Major Improvemnts

2026-09-01 18:28:09 -03:00
parent d16ddace1f
commit 4a3c0a8f72
5 changed files with 184 additions and 173 deletions
--- a/README.md
+++ b/README.md
@@ -210,6 +210,14 @@ Ponto de atencao: embora os secrets sejam armazenados no OCI Vault, valores gera

 ## Instalação SEI

+### Criação de workspace do Terraform
+
+```
+terraform workspace new hml|dev|prod
+terraform workspace select hml|dev|prod
+terraform init| plan | apply --var-file="environments/xxx-terraform.tfvars"
+```
+
 ### Criação de usuários no MySQL

 ```
@@ -220,4 +228,5 @@ GRANT ALL PRIVILEGES ON sei.* TO 'sei_user'@'%';
 GRANT ALL PRIVILEGES ON sip.* TO 'sip_user'@'%';

 FLUSH PRIVILEGES;
-```
+```
+
--- a/fss_server.tf
+++ b/fss_server.tf
@@ -1,8 +1,7 @@
-
 resource "oci_file_storage_file_system" "sei-fss" {
  availability_domain = data.oci_identity_availability_domain.ad.name
  compartment_id = var.ocid_compartment_app
-  display_name = "var.sei_nfs_name-${var.environment}"
+  display_name = "${var.sei_nfs_name}-${var.environment}"
  filesystem_snapshot_policy_id = var.fss_backup ? oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id : null
 }

@@ -25,7 +24,7 @@ resource "oci_file_storage_export" "export-dados" {
  file_system_id = oci_file_storage_file_system.sei-fss.id
  path = "/dados"
  export_options {
-      source                        = "0.0.0.0/0" #data.oci_core_subnet.app_subnet_ocid.cidr_block
+      source                        = var.cidr_subnet_app
      identity_squash               = "NONE"
      require_privileged_source_port = true
      access                        = "READ_WRITE"
--- a/sei_public_load_balancer.tf
+++ b/sei_public_load_balancer.tf
@@ -13,7 +13,9 @@ resource "oci_load_balancer_load_balancer" "sei_load_balancer_public" {
 }

 #------------------------------------------------------------------------------------------------------------------------------------------------
-resource "oci_load_balancer_backend_set" "backend_set_sei_servers" {
+#Backend HTTP
+resource "oci_load_balancer_backend_set" "backend_set_sei_servers_http" {
+    count = !var.load_balancer_enable_https ? 1 : 0
    health_checker {
        protocol = "HTTP"
        interval_ms = "10000"
@@ -24,14 +26,15 @@ resource "oci_load_balancer_backend_set" "backend_set_sei_servers" {
        url_path = "/"
    }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-    name = "bs-sei-servers"
+    name = "bs-sei-servers-http-${var.environment}"
    policy = "IP_HASH"
    session_persistence_configuration {
        cookie_name = "PHPSESSID-SEI"
    } 
 }
-#------------------------------------------------------------------------------------------------------------------------------------------------
-resource "oci_load_balancer_backend_set" "backend_set_sip_servers" {
+
+resource "oci_load_balancer_backend_set" "backend_set_sip_servers_http" {
+    count = !var.load_balancer_enable_https ? 1 : 0
    health_checker {
        protocol = "HTTP"
        interval_ms = "10000"
@@ -42,14 +45,15 @@ resource "oci_load_balancer_backend_set" "backend_set_sip_servers" {
        url_path = "/"
    }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-    name = "bs-sip-servers"
+    name = "bs-sip-servers-http-${var.environment}"
    policy = "IP_HASH"
    session_persistence_configuration {
      cookie_name = "PHPSESSID-SIP"
    } 
 }

-resource "oci_load_balancer_backend_set" "backend_set_solr_servers" {
+resource "oci_load_balancer_backend_set" "backend_set_solr_servers_http" {
+    count = !var.load_balancer_enable_https ? 1 : 0
    health_checker {
        protocol = "HTTP"
        interval_ms = "10000"
@@ -60,79 +64,210 @@ resource "oci_load_balancer_backend_set" "backend_set_solr_servers" {
        url_path = "/solr"
    }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-    name = "bs-solr-servers"
+    name = "bs-solr-servers-http-${var.environment}"
+    policy = "IP_HASH"
+}
+
+#Backend HTTPS
+resource "oci_load_balancer_backend_set" "backend_set_sei_servers_https" {
+    count = var.load_balancer_enable_https ? 1 : 0
+    health_checker {
+        protocol = "HTTP"
+        interval_ms = "10000"
+        port = "443"
+        retries = "3"
+        return_code = "302"
+        timeout_in_millis = "3000"
+        url_path = "/"
+    }
+    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
+    name = "bs-sei-servers-https-${var.environment}"
+    policy = "IP_HASH"
+    session_persistence_configuration {
+        cookie_name = "PHPSESSID-SEI"
+    }
+    ssl_configuration {
+        cipher_suite_name                 = "oci-tls-12-13-ssl-cipher-suite-v3"
+        protocols                         = [ "TLSv1.2", "TLSv1.3" ]
+        trusted_certificate_authority_ids = [ var.load_balancer_certificate_bundle_ocid ]
+        verify_depth                      = 1
+        verify_peer_certificate           = false
+    }
+}
+
+resource "oci_load_balancer_backend_set" "backend_set_sip_servers_https" {
+    count = var.load_balancer_enable_https ? 1 : 0
+    health_checker {
+        protocol = "HTTP"
+        interval_ms = "10000"
+        port = "443"
+        retries = "3"
+        return_code = "302"
+        timeout_in_millis = "3000"
+        url_path = "/"
+    }
+    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
+    name = "bs-sip-servers-https-${var.environment}"
+    policy = "IP_HASH"
+    session_persistence_configuration {
+      cookie_name = "PHPSESSID-SIP"
+    } 
+    ssl_configuration {
+        cipher_suite_name                 = "oci-tls-12-13-ssl-cipher-suite-v3"
+        protocols                         = [ "TLSv1.2", "TLSv1.3" ]
+        trusted_certificate_authority_ids = [ var.load_balancer_certificate_bundle_ocid ]
+        verify_depth                      = 1
+        verify_peer_certificate           = false
+    }
+}
+
+resource "oci_load_balancer_backend_set" "backend_set_solr_servers_https" {
+    count = var.load_balancer_enable_https ? 1 : 0
+    health_checker {
+        protocol = "HTTP"
+        interval_ms = "10000"
+        port = "8983"
+        retries = "3"
+        return_code = "302"
+        timeout_in_millis = "3000"
+        url_path = "/solr"
+    }
+    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
+    name = "bs-solr-servers-https-${var.environment}"
    policy = "IP_HASH"
 }

 #------------------------------------------------------------------------------------------------------------------------------------------------
-resource "oci_load_balancer_backend" "sip_servers" {
-  for_each = { for idx, inst in oci_core_instance.sip-instance : idx => inst }
-  backendset_name   = oci_load_balancer_backend_set.backend_set_sip_servers.name
+#Backends HTTP
+resource "oci_load_balancer_backend" "sip_servers_http" {
+  for_each = !var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sip-instance : idx => inst } : {}
+  backendset_name   = oci_load_balancer_backend_set.backend_set_sip_servers_http[0].name
  ip_address        = each.value.private_ip
  load_balancer_id  = oci_load_balancer_load_balancer.sei_load_balancer_public.id
  port              = "80"
 }
+resource "oci_load_balancer_backend" "sei_servers_http" {
+  for_each = !var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sei-instance : idx => inst } : {}
+  backendset_name   = oci_load_balancer_backend_set.backend_set_sei_servers_http[0].name
+  ip_address        = each.value.private_ip
+  load_balancer_id  = oci_load_balancer_load_balancer.sei_load_balancer_public.id
+  port              = "80"
+}
+resource "oci_load_balancer_backend" "solr_servers_http" {
+  for_each = !var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.solr-instance : idx => inst } : {}
+  backendset_name   = oci_load_balancer_backend_set.backend_set_solr_servers_http[0].name
+  ip_address        = each.value.private_ip
+  load_balancer_id  = oci_load_balancer_load_balancer.sei_load_balancer_public.id
+  port              = "8983"
+}

-#------------------------------------------------------------------------------------------------------------------------------------------------
-resource "oci_load_balancer_backend" "sei_servers" {
-  for_each = { for idx, inst in oci_core_instance.sei-instance : idx => inst }
-  backendset_name   = oci_load_balancer_backend_set.backend_set_sei_servers.name
+#Backends HTTPS
+resource "oci_load_balancer_backend" "sip_servers_https" {
+  for_each = var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sip-instance : idx => inst } : {}
+  backendset_name  = oci_load_balancer_backend_set.backend_set_sip_servers_https[0].name
+  ip_address       = each.value.private_ip
+  load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
+  port             = 443
+}
+resource "oci_load_balancer_backend" "sei_servers_https" {
+  for_each = var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sei-instance : idx => inst } : {}
+  backendset_name   = oci_load_balancer_backend_set.backend_set_sei_servers_https[0].name
  ip_address        = each.value.private_ip
  load_balancer_id  = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-  port              = "80"
+  port              = "443"
 }
-#------------------------------------------------------------------------------------------------------------------------------------------------
-resource "oci_load_balancer_backend" "solr_servers" {
-  for_each = { for idx, inst in oci_core_instance.solr-instance : idx => inst }
-  backendset_name   = oci_load_balancer_backend_set.backend_set_solr_servers.name
+resource "oci_load_balancer_backend" "solr_servers_https" {
+  for_each = var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.solr-instance : idx => inst } : {}
+  backendset_name   = oci_load_balancer_backend_set.backend_set_solr_servers_https[0].name
  ip_address        = each.value.private_ip
  load_balancer_id  = oci_load_balancer_load_balancer.sei_load_balancer_public.id
  port              = "8983"
 }
 #------------------------------------------------------------------------------------------------------------------------------------------------
-resource "oci_load_balancer_listener" "lister_http_sei" {
-    default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_servers.name
+# Listeners HTTP
+resource "oci_load_balancer_listener" "lister_http_sei_http" {
+    count = !var.load_balancer_enable_https ? 1 : 0
+    default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_servers_http[0].name
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-    name = "listener-sei"
+    name = "listener-sei-http-${var.environment}"
    port = "80"
    protocol = "HTTP"
    hostname_names = [ oci_load_balancer_hostname.sei_hostname.name ]
 }
-#------------------------------------------------------------------------------------------------------------------------------------------------
-resource "oci_load_balancer_listener" "lister_http_sip" {
-    default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_servers.name
+
+resource "oci_load_balancer_listener" "lister_http_sip_http" {
+    count = !var.load_balancer_enable_https ? 1 : 0
+    default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_servers_http[0].name
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-    name = "listener-sip"
+    name = "listener-sip-http-${var.environment}"
    port = "80"
    protocol = "HTTP"
    hostname_names = [ oci_load_balancer_hostname.sip_hostname.name ]
 }
-#------------------------------------------------------------------------------------------------------------------------------------------------
-resource "oci_load_balancer_listener" "lister_solr" {
-    default_backend_set_name = oci_load_balancer_backend_set.backend_set_solr_servers.name
+
+resource "oci_load_balancer_listener" "lister_solr_http" {
+    count = !var.load_balancer_enable_https ? 1 : 0
+    default_backend_set_name = oci_load_balancer_backend_set.backend_set_solr_servers_http[0].name
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-    name = "listener-solr"
+    name = "listener-solr-http-${var.environment}"
    port = "8983"
    protocol = "HTTP"
    hostname_names = [ oci_load_balancer_hostname.solr_hostname.name ]
 }
+
+# Listeners HTTPs
+  resource "oci_load_balancer_listener" "lister_sei_https" {
+      count = var.load_balancer_enable_https ? 1 : 0
+      default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_servers_https[0].name
+      load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
+      name = "listener-sei-https-${var.environment}"
+      port = "443"
+      protocol = "HTTP"
+      hostname_names = [ oci_load_balancer_hostname.sei_hostname.name ]
+      ssl_configuration {
+          certificate_ids = [ var.load_balancer_certificate_ocid ]
+          protocols = [ "TLSv1.2", "TLSv1.3" ] 
+          cipher_suite_name = "oci-tls-12-13-ssl-cipher-suite-v3"
+          verify_peer_certificate = "false"
+          verify_depth = "1"
+      }
+      rule_set_names = [ oci_load_balancer_rule_set.redirectHttpToHttps[0].name ]
+  }
+
+  resource "oci_load_balancer_listener" "lister_sip_https" {
+      count = var.load_balancer_enable_https ? 1 : 0
+      default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_servers_https[0].name
+      load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
+      name = "listener-sip-https-${var.environment}"
+      port = "443"
+      protocol = "HTTP"
+      hostname_names = [ oci_load_balancer_hostname.sip_hostname.name ]
+      ssl_configuration {
+          certificate_ids = [ var.load_balancer_certificate_ocid ]
+          protocols = [ "TLSv1.2", "TLSv1.3" ] 
+          cipher_suite_name = "oci-tls-12-13-ssl-cipher-suite-v3"
+          verify_peer_certificate = "false"
+          verify_depth = "1"
+      }
+      rule_set_names = [ oci_load_balancer_rule_set.redirectHttpToHttps[0].name ]
+  }
 #------------------------------------------------------------------------------------------------------------------------------------------------
 resource "oci_load_balancer_hostname" "sei_hostname" {
    hostname = var.sei_fqdn
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-    name = "sei-fqdn"
+    name = "sei-fqdn-${var.environment}"
 }

 resource "oci_load_balancer_hostname" "sip_hostname" {
    hostname = var.sip_fqdn
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-    name = "sip-fqdn"
+    name = "sip-fqdn-${var.environment}"
 }

 resource "oci_load_balancer_hostname" "solr_hostname" {
    hostname = var.solr_fqdn
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-    name = "solr-fqdn"
+    name = "solr-fqdn-${var.environment}"
 }
 #------------------------------------------------------------------------------------------------------------------------------------------------
 resource "oci_logging_log" "lb_access_log" {
@@ -169,50 +304,13 @@ resource "oci_logging_log" "lb_error_log" {
  retention_duration = 30
 }

-
-#  resource "oci_load_balancer_listener" "lister_sei_https" {
-#      default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_apps.name
-#      load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-#      name = "listener-sei-https"
-#      port = "443"
-#      protocol = "HTTP"
-#      hostname_names = [ oci_load_balancer_hostname.sei_hostname.name ]
-#      ssl_configuration {
-#          certificate_ids = [ "ocid1.certificate.oc1.sa-saopaulo-1.amaaaaaaz63sg4iagucp6pedtfwbxd3oxud5ds7atsgsf2a6lwi6c5nnv7va" ]
-#          protocols = [ "TLSv1.2", "TLSv1.3" ] 
-#          cipher_suite_name = "oci-default-ssl-cipher-suite-v1"
-#          verify_peer_certificate = "false"
-#          verify_depth = "1"
-#      }
-#      rule_set_names = [ oci_load_balancer_rule_set.redirectHttpToHttps.name ]
-#  }
-#
-#  resource "oci_load_balancer_listener" "lister_sip_https" {
-#      default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_apps.name
-#      load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
-#      name = "listener-sip-https"
-#      port = "443"
-#      protocol = "HTTP"
-#      hostname_names = [ oci_load_balancer_hostname.sip_hostname.name ]
-#      ssl_configuration {
-#          certificate_ids = [ "ocid1.certificate.oc1.sa-saopaulo-1.amaaaaaaz63sg4iagucp6pedtfwbxd3oxud5ds7atsgsf2a6lwi6c5nnv7va" ]
-#          protocols = [ "TLSv1.2", "TLSv1.3" ] 
-#          cipher_suite_name = "oci-default-ssl-cipher-suite-v1"
-#          verify_peer_certificate = "false"
-#          verify_depth = "1"
-#      }
-#  }
-##-----
 resource "oci_load_balancer_rule_set" "redirectHttpToHttps" {
-    count = var.load_balancer_enable_https == "true" ? 1 : 0
+    count = var.load_balancer_enable_https ? 1 : 0
    items {
        action = "REDIRECT"
        conditions {
-            #Required
            attribute_name = "PATH"
            attribute_value = "/"
-
-            #Optional
            operator = "FORCE_LONGEST_PREFIX_MATCH"
        }
      redirect_uri {
@@ -222,7 +320,6 @@ resource "oci_load_balancer_rule_set" "redirectHttpToHttps" {
        path     = "/{path}"
        query = "?{query}"
    }
-
    response_code = 302
  }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
--- a/terraform.tfvars
+++ b/terraform.tfvars
@@ -1,97 +0,0 @@
-#================================================================================================================================================================================================
-# Parameters to authenticate with Oracle Cloud Infrastructure
-tenancy_ocid = ""
-user_ocid = ""
-fingerprint = ""
-private_key_path = ""
-region = ""
-
-#================================================================================================================================================================================================
-# The environment that you're creating resources for: test, dev, prod, or staging
-environment="hml"
-#================================================================================================================================================================================================
-# The environment compartments
-ocid_compartment_app = ""
-ocid_compartment_database = ""
-ocid_compartment_security = ""
-ocid_compartment_networking = ""
-#================================================================================================================================================================================================
-# The environment networks
-ocid_vcn_3_tier = ""
-ocid_subnet_app = ""
-ocid_subnet_database = ""
-ocid_subnet_public = ""
-#================================================================================================================================================================================================
-# The CIDR networks
-cidr_subnet_app = ""
-cidr_subnet_database = ""
-cidr_subnet_web = ""
-cidr_anywhere = "0.0.0.0/0"
-#================================================================================================================================================================================================
-# SEI Variables
-sei_amount_instances = "1"
-sei_prefix_hostname = "sei-server"
-sei_shape = "VM.Standard.E4.Flex"
-sei_amount_memory = "4"
-sei_amount_ocpus = "1"
-sei_fqdn = ""
-#================================================================================================================================================================================================
-# SIP Variables
-sip_amount_instances = "1"
-sip_prefix_hostname = "sip-server"
-sip_shape = "VM.Standard.E6.Flex"
-sip_amount_memory = "4"
-sip_amount_ocpus = "1"
-sip_fqdn = ""
-#================================================================================================================================================================================================
-# SOLR Variables
-solr_amount_instances = "1"
-solr_prefix_hostname = "solr-server"
-solr_shape = "VM.Standard.E6.Flex"
-solr_amount_memory = "8"
-solr_amount_ocpus = "2"
-solr_boot_disk_size = "200"
-solr_fqdn = ""
-#================================================================================================================================================================================================
-# Memcached Variables
-memcached_amount_instances = "1"
-memcached_prefix_hostname = "memcached-server"
-memcached_shape = "VM.Standard.E6.Flex"
-memcached_amount_memory = "4"
-memcached_amount_ocpus = "1"
-#================================================================================================================================================================================================
-# JodServer Variables
-jod_amount_instances = "1"
-jod_prefix_hostname = "jod-server"
-jod_shape = "VM.Standard.E6.Flex"
-jod_amount_memory = "4"
-jod_amount_ocpus = "1"
-#================================================================================================================================================================================================
-# Public Load Balancer Variables
-load_balancer_prefix_hostname= "sei-load-balancer"
-load_balancer_minimum_bandwidth_in_mbps = "100"
-load_balancer_maximum_bandwidth_in_mbps = "500"
-load_balancer_enable_https = false
-#================================================================================================================================================================================================
-# FSS Variables
-fss_backup = false
-sei_nfs_name = "nfs-sei"
-#================================================================================================================================================================================================
-# WAF Variables
-enable_waf = false
-#================================================================================================================================================================================================
-# Boot Volume Backup Variables
-enable_boot_volume_backup = false
-#================================================================================================================================================================================================
-#Mysql Configurations 
-mysql_database_name = ""
-mysql_database_version = "8.4.9"
-mysql_database_user_name = "admin"
-mysql_database_storage_size = "500"
-mysql_shape = "MySQL.2"
-mysql_backup_retention_in_days = "30"
-mysql_highly_available = "false"
-mysql_contacts_email = ""
-mysql_enable_heatwave = "false"
-mysql_amount_nodes_heatwave = "0" 
-mysql_heatwave_shape = "HeatWave.512GB"
--- a/variables.tf
+++ b/variables.tf
@@ -64,6 +64,9 @@ variable "load_balancer_prefix_hostname" {}
 variable "load_balancer_maximum_bandwidth_in_mbps" {} 
 variable "load_balancer_minimum_bandwidth_in_mbps" {} 
 variable "load_balancer_enable_https" {}
+variable "load_balancer_certificate_ocid" {}
+variable "load_balancer_certificate_bundle_ocid" {}
+
 # FSS
 variable "fss_backup" {} 
 variable "sei_nfs_name" {}