guilherme.silva/iac-sei
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sei-fixeds #1

Merged
guilherme.silva merged 7 commits from sei-fixeds into main 2026-07-13 23:22:17 +00:00
Conversation 1 Commits 7 Files Changed 15 +330 -92
15 changed files with 330 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
.gitignore vendored Normal file
View File

@@ -0,0 +1,47 @@
# Local .terraform directories
.terraform/
# .tfstate files
*.tfstate
*.tfstate.*
# Crash log files
crash.log
crash.*.log
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
# password, private keys, and other secrets. These should not be part of version
# control as they are data points which are potentially sensitive and subject
# to change depending on the environment.
*.tfvars
*.tfvars.json
# Ignore override files as they are usually used to override resources locally and so
# are not checked in
override.tf
override.tf.json
*_override.tf
*_override.tf.json
# Ignore transient lock info files created by terraform apply
.terraform.tfstate.lock.info
# Include override files you do wish to add to version control using negated pattern
# !example_override.tf
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
# example: *tfplan*
# Ignore CLI configuration files
.terraformrc
terraform.rc
# Optional: ignore graph output files generated by `terraform graph`
# *.dot
# Optional: ignore plan files saved before destroying Terraform configuration
# Uncomment the line below if you want to ignore planout files.
# planout
.terraform.lock.hcl
*.DS_Store

14
README.md
View File

@@ -207,3 +207,17 @@ Ponto de atencao: embora os secrets sejam armazenados no OCI Vault, valores gera
| Memcached servers | Ingress | `cidr_subnet_app` | 11211 | Trafego Memcached. |
| JodServer | Ingress | `cidr_subnet_app` | 8080 | Trafego JodServer. |
| Database | Ingress | `cidr_subnet_app` | 3306, 33060 | Trafego MySQL/MySQL HeatWave. |
## Instalação SEI
### Criação de usuários no MySQL
```
CREATE USER 'sei_user'@'%' IDENTIFIED BY 'SuaSenhaSegura';
CREATE USER 'sip_user'@'%' IDENTIFIED BY 'SuaSenhaSegura';
GRANT ALL PRIVILEGES ON sei.* TO 'sei_user'@'%';
GRANT ALL PRIVILEGES ON sip.* TO 'sip_user'@'%';
FLUSH PRIVILEGES;
```

2
data_sources.tf
View File

@@ -30,3 +30,5 @@ data "oci_mysql_mysql_configurations" "sei_mysql_configurations" {
shape_name = "MySQL.4"
type = ["DEFAULT"]
}
data "oci_core_services" "all_services" {}

14
nsg-database-nsg.tf
View File

@@ -35,3 +35,17 @@ resource "oci_core_network_security_group_security_rule" "nsg_db_security_ingres
}
}
#--------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_core_network_security_group_security_rule" "nsg_db_security_egress_rule_01" {
network_security_group_id = oci_core_network_security_group.db-server-nsg.id
description = "Egress to OSN"
destination = lookup(data.oci_core_services.all_services.services[1], "cidr_block")
destination_type = "SERVICE_CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}

29
nsg-jod-servers-nsg.tf
View File

@@ -20,3 +20,32 @@ resource "oci_core_network_security_group_security_rule" "jod_servers_security_i
}
#--------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_core_network_security_group_security_rule" "jod_servers_security_egress_rule_01" {
network_security_group_id = oci_core_network_security_group.jod-servers-nsg.id
description = "Egress to OSN"
destination = lookup(data.oci_core_services.all_services.services[1], "cidr_block")
destination_type = "SERVICE_CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}
resource "oci_core_network_security_group_security_rule" "jod_servers_security_egress_rule_02" {
network_security_group_id = oci_core_network_security_group.jod-servers-nsg.id
description = "Egress to Internet only port TCP/443"
destination = var.cidr_anywhere
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}

29
nsg-memcached-servers-nsg.tf
View File

@@ -21,3 +21,32 @@ resource "oci_core_network_security_group_security_rule" "nsg_memcached_ingress_
#--------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_core_network_security_group_security_rule" "nsg_memcached_egress_rule_01" {
network_security_group_id = oci_core_network_security_group.memcached-servers-nsg.id
description = "Egress to OSN"
destination = lookup(data.oci_core_services.all_services.services[1], "cidr_block")
destination_type = "SERVICE_CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}
resource "oci_core_network_security_group_security_rule" "nsg_memcached_egress_rule_02" {
network_security_group_id = oci_core_network_security_group.memcached-servers-nsg.id
description = "Egress to Internet port TCP/443"
destination = var.cidr_anywhere
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}

135
nsg-sei-servers-nsg.tf
View File

@@ -51,6 +51,51 @@ resource "oci_core_network_security_group_security_rule" "sei_servers_security_i
#--------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_01" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress to Internet port TCP/80"
destination = var.cidr_anywhere
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 80
min = 80
}
}
}
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_02" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress to OSN port TCP/443"
destination = lookup(data.oci_core_services.all_services.services[1], "cidr_block")
destination_type = "SERVICE_CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_03" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress to Internet port TCP/443"
destination = var.cidr_anywhere
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_04" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress MySQL to sn-database"
destination = var.cidr_subnet_database
@@ -65,51 +110,6 @@ resource "oci_core_network_security_group_security_rule" "sei_servers_security_e
}
}
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_02" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress MySQL Heatware to sn-database"
destination = var.cidr_subnet_database
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 33060
min = 33060
}
}
}
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_03" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress SOLR to sn-database"
destination = var.cidr_subnet_app
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 8983
min = 8983
}
}
}
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_04" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress Memcached to sn-app"
destination = var.cidr_subnet_app
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 11211
min = 11211
}
}
}
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_05" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress Jod to sn-app"
@@ -124,4 +124,49 @@ resource "oci_core_network_security_group_security_rule" "sei_servers_security_e
}
}
}
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_06" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress SOLR to sn-database"
destination = var.cidr_subnet_app
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 8983
min = 8983
}
}
}
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_07" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress Memcached to sn-app"
destination = var.cidr_subnet_app
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 11211
min = 11211
}
}
}
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_08" {
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
description = "Egress MySQL Heatware to sn-database"
destination = var.cidr_subnet_database
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 33060
min = 33060
}
}
}
#--------------------------------------------------------------------------------------------------------------------------------------------

81
nsg-sip-servers-nsg.tf
View File

@@ -51,6 +51,51 @@ resource "oci_core_network_security_group_security_rule" "nsg_sip-server_ingress
#--------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_01" {
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
description = "Egress to Internet port TCP/80"
destination = var.cidr_anywhere
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 80
min = 80
}
}
}
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_02" {
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
description = "Egress to OSN"
destination = lookup(data.oci_core_services.all_services.services[1], "cidr_block")
destination_type = "SERVICE_CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_03" {
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
description = "Egress to Internet port TCP/443"
destination = var.cidr_anywhere
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_04" {
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
description = "Egress MySQL to sn-database"
destination = var.cidr_subnet_database
@@ -65,22 +110,7 @@ resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_
}
}
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_02" {
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
description = "Egress MySQL Heatware to sn-database"
destination = var.cidr_subnet_database
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 33060
min = 33060
}
}
}
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_03" {
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_05" {
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
description = "Egress SOLR to sn-database"
destination = var.cidr_subnet_app
@@ -95,7 +125,7 @@ resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_
}
}
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_04" {
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_06" {
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
description = "Egress Memcached to sn-app"
destination = var.cidr_subnet_app
@@ -109,4 +139,21 @@ resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_
}
}
}
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_07" {
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
description = "Egress MySQL Heatware to sn-database"
destination = var.cidr_subnet_database
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 33060
min = 33060
}
}
}
#--------------------------------------------------------------------------------------------------------------------------------------------

30
nsg-solr-servers-nsg.tf
View File

@@ -33,6 +33,36 @@ resource "oci_core_network_security_group_security_rule" "nsg_solr-server_ingres
}
}
}
#--------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_core_network_security_group_security_rule" "nsg_solr_servers_security_egress_rule_01" {
network_security_group_id = oci_core_network_security_group.solr-server-nsg.id
description = "Egress to OSN"
destination = lookup(data.oci_core_services.all_services.services[1], "cidr_block")
destination_type = "SERVICE_CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}
resource "oci_core_network_security_group_security_rule" "nsg_solr_servers_security_egress_rule_02" {
network_security_group_id = oci_core_network_security_group.solr-server-nsg.id
description = "Egress to Internet only port TCP/443"
destination = var.cidr_anywhere
destination_type = "CIDR_BLOCK"
direction = "EGRESS"
protocol = "6"
tcp_options {
destination_port_range {
max = 443
min = 443
}
}
}
resource "oci_core_network_security_group_security_rule" "nsg_solr_servers_security_egress_rule_03" {
network_security_group_id = oci_core_network_security_group.solr-server-nsg.id

2
sei_waf.tf
View File

@@ -1,5 +1,5 @@
resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
count = var.var.enable_waf == "true" ? 1 : 0
count = var.enable_waf == "true" ? 1 : 0
compartment_id = var.ocid_compartment_networking
display_name = "sei-waf-policy-${var.environment}-v01"
actions {

3
server_instances_memcached.tf
View File

@@ -28,8 +28,7 @@ resource "oci_core_instance" "memcached-instance" {
lifecycle {
ignore_changes = [
source_details [ "source_id" ],
#metadata [ "user_data" ]
source_details [ "source_id" ]
]
}
}

5
server_instances_sei.tf
View File

@@ -13,7 +13,7 @@ resource "oci_core_instance" "sei-instance" {
create_vnic_details {
subnet_id = var.ocid_subnet_app
assign_public_ip = false
nsg_ids = [ oci_core_network_security_group.sei-public-nsg.id]
nsg_ids = [ oci_core_network_security_group.sei-servers-nsg.id ]
}
source_details {
@@ -28,8 +28,7 @@ resource "oci_core_instance" "sei-instance" {
lifecycle {
ignore_changes = [
source_details [ "source_id" ],
#metadata [ "user_data" ]
source_details [ "source_id" ]
]
}
}

3
server_instances_sip.tf
View File

@@ -28,8 +28,7 @@ resource "oci_core_instance" "sip-instance" {
lifecycle {
ignore_changes = [
source_details [ "source_id" ],
#metadata [ "user_data" ]
source_details [ "source_id" ]
]
}

5
server_instances_solr.tf
View File

@@ -13,7 +13,7 @@ resource "oci_core_instance" "solr-instance" {
create_vnic_details {
subnet_id = var.ocid_subnet_app
assign_public_ip = false
nsg_ids = [ oci_core_network_security_group.solr-servers-nsg.id ]
nsg_ids = [ oci_core_network_security_group.solr-server-nsg.id ]
}
source_details {
@@ -28,8 +28,7 @@ resource "oci_core_instance" "solr-instance" {
lifecycle {
ignore_changes = [
source_details [ "source_id" ],
#metadata [ "user_data" ]
source_details [ "source_id" ]
]
}
}

15
variables_sei_nfs.tf
View File

@@ -1,15 +0,0 @@
# Copyright (c) 2023, 2025, Oracle and/or its affiliates.
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
# ------------------------------------------------------
variable "sei_nfs_name" {
type = string
default = "nfs-sei"
description = "Nome do FSS para o SEI"
}
variable "sei_mount_target_ip_address" {
type = string
default = "10.191.228.100"
description = "IP Address para o mount target"
}