CAIXA_AUTOMATION/README.md

PDB Self-Service Portal

MVP portal for approval-based PDB provisioning on OCI Exadata Database Service on Exascale Infrastructure.

Workflow

1. A developer submits a PDB name, requested DATA tablespace size, and initial PDB administrator password.
2. The portal encrypts the password before persisting the request and records it as PENDING.
3. An administrator approves the request.
4. The backend invokes OCI CreatePluggableDatabase for the configured CDB.
5. Once OCI reports the PDB as AVAILABLE, the backend connects through JDBC and creates DATA at the approved initial size.

The application never uses SQL*Plus. It uses the OCI Java SDK for PDB provisioning and Oracle JDBC only for the post-provisioning DDL that the OCI PDB API does not expose.

Required production configuration

Set these as deployment secrets, not in source control:

• PDB_PORTAL_CDB_OCID: the Container Database OCID (the ocid1.database... value).
• PDB_PORTAL_CDB_ADMIN_PASSWORD: supplied at runtime by OCI Vault or the deployment secret manager.
• PDB_PORTAL_TDE_WALLET_PASSWORD (when required by the CDB).
• PDB_PORTAL_ENCRYPTION_KEY: a Base64-encoded 256-bit AES key used to protect the submitted PDB password while approval is pending.
• PDB_PORTAL_JDBC_URL_TEMPLATE (optional): override only if needed, e.g. jdbc:oracle:thin:@//scan-host:1521/{pdbName}. By default the portal reads the PDB connection string returned by OCI.

When deployed on OCI, grant a dynamic group containing the application runtime permission to manage PDBs in the target compartment. The backend uses a Resource Principal; a personal OCI API key must only be used for local development, never embedded in the portal.

For a local OCI test, set PDB_PORTAL_OCI_AUTH_MODE=api_key. The SDK then reads your usual OCI config file (%USERPROFILE%\\.oci\\config, profile DEFAULT) and its key_file entry. You may instead set PDB_PORTAL_OCI_CONFIG_PATH and PDB_PORTAL_OCI_PROFILE. The private key stays outside this repository.

Run locally

Install JDK 21 and Maven, then set the variables above (a non-production local key is acceptable only for development):

mvn spring-boot:run

Development users are configured in application.yml; replace Basic authentication with the company OIDC provider before production.