iac-sei/sei_public_load_balancer.tf

resource "oci_load_balancer_load_balancer" "sei_load_balancer_public" {
    compartment_id =  var.ocid_compartment_networking
    display_name = "${var.load_balancer_prefix_hostname}-${var.environment}-public"
    shape = "flexible"
    subnet_ids = [ var.ocid_subnet_public ]
    is_delete_protection_enabled = "false"
    is_private = "false"
    network_security_group_ids = [ oci_core_network_security_group.load-balancer-public-nsg.id ] 
    shape_details {
        maximum_bandwidth_in_mbps = var.load_balancer_maximum_bandwidth_in_mbps
        minimum_bandwidth_in_mbps = var.load_balancer_minimum_bandwidth_in_mbps
    }
}

#------------------------------------------------------------------------------------------------------------------------------------------------
#Backend HTTP
resource "oci_load_balancer_backend_set" "backend_set_sei_servers_http" {
    count = !var.load_balancer_enable_https ? 1 : 0
    health_checker {
        protocol = "HTTP"
        interval_ms = "10000"
        port = "80"
        retries = "3"
        return_code = "302"
        timeout_in_millis = "3000"
        url_path = "/"
    }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "bs-sei-servers-http-${var.environment}"
    policy = "IP_HASH"
    session_persistence_configuration {
        cookie_name = "PHPSESSID-SEI"
    } 
}

resource "oci_load_balancer_backend_set" "backend_set_sip_servers_http" {
    count = !var.load_balancer_enable_https ? 1 : 0
    health_checker {
        protocol = "HTTP"
        interval_ms = "10000"
        port = "80"
        retries = "3"
        return_code = "302"
        timeout_in_millis = "3000"
        url_path = "/"
    }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "bs-sip-servers-http-${var.environment}"
    policy = "IP_HASH"
    session_persistence_configuration {
      cookie_name = "PHPSESSID-SIP"
    } 
}

resource "oci_load_balancer_backend_set" "backend_set_solr_servers_http" {
    count = !var.load_balancer_enable_https ? 1 : 0
    health_checker {
        protocol = "HTTP"
        interval_ms = "10000"
        port = "8983"
        retries = "3"
        return_code = "302"
        timeout_in_millis = "3000"
        url_path = "/solr"
    }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "bs-solr-servers-http-${var.environment}"
    policy = "IP_HASH"
}

#Backend HTTPS
resource "oci_load_balancer_backend_set" "backend_set_sei_servers_https" {
    count = var.load_balancer_enable_https ? 1 : 0
    health_checker {
        protocol = "HTTP"
        interval_ms = "10000"
        port = "443"
        retries = "3"
        return_code = "302"
        timeout_in_millis = "3000"
        url_path = "/"
    }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "bs-sei-servers-https-${var.environment}"
    policy = "IP_HASH"
    session_persistence_configuration {
        cookie_name = "PHPSESSID-SEI"
    }
    ssl_configuration {
        cipher_suite_name                 = "oci-tls-12-13-ssl-cipher-suite-v3"
        protocols                         = [ "TLSv1.2", "TLSv1.3" ]
        trusted_certificate_authority_ids = [ var.load_balancer_certificate_bundle_ocid ]
        verify_depth                      = 1
        verify_peer_certificate           = false
    }
}

resource "oci_load_balancer_backend_set" "backend_set_sip_servers_https" {
    count = var.load_balancer_enable_https ? 1 : 0
    health_checker {
        protocol = "HTTP"
        interval_ms = "10000"
        port = "443"
        retries = "3"
        return_code = "302"
        timeout_in_millis = "3000"
        url_path = "/"
    }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "bs-sip-servers-https-${var.environment}"
    policy = "IP_HASH"
    session_persistence_configuration {
      cookie_name = "PHPSESSID-SIP"
    } 
    ssl_configuration {
        cipher_suite_name                 = "oci-tls-12-13-ssl-cipher-suite-v3"
        protocols                         = [ "TLSv1.2", "TLSv1.3" ]
        trusted_certificate_authority_ids = [ var.load_balancer_certificate_bundle_ocid ]
        verify_depth                      = 1
        verify_peer_certificate           = false
    }
}

resource "oci_load_balancer_backend_set" "backend_set_solr_servers_https" {
    count = var.load_balancer_enable_https ? 1 : 0
    health_checker {
        protocol = "HTTP"
        interval_ms = "10000"
        port = "8983"
        retries = "3"
        return_code = "302"
        timeout_in_millis = "3000"
        url_path = "/solr"
    }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "bs-solr-servers-https-${var.environment}"
    policy = "IP_HASH"
}

#------------------------------------------------------------------------------------------------------------------------------------------------
#Backends HTTP
resource "oci_load_balancer_backend" "sip_servers_http" {
  for_each = !var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sip-instance : idx => inst } : {}
  backendset_name   = oci_load_balancer_backend_set.backend_set_sip_servers_http[0].name
  ip_address        = each.value.private_ip
  load_balancer_id  = oci_load_balancer_load_balancer.sei_load_balancer_public.id
  port              = "80"
}
resource "oci_load_balancer_backend" "sei_servers_http" {
  for_each = !var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sei-instance : idx => inst } : {}
  backendset_name   = oci_load_balancer_backend_set.backend_set_sei_servers_http[0].name
  ip_address        = each.value.private_ip
  load_balancer_id  = oci_load_balancer_load_balancer.sei_load_balancer_public.id
  port              = "80"
}
resource "oci_load_balancer_backend" "solr_servers_http" {
  for_each = !var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.solr-instance : idx => inst } : {}
  backendset_name   = oci_load_balancer_backend_set.backend_set_solr_servers_http[0].name
  ip_address        = each.value.private_ip
  load_balancer_id  = oci_load_balancer_load_balancer.sei_load_balancer_public.id
  port              = "8983"
}

#Backends HTTPS
resource "oci_load_balancer_backend" "sip_servers_https" {
  for_each = var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sip-instance : idx => inst } : {}
  backendset_name  = oci_load_balancer_backend_set.backend_set_sip_servers_https[0].name
  ip_address       = each.value.private_ip
  load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
  port             = 443
}
resource "oci_load_balancer_backend" "sei_servers_https" {
  for_each = var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.sei-instance : idx => inst } : {}
  backendset_name   = oci_load_balancer_backend_set.backend_set_sei_servers_https[0].name
  ip_address        = each.value.private_ip
  load_balancer_id  = oci_load_balancer_load_balancer.sei_load_balancer_public.id
  port              = "443"
}
resource "oci_load_balancer_backend" "solr_servers_https" {
  for_each = var.load_balancer_enable_https ? { for idx, inst in oci_core_instance.solr-instance : idx => inst } : {}
  backendset_name   = oci_load_balancer_backend_set.backend_set_solr_servers_https[0].name
  ip_address        = each.value.private_ip
  load_balancer_id  = oci_load_balancer_load_balancer.sei_load_balancer_public.id
  port              = "8983"
}
#------------------------------------------------------------------------------------------------------------------------------------------------
# Listeners HTTP
resource "oci_load_balancer_listener" "lister_http_sei_http" {
    count = !var.load_balancer_enable_https ? 1 : 0
    default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_servers_http[0].name
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "listener-sei-http-${var.environment}"
    port = "80"
    protocol = "HTTP"
    hostname_names = [ oci_load_balancer_hostname.sei_hostname.name ]
}

resource "oci_load_balancer_listener" "lister_http_sip_http" {
    count = !var.load_balancer_enable_https ? 1 : 0
    default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_servers_http[0].name
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "listener-sip-http-${var.environment}"
    port = "80"
    protocol = "HTTP"
    hostname_names = [ oci_load_balancer_hostname.sip_hostname.name ]
}

resource "oci_load_balancer_listener" "lister_solr_http" {
    count = !var.load_balancer_enable_https ? 1 : 0
    default_backend_set_name = oci_load_balancer_backend_set.backend_set_solr_servers_http[0].name
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "listener-solr-http-${var.environment}"
    port = "8983"
    protocol = "HTTP"
    hostname_names = [ oci_load_balancer_hostname.solr_hostname.name ]
}

# Listeners HTTPs
  resource "oci_load_balancer_listener" "lister_sei_https" {
      count = var.load_balancer_enable_https ? 1 : 0
      default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_servers_https[0].name
      load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
      name = "listener-sei-https-${var.environment}"
      port = "443"
      protocol = "HTTP"
      hostname_names = [ oci_load_balancer_hostname.sei_hostname.name ]
      ssl_configuration {
          certificate_ids = [ var.load_balancer_certificate_ocid ]
          protocols = [ "TLSv1.2", "TLSv1.3" ] 
          cipher_suite_name = "oci-tls-12-13-ssl-cipher-suite-v3"
          verify_peer_certificate = "false"
          verify_depth = "1"
      }
      rule_set_names = [ oci_load_balancer_rule_set.redirectHttpToHttps[0].name ]
  }

  resource "oci_load_balancer_listener" "lister_sip_https" {
      count = var.load_balancer_enable_https ? 1 : 0
      default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_servers_https[0].name
      load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
      name = "listener-sip-https-${var.environment}"
      port = "443"
      protocol = "HTTP"
      hostname_names = [ oci_load_balancer_hostname.sip_hostname.name ]
      ssl_configuration {
          certificate_ids = [ var.load_balancer_certificate_ocid ]
          protocols = [ "TLSv1.2", "TLSv1.3" ] 
          cipher_suite_name = "oci-tls-12-13-ssl-cipher-suite-v3"
          verify_peer_certificate = "false"
          verify_depth = "1"
      }
      rule_set_names = [ oci_load_balancer_rule_set.redirectHttpToHttps[0].name ]
  }
#------------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_load_balancer_hostname" "sei_hostname" {
    hostname = var.sei_fqdn
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "sei-fqdn-${var.environment}"
}

resource "oci_load_balancer_hostname" "sip_hostname" {
    hostname = var.sip_fqdn
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "sip-fqdn-${var.environment}"
}

resource "oci_load_balancer_hostname" "solr_hostname" {
    hostname = var.solr_fqdn
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "solr-fqdn-${var.environment}"
}
#------------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_logging_log" "lb_access_log" {
  display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-access-log"
  log_group_id = oci_logging_log_group.sei_log_group.id
  log_type     = "SERVICE"

  configuration {
    source {
      source_type = "OCISERVICE"
      service     = "loadbalancer"
      resource    = oci_load_balancer_load_balancer.sei_load_balancer_public.id
      category    = "access"
    }
  }
  is_enabled         = true
  retention_duration = 30
}

resource "oci_logging_log" "lb_error_log" {
  display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-error-log"
  log_group_id = oci_logging_log_group.sei_log_group.id
  log_type     = "SERVICE"

  configuration {
    source {
      source_type = "OCISERVICE"
      service     = "loadbalancer"
      resource    = oci_load_balancer_load_balancer.sei_load_balancer_public.id
      category    = "error"
    }
  }
  is_enabled         = true
  retention_duration = 30
}

resource "oci_load_balancer_rule_set" "redirectHttpToHttps" {
    count = var.load_balancer_enable_https ? 1 : 0
    items {
        action = "REDIRECT"
        conditions {
            attribute_name = "PATH"
            attribute_value = "/"
            operator = "FORCE_LONGEST_PREFIX_MATCH"
        }
      redirect_uri {
        protocol = "HTTPS"
        host     = "{host}"
        port     = 443
        path     = "/{path}"
        query = "?{query}"
    }
    response_code = 302
  }
    load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
    name = "redirect_http_to_https"
}