diff --git a/README.md b/README.md index 01c6e31..6b43492 100644 --- a/README.md +++ b/README.md @@ -210,6 +210,14 @@ Ponto de atencao: embora os secrets sejam armazenados no OCI Vault, valores gera ## Instalação SEI +### Criação de workspace do Terraform + +``` +terraform workspace new hml|dev|prod +terraform workspace select hml|dev|prod +terraform init| plan | apply --var-file="environments/xxx-terraform.tfvars" +``` + ### Criação de usuários no MySQL ``` @@ -220,4 +228,5 @@ GRANT ALL PRIVILEGES ON sei.* TO 'sei_user'@'%'; GRANT ALL PRIVILEGES ON sip.* TO 'sip_user'@'%'; FLUSH PRIVILEGES; -``` \ No newline at end of file +``` + diff --git a/fss_server.tf b/fss_server.tf index ac929a8..24e8151 100644 --- a/fss_server.tf +++ b/fss_server.tf @@ -1,8 +1,7 @@ - resource "oci_file_storage_file_system" "sei-fss" { availability_domain = data.oci_identity_availability_domain.ad.name compartment_id = var.ocid_compartment_app - display_name = "var.sei_nfs_name-${var.environment}" + display_name = "${var.sei_nfs_name}-${var.environment}" filesystem_snapshot_policy_id = var.fss_backup ? oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id : null } @@ -25,7 +24,7 @@ resource "oci_file_storage_export" "export-dados" { file_system_id = oci_file_storage_file_system.sei-fss.id path = "/dados" export_options { - source = "0.0.0.0/0" #data.oci_core_subnet.app_subnet_ocid.cidr_block + source = var.cidr_subnet_app identity_squash = "NONE" require_privileged_source_port = true access = "READ_WRITE" diff --git a/sei_public_load_balancer.tf b/sei_public_load_balancer.tf index 337022d..9d806c7 100755 --- a/sei_public_load_balancer.tf +++ b/sei_public_load_balancer.tf @@ -13,7 +13,9 @@ resource "oci_load_balancer_load_balancer" "sei_load_balancer_public" { } #------------------------------------------------------------------------------------------------------------------------------------------------ -resource "oci_load_balancer_backend_set" "backend_set_sei_servers" { +#Backend HTTP +resource "oci_load_balancer_backend_set" "backend_set_sei_servers_http" { + count = !var.load_balancer_enable_https ? 1 : 0 health_checker { protocol = "HTTP" interval_ms = "10000" @@ -24,14 +26,15 @@ resource "oci_load_balancer_backend_set" "backend_set_sei_servers" { url_path = "/" } load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id - name = "bs-sei-servers" + name = "bs-sei-servers-http-${var.environment}" policy = "IP_HASH" session_persistence_configuration { cookie_name = "PHPSESSID-SEI" } } -#------------------------------------------------------------------------------------------------------------------------------------------------ -resource "oci_load_balancer_backend_set" "backend_set_sip_servers" { + +resource "oci_load_balancer_backend_set" "backend_set_sip_servers_http" { + count = !var.load_balancer_enable_https ? 1 : 0 health_checker { protocol = "HTTP" interval_ms = "10000" @@ -42,14 +45,15 @@ resource "oci_load_balancer_backend_set" "backend_set_sip_servers" { url_path = "/" } load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id - name = "bs-sip-servers" + name = "bs-sip-servers-http-${var.environment}" policy = "IP_HASH" session_persistence_configuration { cookie_name = "PHPSESSID-SIP" } } -resource "oci_load_balancer_backend_set" "backend_set_solr_servers" { +resource "oci_load_balancer_backend_set" "backend_set_solr_servers_http" { + count = !var.load_balancer_enable_https ? 1 : 0 health_checker { protocol = "HTTP" interval_ms = "10000" @@ -60,79 +64,210 @@ resource "oci_load_balancer_backend_set" "backend_set_solr_servers" { url_path = "/solr" } load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id - name = "bs-solr-servers" + name = "bs-solr-servers-http-${var.environment}" + policy = "IP_HASH" +} + +#Backend HTTPS +resource "oci_load_balancer_backend_set" "backend_set_sei_servers_https" { + count = var.load_balancer_enable_https ? 1 : 0 + health_checker { + protocol = "HTTP" + interval_ms = "10000" + port = "443" + retries = "3" + return_code = "302" + timeout_in_millis = "3000" + url_path = "/" + } + load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id + name = "bs-sei-servers-https-${var.environment}" + policy = "IP_HASH" + session_persistence_configuration { + cookie_name = "PHPSESSID-SEI" + } + ssl_configuration { + cipher_suite_name = "oci-tls-12-13-ssl-cipher-suite-v3" + protocols = [ "TLSv1.2", "TLSv1.3" ] + trusted_certificate_authority_ids = [ var.load_balancer_certificate_bundle_ocid ] + verify_depth = 1 + verify_peer_certificate = false + } +} + +resource "oci_load_balancer_backend_set" "backend_set_sip_servers_https" { + count = var.load_balancer_enable_https ? 1 : 0 + health_checker { + protocol = "HTTP" + interval_ms = "10000" + port = "443" + retries = "3" + return_code = "302" + timeout_in_millis = "3000" + url_path = "/" + } + load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id + name = "bs-sip-servers-https-${var.environment}" + policy = "IP_HASH" + session_persistence_configuration { + cookie_name = "PHPSESSID-SIP" + } + ssl_configuration { + cipher_suite_name = "oci-tls-12-13-ssl-cipher-suite-v3" + protocols = [ "TLSv1.2", "TLSv1.3" ] + trusted_certificate_authority_ids = [ var.load_balancer_certificate_bundle_ocid ] + verify_depth = 1 + verify_peer_certificate = false + } +} + +resource "oci_load_balancer_backend_set" "backend_set_solr_servers_https" { + count = var.load_balancer_enable_https ? 1 : 0 + health_checker { + protocol = "HTTP" + interval_ms = "10000" + port = "8983" + retries = "3" + return_code = "302" + timeout_in_millis = "3000" + url_path = "/solr" + } + load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id + name = "bs-solr-servers-https-${var.environment}" policy = "IP_HASH" } #------------------------------------------------------------------------------------------------------------------------------------------------ -resource "oci_load_balancer_backend" "sip_servers" { - for_each = { for idx, inst in oci_core_instance.sip-instance : idx => inst } - backendset_name = oci_load_balancer_backend_set.backend_set_sip_servers.name +#Backends HTTP +resource "oci_load_balancer_backend" "sip_servers_http" { + for_each = !var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sip-instance : idx => inst } : {} + backendset_name = oci_load_balancer_backend_set.backend_set_sip_servers_http[0].name ip_address = each.value.private_ip load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id port = "80" } +resource "oci_load_balancer_backend" "sei_servers_http" { + for_each = !var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sei-instance : idx => inst } : {} + backendset_name = oci_load_balancer_backend_set.backend_set_sei_servers_http[0].name + ip_address = each.value.private_ip + load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id + port = "80" +} +resource "oci_load_balancer_backend" "solr_servers_http" { + for_each = !var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.solr-instance : idx => inst } : {} + backendset_name = oci_load_balancer_backend_set.backend_set_solr_servers_http[0].name + ip_address = each.value.private_ip + load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id + port = "8983" +} -#------------------------------------------------------------------------------------------------------------------------------------------------ -resource "oci_load_balancer_backend" "sei_servers" { - for_each = { for idx, inst in oci_core_instance.sei-instance : idx => inst } - backendset_name = oci_load_balancer_backend_set.backend_set_sei_servers.name +#Backends HTTPS +resource "oci_load_balancer_backend" "sip_servers_https" { + for_each = var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sip-instance : idx => inst } : {} + backendset_name = oci_load_balancer_backend_set.backend_set_sip_servers_https[0].name + ip_address = each.value.private_ip + load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id + port = 443 +} +resource "oci_load_balancer_backend" "sei_servers_https" { + for_each = var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sei-instance : idx => inst } : {} + backendset_name = oci_load_balancer_backend_set.backend_set_sei_servers_https[0].name ip_address = each.value.private_ip load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id - port = "80" + port = "443" } -#------------------------------------------------------------------------------------------------------------------------------------------------ -resource "oci_load_balancer_backend" "solr_servers" { - for_each = { for idx, inst in oci_core_instance.solr-instance : idx => inst } - backendset_name = oci_load_balancer_backend_set.backend_set_solr_servers.name +resource "oci_load_balancer_backend" "solr_servers_https" { + for_each = var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.solr-instance : idx => inst } : {} + backendset_name = oci_load_balancer_backend_set.backend_set_solr_servers_https[0].name ip_address = each.value.private_ip load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id port = "8983" } #------------------------------------------------------------------------------------------------------------------------------------------------ -resource "oci_load_balancer_listener" "lister_http_sei" { - default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_servers.name +# Listeners HTTP +resource "oci_load_balancer_listener" "lister_http_sei_http" { + count = !var.load_balancer_enable_https ? 1 : 0 + default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_servers_http[0].name load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id - name = "listener-sei" + name = "listener-sei-http-${var.environment}" port = "80" protocol = "HTTP" hostname_names = [ oci_load_balancer_hostname.sei_hostname.name ] } -#------------------------------------------------------------------------------------------------------------------------------------------------ -resource "oci_load_balancer_listener" "lister_http_sip" { - default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_servers.name + +resource "oci_load_balancer_listener" "lister_http_sip_http" { + count = !var.load_balancer_enable_https ? 1 : 0 + default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_servers_http[0].name load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id - name = "listener-sip" + name = "listener-sip-http-${var.environment}" port = "80" protocol = "HTTP" hostname_names = [ oci_load_balancer_hostname.sip_hostname.name ] } -#------------------------------------------------------------------------------------------------------------------------------------------------ -resource "oci_load_balancer_listener" "lister_solr" { - default_backend_set_name = oci_load_balancer_backend_set.backend_set_solr_servers.name + +resource "oci_load_balancer_listener" "lister_solr_http" { + count = !var.load_balancer_enable_https ? 1 : 0 + default_backend_set_name = oci_load_balancer_backend_set.backend_set_solr_servers_http[0].name load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id - name = "listener-solr" + name = "listener-solr-http-${var.environment}" port = "8983" protocol = "HTTP" hostname_names = [ oci_load_balancer_hostname.solr_hostname.name ] } + +# Listeners HTTPs + resource "oci_load_balancer_listener" "lister_sei_https" { + count = var.load_balancer_enable_https ? 1 : 0 + default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_servers_https[0].name + load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id + name = "listener-sei-https-${var.environment}" + port = "443" + protocol = "HTTP" + hostname_names = [ oci_load_balancer_hostname.sei_hostname.name ] + ssl_configuration { + certificate_ids = [ var.load_balancer_certificate_ocid ] + protocols = [ "TLSv1.2", "TLSv1.3" ] + cipher_suite_name = "oci-tls-12-13-ssl-cipher-suite-v3" + verify_peer_certificate = "false" + verify_depth = "1" + } + rule_set_names = [ oci_load_balancer_rule_set.redirectHttpToHttps[0].name ] + } + + resource "oci_load_balancer_listener" "lister_sip_https" { + count = var.load_balancer_enable_https ? 1 : 0 + default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_servers_https[0].name + load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id + name = "listener-sip-https-${var.environment}" + port = "443" + protocol = "HTTP" + hostname_names = [ oci_load_balancer_hostname.sip_hostname.name ] + ssl_configuration { + certificate_ids = [ var.load_balancer_certificate_ocid ] + protocols = [ "TLSv1.2", "TLSv1.3" ] + cipher_suite_name = "oci-tls-12-13-ssl-cipher-suite-v3" + verify_peer_certificate = "false" + verify_depth = "1" + } + rule_set_names = [ oci_load_balancer_rule_set.redirectHttpToHttps[0].name ] + } #------------------------------------------------------------------------------------------------------------------------------------------------ resource "oci_load_balancer_hostname" "sei_hostname" { hostname = var.sei_fqdn load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id - name = "sei-fqdn" + name = "sei-fqdn-${var.environment}" } resource "oci_load_balancer_hostname" "sip_hostname" { hostname = var.sip_fqdn load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id - name = "sip-fqdn" + name = "sip-fqdn-${var.environment}" } resource "oci_load_balancer_hostname" "solr_hostname" { hostname = var.solr_fqdn load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id - name = "solr-fqdn" + name = "solr-fqdn-${var.environment}" } #------------------------------------------------------------------------------------------------------------------------------------------------ resource "oci_logging_log" "lb_access_log" { @@ -169,50 +304,13 @@ resource "oci_logging_log" "lb_error_log" { retention_duration = 30 } - -# resource "oci_load_balancer_listener" "lister_sei_https" { -# default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_apps.name -# load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id -# name = "listener-sei-https" -# port = "443" -# protocol = "HTTP" -# hostname_names = [ oci_load_balancer_hostname.sei_hostname.name ] -# ssl_configuration { -# certificate_ids = [ "ocid1.certificate.oc1.sa-saopaulo-1.amaaaaaaz63sg4iagucp6pedtfwbxd3oxud5ds7atsgsf2a6lwi6c5nnv7va" ] -# protocols = [ "TLSv1.2", "TLSv1.3" ] -# cipher_suite_name = "oci-default-ssl-cipher-suite-v1" -# verify_peer_certificate = "false" -# verify_depth = "1" -# } -# rule_set_names = [ oci_load_balancer_rule_set.redirectHttpToHttps.name ] -# } -# -# resource "oci_load_balancer_listener" "lister_sip_https" { -# default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_apps.name -# load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id -# name = "listener-sip-https" -# port = "443" -# protocol = "HTTP" -# hostname_names = [ oci_load_balancer_hostname.sip_hostname.name ] -# ssl_configuration { -# certificate_ids = [ "ocid1.certificate.oc1.sa-saopaulo-1.amaaaaaaz63sg4iagucp6pedtfwbxd3oxud5ds7atsgsf2a6lwi6c5nnv7va" ] -# protocols = [ "TLSv1.2", "TLSv1.3" ] -# cipher_suite_name = "oci-default-ssl-cipher-suite-v1" -# verify_peer_certificate = "false" -# verify_depth = "1" -# } -# } -##----- resource "oci_load_balancer_rule_set" "redirectHttpToHttps" { - count = var.load_balancer_enable_https == "true" ? 1 : 0 + count = var.load_balancer_enable_https ? 1 : 0 items { action = "REDIRECT" conditions { - #Required attribute_name = "PATH" attribute_value = "/" - - #Optional operator = "FORCE_LONGEST_PREFIX_MATCH" } redirect_uri { @@ -222,7 +320,6 @@ resource "oci_load_balancer_rule_set" "redirectHttpToHttps" { path = "/{path}" query = "?{query}" } - response_code = 302 } load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id diff --git a/terraform.tfvars b/terraform.tfvars deleted file mode 100644 index 7634261..0000000 --- a/terraform.tfvars +++ /dev/null @@ -1,97 +0,0 @@ -#================================================================================================================================================================================================ -# Parameters to authenticate with Oracle Cloud Infrastructure -tenancy_ocid = "" -user_ocid = "" -fingerprint = "" -private_key_path = "" -region = "" - -#================================================================================================================================================================================================ -# The environment that you're creating resources for: test, dev, prod, or staging -environment="hml" -#================================================================================================================================================================================================ -# The environment compartments -ocid_compartment_app = "" -ocid_compartment_database = "" -ocid_compartment_security = "" -ocid_compartment_networking = "" -#================================================================================================================================================================================================ -# The environment networks -ocid_vcn_3_tier = "" -ocid_subnet_app = "" -ocid_subnet_database = "" -ocid_subnet_public = "" -#================================================================================================================================================================================================ -# The CIDR networks -cidr_subnet_app = "" -cidr_subnet_database = "" -cidr_subnet_web = "" -cidr_anywhere = "0.0.0.0/0" -#================================================================================================================================================================================================ -# SEI Variables -sei_amount_instances = "1" -sei_prefix_hostname = "sei-server" -sei_shape = "VM.Standard.E4.Flex" -sei_amount_memory = "4" -sei_amount_ocpus = "1" -sei_fqdn = "" -#================================================================================================================================================================================================ -# SIP Variables -sip_amount_instances = "1" -sip_prefix_hostname = "sip-server" -sip_shape = "VM.Standard.E6.Flex" -sip_amount_memory = "4" -sip_amount_ocpus = "1" -sip_fqdn = "" -#================================================================================================================================================================================================ -# SOLR Variables -solr_amount_instances = "1" -solr_prefix_hostname = "solr-server" -solr_shape = "VM.Standard.E6.Flex" -solr_amount_memory = "8" -solr_amount_ocpus = "2" -solr_boot_disk_size = "200" -solr_fqdn = "" -#================================================================================================================================================================================================ -# Memcached Variables -memcached_amount_instances = "1" -memcached_prefix_hostname = "memcached-server" -memcached_shape = "VM.Standard.E6.Flex" -memcached_amount_memory = "4" -memcached_amount_ocpus = "1" -#================================================================================================================================================================================================ -# JodServer Variables -jod_amount_instances = "1" -jod_prefix_hostname = "jod-server" -jod_shape = "VM.Standard.E6.Flex" -jod_amount_memory = "4" -jod_amount_ocpus = "1" -#================================================================================================================================================================================================ -# Public Load Balancer Variables -load_balancer_prefix_hostname= "sei-load-balancer" -load_balancer_minimum_bandwidth_in_mbps = "100" -load_balancer_maximum_bandwidth_in_mbps = "500" -load_balancer_enable_https = false -#================================================================================================================================================================================================ -# FSS Variables -fss_backup = false -sei_nfs_name = "nfs-sei" -#================================================================================================================================================================================================ -# WAF Variables -enable_waf = false -#================================================================================================================================================================================================ -# Boot Volume Backup Variables -enable_boot_volume_backup = false -#================================================================================================================================================================================================ -#Mysql Configurations -mysql_database_name = "" -mysql_database_version = "8.4.9" -mysql_database_user_name = "admin" -mysql_database_storage_size = "500" -mysql_shape = "MySQL.2" -mysql_backup_retention_in_days = "30" -mysql_highly_available = "false" -mysql_contacts_email = "" -mysql_enable_heatwave = "false" -mysql_amount_nodes_heatwave = "0" -mysql_heatwave_shape = "HeatWave.512GB" \ No newline at end of file diff --git a/variables.tf b/variables.tf index 68c01b9..41e3849 100644 --- a/variables.tf +++ b/variables.tf @@ -64,6 +64,9 @@ variable "load_balancer_prefix_hostname" {} variable "load_balancer_maximum_bandwidth_in_mbps" {} variable "load_balancer_minimum_bandwidth_in_mbps" {} variable "load_balancer_enable_https" {} +variable "load_balancer_certificate_ocid" {} +variable "load_balancer_certificate_bundle_ocid" {} + # FSS variable "fss_backup" {} variable "sei_nfs_name" {}