guilherme.silva/iac-sei
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pontual Fix

Browse Source
This commit is contained in:
Guilherme Silva
2026-09-02 08:38:27 -03:00
parent 9ed5e6ec51
commit c9ec31ca92
6 changed files with 61 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
fss_server.tf
View File

@@ -2,7 +2,8 @@ resource "oci_file_storage_file_system" "sei-fss" {
availability_domain = data.oci_identity_availability_domain.ad.name
compartment_id = var.ocid_compartment_app
display_name = "${var.sei_nfs_name}-${var.environment}"
filesystem_snapshot_policy_id = var.fss_backup ? oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id : null
#filesystem_snapshot_policy_id = var.fss_backup ? oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id : null
filesystem_snapshot_policy_id = var.fss_backup ? ( oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id) : null
}
resource "oci_file_storage_mount_target" "mount-target-sei" {
@@ -32,14 +33,15 @@ resource "oci_file_storage_export" "export-dados" {
}
}
resource "oci_file_storage_filesystem_snapshot_policy" "sei_filesystem_snapshot_policy" {
count = var.fss_backup == "true" ? 1 : 0
count = var.fss_backup ? 1 : 0
availability_domain = data.oci_identity_availability_domain.ad.name
compartment_id = var.ocid_compartment_app
display_name = "sei-fss-snapshot-policy-${var.environment}"
display_name = "sei-${var.environment}-snapshot-policy"
policy_prefix = "fss-sei-${var.environment}"
schedules {
period = "DAILY"
time_zone = "REGIONAL_DATA_CENTER_TIME"
hour_of_day = "23"
retention_duration_in_seconds = var.fss_snapshot_retention_in_days * 86400
}
}

19
logging_group.tf
View File

@@ -1,4 +1,19 @@
resource "oci_logging_log_group" "sei_log_group" {
resource "oci_logging_log_group" "sei_log_group_app" {
compartment_id = var.ocid_compartment_app
display_name = "sei-log-group-${var.environment}"
display_name = "aplications-log-group-${var.environment}"
}
resource "oci_logging_log_group" "sei_log_group_network" {
compartment_id = var.ocid_compartment_networking
display_name = "network-log-group-${var.environment}"
}
resource "oci_logging_log_group" "sei_log_group_security" {
compartment_id = var.ocid_compartment_security
display_name = "security-log-group-${var.environment}"
}
resource "oci_logging_log_group" "sei_log_group_database" {
compartment_id = var.ocid_compartment_database
display_name = "database-log-group-${var.environment}"
}

24
mysql-sei.tf
View File

@@ -8,48 +8,38 @@ resource "oci_mysql_mysql_configuration" "sei_mysql_configuration" {
name = "lower_case_table_names"
value = "CASE_SENSITIVE"
}
options {
name = "character_set_server"
value = "LATIN1"
}
options {
name = "collation_server"
value = "LATIN1_SWEDISH_CI"
}
options {
name = "character_set_client"
value = "LATIN1"
}
options {
name = "character_set_connection"
value = "LATIN1"
}
options {
name = "character_set_results"
value = "LATIN1"
}
options {
name = "collation_connection"
value = "LATIN1_SWEDISH_CI"
}
options {
name = "init_connect"
value = "SET NAMES latin1"
}
options {
name = "sql_require_primary_key"
value = "OFF"
}
}
resource "oci_mysql_mysql_db_system" "sei_mysql_dbsystem" {
@@ -77,35 +67,33 @@ resource "oci_mysql_mysql_db_system" "sei_mysql_dbsystem" {
shape_name = var.mysql_shape
state = "ACTIVE"
subnet_id = var.ocid_subnet_database
data_storage {
is_auto_expand_storage_enabled = false
}
deletion_policy {
automatic_backup_retention = "RETAIN"
final_backup = "REQUIRE_FINAL_BACKUP"
is_delete_protected = true
}
encrypt_data {
key_generation_type = "SYSTEM"
}
maintenance {
window_start_time = "SUNDAY 00:00"
window_start_time = "SATURDAY 00:00"
}
read_endpoint {
exclude_ips = []
is_enabled = false
}
secure_connections {
certificate_generation_type = "SYSTEM"
}
source {
source_type = "NONE"
}
backup_policy {
is_enabled = var.mysql_automatic_backup_enabled
retention_in_days = var.mysql_backup_retention_in_days
window_start_time = "01:00-00:00"
}
}

4
sei_public_load_balancer.tf
View File

@@ -290,7 +290,7 @@ resource "oci_load_balancer_hostname" "solr_hostname" {
#------------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_logging_log" "lb_access_log" {
display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-access-log"
log_group_id = oci_logging_log_group.sei_log_group.id
log_group_id = oci_logging_log_group.sei_log_group_network.id
log_type = "SERVICE"
configuration {
@@ -307,7 +307,7 @@ resource "oci_logging_log" "lb_access_log" {
resource "oci_logging_log" "lb_error_log" {
display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-error-log"
log_group_id = oci_logging_log_group.sei_log_group.id
log_group_id = oci_logging_log_group.sei_log_group_network.id
log_type = "SERVICE"
configuration {

41
sei_waf.tf
View File

@@ -1,6 +1,6 @@
resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
count = var.enable_waf == "true" ? 1 : 0
compartment_id = var.ocid_compartment_networking
count = var.enable_waf ? 1 : 0
compartment_id = var.ocid_compartment_security
display_name = "sei-waf-policy-${var.environment}-v01"
actions {
code = 0
@@ -32,12 +32,29 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
actions {
code = 403
name = "Deny Country"
name = "403 - Response Code Action for protection rules"
type = "RETURN_HTTP_RESPONSE"
body {
text = jsonencode({
code = "403"
message = "This is country is Forbidden request"
message = "Your request was blocked by OCI WAF security policy. Please contact the system administrator for assistance."
})
type = "STATIC_TEXT"
}
headers {
name = "Content-Type"
value = "application/json"
}
}
actions {
code = 403
name = "403 - Response Code Action for country"
type = "RETURN_HTTP_RESPONSE"
body {
text = jsonencode({
code = "403"
message = "Your country request was blocked by OCI WAF security policy. Please contact the system administrator for assistance."
})
type = "STATIC_TEXT"
}
@@ -49,7 +66,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
request_access_control {
default_action_name = "Pre-configured Allow Action"
rules {
action_name = "Deny Country"
action_name = "403 - Response Code Action for country"
condition = "!i_contains(['BR'], connection.source.geo.countryCode)"
condition_language = "JMESPATH"
name = "Allow Countries"
@@ -57,9 +74,9 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
}
}
request_protection {
body_inspection_size_limit_in_bytes = 8192
body_inspection_size_limit_in_bytes = 8192
rules {
action_name = "Pre-configured Check Action"
action_name = "403 - Response Code Action for protection rules"
condition_language = "JMESPATH"
is_body_inspection_enabled = true
name = "recommended-protection-rules"
@@ -166,7 +183,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
}
}
rules {
action_name = "Pre-configured Check Action"
action_name = "403 - Response Code Action for protection rules"
condition_language = "JMESPATH"
is_body_inspection_enabled = true
name = "mysql-protection-rules"
@@ -213,7 +230,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
}
}
rules {
action_name = "Pre-configured Check Action"
action_name = "403 - Response Code Action for protection rules"
condition_language = "JMESPATH"
is_body_inspection_enabled = true
name = "php-protection-rules"
@@ -435,7 +452,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
}
}
rules {
action_name = "Pre-configured Check Action"
action_name = "403 - Response Code Action for protection rules"
condition_language = "JMESPATH"
is_body_inspection_enabled = true
name = "apache-protection-rules"
@@ -585,7 +602,7 @@ resource "oci_waf_web_app_firewall" "sei_public_load_balancer_waf" {
resource "oci_logging_log" "waf_log_lb_public" {
count = var.enable_waf ? 1 : 0
display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-waf-log"
log_group_id = oci_logging_log_group.sei_log_group.id
log_group_id = oci_logging_log_group.sei_log_group_security.id
log_type = "SERVICE"
configuration {
source {
@@ -594,7 +611,7 @@ resource "oci_logging_log" "waf_log_lb_public" {
service = "waf"
source_type = "OCISERVICE"
}
compartment_id = var.ocid_compartment_security
compartment_id = var.ocid_compartment_security
}
is_enabled = "true"
retention_duration = "30"

2
variables.tf
View File

@@ -69,6 +69,7 @@ variable "load_balancer_certificate_bundle_ocid" {}
# FSS
variable "fss_backup" {}
variable "fss_snapshot_retention_in_days" {}
variable "sei_nfs_name" {}
# WAF
@@ -89,6 +90,7 @@ variable "mysql_database_version" {}
variable "mysql_database_user_name" {}
variable "mysql_database_storage_size" {}
variable "mysql_shape" {}
variable "mysql_automatic_backup_enabled" {}
variable "mysql_backup_retention_in_days" {}
variable "mysql_highly_available" {}
variable "mysql_contacts_email" {}