# Terraform

This directory contains the OCI foundation for the lab.

## Environments

- `envs/demo`: default environment for demos and workshops.

## Modules

- `modules/network`: VCN, optional private/public subnets, gateways, route tables, and NSGs.
- `modules/vault`: optional OCI Vault and KMS key.
- `modules/autonomous_database`: Autonomous Database with private endpoint and mTLS.
- `modules/compute_bastion`: optional compute instance for administration inside the VCN.

## Applied Best Practices

- Database in a private subnet.
- Dedicated database and application NSGs.
- Bastion disabled by default.
- No password or wallet committed to Git.
- Real `.tfvars` files ignored by Git.
- Sensitive variables marked as `sensitive`.