diff --git a/generation_keys.tf b/generation_keys.tf index dbb3938..dd855e5 100755 --- a/generation_keys.tf +++ b/generation_keys.tf @@ -7,7 +7,7 @@ resource "oci_vault_secret" "sei_oci_vault_secret_private_key" { compartment_id = var.ocid_compartment_security vault_id = oci_kms_vault.vault-sei.id key_id = oci_kms_key.sei-vault-keys.id - secret_name = "master-private-ssh-key" + secret_name = "master-private-ssh-key-${var.environment}" secret_content { content_type = "BASE64" content = base64encode(tls_private_key.master_ssh_key.private_key_openssh) @@ -18,7 +18,7 @@ resource "oci_vault_secret" "sei_oci_vault_secret_pulbic_key" { compartment_id = var.ocid_compartment_security vault_id = oci_kms_vault.vault-sei.id key_id = oci_kms_key.sei-vault-keys.id - secret_name = "master-public-ssh-key" + secret_name = "master-public-ssh-key-${var.environment}" secret_content { content_type = "BASE64" content = base64encode(tls_private_key.master_ssh_key.public_key_openssh) @@ -38,10 +38,9 @@ resource "oci_vault_secret" "sei_oci_vault_secret_mysql" { compartment_id = var.ocid_compartment_security vault_id = oci_kms_vault.vault-sei.id key_id = oci_kms_key.sei-vault-keys.id - secret_name = "master-mysql-password" + secret_name = "master-mysql-password-${var.environment}" secret_content { content_type = "BASE64" content = base64encode(random_password.password_mysql_admin.result) } -} - +} \ No newline at end of file diff --git a/mysql-sei.tf b/mysql-sei.tf index 708a3d9..8071187 100755 --- a/mysql-sei.tf +++ b/mysql-sei.tf @@ -1,7 +1,7 @@ resource "oci_mysql_mysql_configuration" "sei_mysql_configuration" { compartment_id = var.ocid_compartment_database description = "Copy of: MySQL.2.Standalone\nDefault standalone configuration for the ${var.mysql_shape} MySQL shape" - display_name = "mysql-sei-initial-configuration" + display_name = "mysql-sei-configuration-${var.environment}" parent_configuration_id = data.oci_mysql_mysql_configurations.sei_mysql_configurations.configurations[0].id shape_name = var.mysql_shape options { @@ -43,6 +43,13 @@ resource "oci_mysql_mysql_configuration" "sei_mysql_configuration" { name = "init_connect" value = "SET NAMES latin1" } + + options { + name = "sql_require_primary_key" + value = "OFF" + } + + } resource "oci_mysql_mysql_db_system" "sei_mysql_dbsystem" { @@ -50,7 +57,7 @@ resource "oci_mysql_mysql_db_system" "sei_mysql_dbsystem" { email = var.mysql_contacts_email } access_mode = "UNRESTRICTED" - admin_password = random_string.password_mysql_admin.result + admin_password = random_password.password_mysql_admin.result admin_username = "admin" availability_domain = data.oci_identity_availability_domains.ads.availability_domains[0].name compartment_id = var.ocid_compartment_database @@ -60,8 +67,8 @@ resource "oci_mysql_mysql_db_system" "sei_mysql_dbsystem" { database_management = "ENABLED" database_mode = "READ_WRITE" description = "Instância MySQL SEI" - display_name = var.mysql_database_name - hostname_label = var.mysql_database_name + display_name = "${var.mysql_database_name}-${var.environment}" + hostname_label = "${var.mysql_database_name}-${var.environment}" is_highly_available = var.mysql_highly_available mysql_version = var.mysql_database_version port = 3306 diff --git a/nsg-sei-lbs-nsg.tf b/nsg-sei-lbs-nsg.tf index 2a97b49..5b7c723 100755 --- a/nsg-sei-lbs-nsg.tf +++ b/nsg-sei-lbs-nsg.tf @@ -4,7 +4,7 @@ resource "oci_core_network_security_group" "load-balancer-public-nsg" { vcn_id = var.ocid_vcn_3_tier } -resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ingress_01" { +resource "oci_core_network_security_group_security_rule" "nsg_lb_security_rule_ingress_01" { network_security_group_id = oci_core_network_security_group.load-balancer-public-nsg.id description = "Ingress internet HTTP" direction = "INGRESS" @@ -19,7 +19,7 @@ resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ } } -resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ingress_02" { +resource "oci_core_network_security_group_security_rule" "nsg_lb_security_rule_ingress_02" { network_security_group_id = oci_core_network_security_group.load-balancer-public-nsg.id description = "Ingress internet HTTPs " direction = "INGRESS" @@ -34,7 +34,7 @@ resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ } } -resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ingress_03" { +resource "oci_core_network_security_group_security_rule" "nsg_lb_security_rule_ingress_03" { network_security_group_id = oci_core_network_security_group.load-balancer-public-nsg.id description = "Ingress internet OnP SOLR." direction = "INGRESS" @@ -49,7 +49,7 @@ resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ } } #------------------------------------------------------------------------------------------------------------ -resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ingress_01" { +resource "oci_core_network_security_group_security_rule" "nsg_lb_security_rule_egress_01" { network_security_group_id = oci_core_network_security_group.load-balancer-public-nsg.id description = "Egress to app port TCP/443" destination = var.cidr_subnet_app @@ -63,7 +63,7 @@ resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ } } } -resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ingress_02" { +resource "oci_core_network_security_group_security_rule" "nsg_lb_security_rule_egress_02" { network_security_group_id = oci_core_network_security_group.load-balancer-public-nsg.id description = "Egress to app port TCP/80" destination = var.cidr_subnet_app @@ -77,7 +77,7 @@ resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ } } } -resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ingress_03" { +resource "oci_core_network_security_group_security_rule" "nsg_lb_security_rule_egress_03" { network_security_group_id = oci_core_network_security_group.load-balancer-public-nsg.id description = "Egress to app port TCP/8983" destination = var.cidr_subnet_app diff --git a/nsg-sei-servers-nsg.tf b/nsg-sei-servers-nsg.tf index 2965393..453bc11 100755 --- a/nsg-sei-servers-nsg.tf +++ b/nsg-sei-servers-nsg.tf @@ -126,21 +126,6 @@ resource "oci_core_network_security_group_security_rule" "sei_servers_security_e } resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_06" { - network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id - description = "Egress SOLR to sn-database" - destination = var.cidr_subnet_app - destination_type = "CIDR_BLOCK" - direction = "EGRESS" - protocol = "6" - tcp_options { - destination_port_range { - max = 8983 - min = 8983 - } - } -} - -resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_07" { network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id description = "Egress Memcached to sn-app" destination = var.cidr_subnet_app @@ -155,7 +140,7 @@ resource "oci_core_network_security_group_security_rule" "sei_servers_security_e } } -resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_08" { +resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_07" { network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id description = "Egress MySQL Heatware to sn-database" destination = var.cidr_subnet_database diff --git a/sei_public_load_balancer.tf b/sei_public_load_balancer.tf index 94668b9..337022d 100755 --- a/sei_public_load_balancer.tf +++ b/sei_public_load_balancer.tf @@ -117,16 +117,12 @@ resource "oci_load_balancer_listener" "lister_solr" { hostname_names = [ oci_load_balancer_hostname.solr_hostname.name ] } #------------------------------------------------------------------------------------------------------------------------------------------------ -# AQUI -#------------------------------------------------------------------------------------------------------------------------------------------------ - resource "oci_load_balancer_hostname" "sei_hostname" { hostname = var.sei_fqdn load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id name = "sei-fqdn" } - resource "oci_load_balancer_hostname" "sip_hostname" { hostname = var.sip_fqdn load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id @@ -151,10 +147,7 @@ resource "oci_logging_log" "lb_access_log" { resource = oci_load_balancer_load_balancer.sei_load_balancer_public.id category = "access" } - - compartment_id = var.ocid_compartment_networking } - is_enabled = true retention_duration = 30 } @@ -171,16 +164,12 @@ resource "oci_logging_log" "lb_error_log" { resource = oci_load_balancer_load_balancer.sei_load_balancer_public.id category = "error" } - - compartment_id = var.ocid_compartment_networking } is_enabled = true retention_duration = 30 } - - # resource "oci_load_balancer_listener" "lister_sei_https" { # default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_apps.name # load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id @@ -214,45 +203,28 @@ resource "oci_logging_log" "lb_error_log" { # } # } ##----- +resource "oci_load_balancer_rule_set" "redirectHttpToHttps" { + count = var.load_balancer_enable_https == "true" ? 1 : 0 + items { + action = "REDIRECT" + conditions { + #Required + attribute_name = "PATH" + attribute_value = "/" -#resource "oci_load_balancer_load_balancer_routing_policy" "sei_routing_policy" { -# condition_language_version = "V1" -# load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id -# name = "RedirectHttpToHTTPs" -# rules { -# #Required -# actions { -# #Required -# backend_set_name = oci_load_balancer_backend_set.backend_set_sei_apps.name -# name = "FORWARD_TO_BACKENDSET" -# } -# condition = "any(http.request.url.path sw '/SIP')" -# name = "SIP_SERVER" -# } -#} -# -# -#resource "oci_load_balancer_rule_set" "redirectHttpToHttps" { -# items { -# action = "REDIRECT" -# conditions { -# #Required -# attribute_name = "PATH" -# attribute_value = "/" -# -# #Optional -# operator = "FORCE_LONGEST_PREFIX_MATCH" -# } -# redirect_uri { -# protocol = "HTTPS" -# host = "{host}" -# port = 443 -# path = "/{path}" -# query = "?{query}" -# } -# -# response_code = 302 -# } -# load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id -# name = "redirect_http_to_https" -#} \ No newline at end of file + #Optional + operator = "FORCE_LONGEST_PREFIX_MATCH" + } + redirect_uri { + protocol = "HTTPS" + host = "{host}" + port = 443 + path = "/{path}" + query = "?{query}" + } + + response_code = 302 + } + load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id + name = "redirect_http_to_https" +} \ No newline at end of file diff --git a/server_instances_jod.tf b/server_instances_jod.tf index 5b07492..bd4237e 100755 --- a/server_instances_jod.tf +++ b/server_instances_jod.tf @@ -13,6 +13,7 @@ resource "oci_core_instance" "jod-instance" { create_vnic_details { subnet_id = var.ocid_subnet_app assign_public_ip = false + nsg_ids = [ oci_core_network_security_group.jod-servers-nsg.id ] } source_details { diff --git a/terraform.tfvars b/terraform.tfvars index 047fe2f..7634261 100644 --- a/terraform.tfvars +++ b/terraform.tfvars @@ -71,6 +71,7 @@ jod_amount_ocpus = "1" load_balancer_prefix_hostname= "sei-load-balancer" load_balancer_minimum_bandwidth_in_mbps = "100" load_balancer_maximum_bandwidth_in_mbps = "500" +load_balancer_enable_https = false #================================================================================================================================================================================================ # FSS Variables fss_backup = false diff --git a/utils/cloud-init-jod.yaml b/utils/cloud-init-jod.yaml index 88ca56b..f2e0bd3 100644 --- a/utils/cloud-init-jod.yaml +++ b/utils/cloud-init-jod.yaml @@ -24,7 +24,7 @@ packages: runcmd: - [ adduser, jod ] - - [ wget, https://objectstorage.sa-saopaulo-1.oraclecloud.com/p/AZfqhI6p2tMTRQftfvGjcRjdHBIBs51R2kXoEBjtUtJ7H_a4HyK298Kpcxi9i1y3/n/idzvuvikb5ym/b/bucket-cadsus-terraform/o/jodconverter-4.4.8.zip, -O, /tmp/jodconverter-4.4.8.zip ] + - [ wget, https://objectstorage.sa-saopaulo-1.oraclecloud.com/p/KU_oqRwKQvexaWApz6FahM1ctUGpgMVslyADsvCetdK6piNfPZqo-veK2swy0Of0/n/idzvuvikb5ym/b/bucket-sei-packages/o/jodconverter-4.4.8.zip, -O, /tmp/jodconverter-4.4.8.zip ] - [ sed, -i, '$a\set number', /etc/vimrc ] - [ systemctl, disable, firewalld.service, --now ] - [ setenforce, 0 ] diff --git a/utils/cloud-init-memcached.yaml b/utils/cloud-init-memcached.yaml index 55faf35..7cf8ddc 100644 --- a/utils/cloud-init-memcached.yaml +++ b/utils/cloud-init-memcached.yaml @@ -30,8 +30,5 @@ runcmd: - [sed, -i, 's/^SELINUX.*/SELINUX=disabled/', /etc/selinux/config] - [sed, -i, 's|^OPTIONS="-l 127\.0\.0\.1,::1"$|OPTIONS="-l 0.0.0.0"|', /etc/sysconfig/memcached] - [systemctl, enable, memcached.service, --now] -final_message: "MemCache Instance ready after $UPTIME seconds" - - -dnf install -y dnf install -ygcc curl-devel jdk1.8 php-opcache.x86_64 glibc-langpack-pt langpacks-pt memcached nc \ No newline at end of file +final_message: "MemCache Instance ready after $UPTIME seconds" \ No newline at end of file diff --git a/utils/cloud-init-sip.yaml b/utils/cloud-init-sip.yaml index 934feab..2fbb018 100644 --- a/utils/cloud-init-sip.yaml +++ b/utils/cloud-init-sip.yaml @@ -79,7 +79,7 @@ runcmd: - chown -R root:apache /var/www - chown -R apache:apache /run/php-fpm - cp /tmp/robots.txt /opt/sip/robots.txt - - cp /tmp/sei.conf /etc/httpd/conf.d/sip.conf + - cp /tmp/sip.conf /etc/httpd/conf.d/sip.conf - rm -f /etc/httpd/conf.d/{userdir.conf,welcome.conf} - echo "00 01 * * * rm -rf /opt/sip/temp/*" | crontab - echo "* * * * * /usr/bin/php -c /etc/php.ini /opt/sip/scripts/AgendamentoTarefaSip.php 2>&1 >> /root/infra_agendamento_sip.log" | crontab diff --git a/utils/cloud-init-solr.yaml b/utils/cloud-init-solr.yaml index 74898be..6aff660 100644 --- a/utils/cloud-init-solr.yaml +++ b/utils/cloud-init-solr.yaml @@ -25,16 +25,16 @@ runcmd: - adduser solr - localectl set-locale LANG=pt_BR.UTF-8 - sed -i 's/^SELINUX.*/SELINUX=disabled/' /etc/selinux/config - - wget https://objectstorage.sa-saopaulo-1.oraclecloud.com/p/sCbg0kkAI_DOehFCLxUFg_LN9ypX0vXddkxj7A__uxtCrD1AkBUZnH-8ixMgCPCI/n/gr2g2eizhkzs/b/bucket-sei/o/solr-9.6.1.tgz -O /tmp/solr-9.6.1.tgz - - wget https://objectstorage.sa-saopaulo-1.oraclecloud.com/p/D_nCQ5KYQ2mAGxHo29mwsDKwCOs-XOAUdtFk8WyQM9QD2VWONhor8gwRi-LnKUGn/n/idzvuvikb5ym/b/bucket-gise-dev/o/solr-v2.tar.gz -O /tmp/solr.tar.gz + - wget https://objectstorage.sa-saopaulo-1.oraclecloud.com/p/KU_oqRwKQvexaWApz6FahM1ctUGpgMVslyADsvCetdK6piNfPZqo-veK2swy0Of0/n/idzvuvikb5ym/b/bucket-sei-packages/o/solr-9.6.1.tgz -O /tmp/solr-9.6.1.tgz + - wget https://objectstorage.sa-saopaulo-1.oraclecloud.com/p/KU_oqRwKQvexaWApz6FahM1ctUGpgMVslyADsvCetdK6piNfPZqo-veK2swy0Of0/n/idzvuvikb5ym/b/bucket-sei-packages/o/solr-v2.tar.gz -O /tmp/solr.tar.gz - tar -xvf /tmp/solr-9.6.1.tgz -C /tmp/ - tar -xvf /tmp/solr.tar.gz -C /tmp/ - sh /tmp/sei-solr-9.6.1.sh - - IP=$(ip -o -4 addr show | awk '{print $4}' | cut -d/ -f1 | sed -n '2p') && sed -i "s|^#SOLR_HOST.*|SOLR_HOST=${IP}|" /opt/solr-9.6.1/bin/solr.in.sh - - sed -i 's/^#SOLR_JAVA_MEM.*/SOLR_JAVA_MEM="-Xms512m -Xmx28g"/' /opt/solr-9.6.1/bin/solr.in.sh - - sed -i 's/^#SOLR_JETTY_HOST.*/SOLR_JETTY_HOST="0.0.0.0"/' /opt/solr-9.6.1/bin/solr.in.sh - - sed -i 's/^#SOLR_REQUESTLOG_ENABLED.*/SOLR_REQUESTLOG_ENABLED=false/' /opt/solr-9.6.1/bin/solr.in.sh - - sed -i '$a\SOLR_OPTS="$SOLR_OPTS -Dsolr.allowPaths=/dados -Djava.net.preferIPv4Stack=true"' /opt/solr-9.6.1/bin/solr.in.sh + - IP=$(ip -o -4 addr show | awk '{print $4}' | cut -d/ -f1 | sed -n '2p') && sed -i "s|^#SOLR_HOST.*|SOLR_HOST=${IP}|" /opt/solr/bin/solr.in.sh + - sed -i 's/^#SOLR_JAVA_MEM.*/SOLR_JAVA_MEM="-Xms512m -Xmx28g"/' /opt/solr/bin/solr.in.sh + - sed -i 's/^#SOLR_JETTY_HOST.*/SOLR_JETTY_HOST="0.0.0.0"/' /opt/solr/bin/solr.in.sh + - sed -i 's/^#SOLR_REQUESTLOG_ENABLED.*/SOLR_REQUESTLOG_ENABLED=false/' /opt/solr/bin/solr.in.sh + - sed -i '$a\SOLR_OPTS="$SOLR_OPTS -Dsolr.allowPaths=/dados -Djava.net.preferIPv4Stack=true"' /opt/solr/bin/solr.in.sh - service solr stop - systemctl daemon-reload - systemctl enable --now solr.service diff --git a/variables.tf b/variables.tf index 0023d58..68c01b9 100644 --- a/variables.tf +++ b/variables.tf @@ -63,7 +63,7 @@ variable "jod_amount_ocpus" {} variable "load_balancer_prefix_hostname" {} variable "load_balancer_maximum_bandwidth_in_mbps" {} variable "load_balancer_minimum_bandwidth_in_mbps" {} - +variable "load_balancer_enable_https" {} # FSS variable "fss_backup" {} variable "sei_nfs_name" {}