commit 7583ef25a4bb119364088cdfde3a8065a9e7f8bf
Author: root <root@TODASILV-6CP4N44.localdomain>
Date:   Fri Jul 17 14:29:36 2026 -0300

    first commit

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..4f9ba7c
--- /dev/null
+++ b/README.md
@@ -0,0 +1,34 @@
+# PDB Self-Service Portal
+
+MVP portal for approval-based PDB provisioning on OCI Exadata Database Service on Exascale Infrastructure.
+
+## Workflow
+
+1. A developer submits a PDB name, requested `DATA` tablespace size, and initial PDB administrator password.
+2. The portal encrypts the password before persisting the request and records it as `PENDING`.
+3. An administrator approves the request.
+4. The backend invokes OCI `CreatePluggableDatabase` for the configured CDB.
+5. Once OCI reports the PDB as `AVAILABLE`, the backend connects through JDBC and creates `DATA` at the approved initial size.
+
+The application never uses SQL*Plus. It uses the OCI Java SDK for PDB provisioning and Oracle JDBC only for the post-provisioning DDL that the OCI PDB API does not expose.
+
+## Required production configuration
+
+Set these as deployment secrets, not in source control:
+
+- `PDB_PORTAL_CDB_OCID`: the Container Database OCID (the `ocid1.database...` value).
+- `PDB_PORTAL_CDB_ADMIN_PASSWORD`: supplied at runtime by OCI Vault or the deployment secret manager.
+- `PDB_PORTAL_ENCRYPTION_KEY`: a Base64-encoded 256-bit AES key used to protect the submitted PDB password while approval is pending.
+- `PDB_PORTAL_JDBC_URL_TEMPLATE`: e.g. `jdbc:oracle:thin:@//scan-host:1521/{pdbName}`.
+
+When deployed on OCI, grant a dynamic group containing the application runtime permission to manage PDBs in the target compartment. The backend uses a Resource Principal; a personal OCI API key must only be used for local development, never embedded in the portal.
+
+## Run locally
+
+Install JDK 21 and Maven, then set the variables above (a non-production local key is acceptable only for development):
+
+```powershell
+mvn spring-boot:run
+```
+
+Development users are configured in `application.yml`; replace Basic authentication with the company OIDC provider before production.