OCI Build Playbook for Oracle PeopleSoft Archive

# versions.tf
terraform {
  required_version = ">= 1.6.0"

  required_providers {
    oci = {
      source  = "oracle/oci"
      # Pin the tested OCI provider version for your implementation.
      version = "~> 6.0"
    }
  }
}

# provider.tf
provider "oci" {
  tenancy_ocid     = var.tenancy_ocid
  user_ocid        = var.user_ocid
  fingerprint      = var.fingerprint
  private_key_path = var.private_key_path
  region           = var.region
}

# variables.tf
variable "tenancy_ocid" { type = string }
variable "user_ocid" { type = string }
variable "fingerprint" { type = string }
variable "private_key_path" { type = string }
variable "region" { type = string }

variable "project_name" {
  type    = string
  default = "peoplesoftarchive"
}

variable "environment" {
  type    = string
  default = "prod"
}

variable "vcn_cidr_block" {
  type    = string
  default = "10.20.0.0/16"
}

variable "private_db_endpoint_subnet_cidr_block" {
  type    = string
  default = "10.20.10.0/24"
}

variable "archive_db_name" {
  type    = string
  default = "PSARCH"
}

variable "adw_admin_password" {
  type      = string
  sensitive = true
}

variable "enable_service_gateway" {
  type    = bool
  default = false
}

variable "enable_bastion" {
  type    = bool
  default = false
}

variable "bastion_client_cidr_blocks" {
  type    = list(string)
  default = []
}

variable "enable_ipsec_vpn" {
  type    = bool
  default = false
}

variable "customer_cpe_public_ip" {
  type    = string
  default = ""
}

variable "customer_on_prem_cidr_blocks" {
  type    = list(string)
  default = []
}

variable "enable_dns_resolver_endpoint" {
  type    = bool
  default = false
}

variable "enable_sso" {
  type    = bool
  default = false
}

variable "identity_domain_url" {
  description = "OCI Identity Domain base URL, for example https://idcs-...identity.oraclecloud.com."
  type        = string
  default     = ""
}

variable "identity_domain_app_template_id" {
  type    = string
  default = "CustomWebAppTemplateId"
}

variable "apex_oidc_redirect_uris" {
  type    = list(string)
  default = []
}

variable "apex_post_logout_redirect_uris" {
  type    = list(string)
  default = []
}

variable "apex_oidc_allowed_grants" {
  type    = list(string)
  default = ["authorization_code", "refresh_token"]
}

variable "peoplesoft_archive_groups" {
  type = list(string)
  default = [
    "PS_HCM",
    "PS_BENEFITS",
    "PS_PAYROLL",
    "PS_PAYROLL_DOCUMENTS",
    "PS_GL",
    "PS_AP",
    "PS_AR",
    "PS_ASSET_MANAGEMENT",
    "PS_PURCHASING",
    "PS_BILLING",
    "PS_INVENTORY",
    "PS_ORDER_MANAGEMENT",
    "PS_PROJECT_COSTING",
    "PS_AUDIT",
    "PS_ARCHIVE_ADMIN"
  ]
}

resource "oci_identity_compartment" "peoplesoftarchive" {
  compartment_id = var.tenancy_ocid
  name           = "${var.project_name}-${var.environment}"
  description    = "PeopleSoft Archive ${var.environment} resources"
  enable_delete  = false
}

resource "oci_core_vcn" "main" {
  compartment_id = oci_identity_compartment.peoplesoftarchive.id
  cidr_block     = var.vcn_cidr_block
  display_name   = "${var.project_name}-${var.environment}-vcn"
  dns_label      = "peoplesoftarchive"
}

resource "oci_core_subnet" "private_db_endpoint" {
  compartment_id             = oci_identity_compartment.peoplesoftarchive.id
  vcn_id                     = oci_core_vcn.main.id
  cidr_block                 = var.private_db_endpoint_subnet_cidr_block
  display_name               = "${var.project_name}-${var.environment}-private-db-endpoint-subnet"
  dns_label                  = "psdbpriv"
  prohibit_public_ip_on_vnic = true
  route_table_id             = var.enable_ipsec_vpn ? oci_core_route_table.private_db_endpoint[0].id : null
}

resource "oci_core_network_security_group" "archive_db" {
  compartment_id = oci_identity_compartment.peoplesoftarchive.id
  vcn_id         = oci_core_vcn.main.id
  display_name   = "${var.project_name}-${var.environment}-archive-db-nsg"
}

resource "oci_core_network_security_group_security_rule" "adbsql_from_vcn" {
  network_security_group_id = oci_core_network_security_group.archive_db.id
  direction                 = "INGRESS"
  protocol                  = "6"
  source                    = var.vcn_cidr_block
  source_type               = "CIDR_BLOCK"

  tcp_options {
    destination_port_range {
      min = 1522
      max = 1522
    }
  }
}

resource "oci_core_network_security_group_security_rule" "adb_https_from_vcn" {
  network_security_group_id = oci_core_network_security_group.archive_db.id
  direction                 = "INGRESS"
  protocol                  = "6"
  source                    = var.vcn_cidr_block
  source_type               = "CIDR_BLOCK"

  tcp_options {
    destination_port_range {
      min = 443
      max = 443
    }
  }
}

resource "oci_database_autonomous_database" "archive" {
  compartment_id           = oci_identity_compartment.peoplesoftarchive.id
  db_name                  = var.archive_db_name
  display_name             = "${var.project_name}-${var.environment}-adb"
  db_workload              = "DW"
  admin_password           = var.adw_admin_password
  data_storage_size_in_tbs = 1
  compute_model            = "ECPU"
  compute_count            = 2
  license_model            = "LICENSE_INCLUDED"

  subnet_id              = oci_core_subnet.private_db_endpoint.id
  nsg_ids                = [oci_core_network_security_group.archive_db.id]
  private_endpoint_label = "psarchiveadb"

  is_mtls_connection_required = true
}

resource "oci_identity_domains_app" "apex_archive" {
  count = var.enable_sso ? 1 : 0

  idcs_endpoint = var.identity_domain_url
  schemas       = ["urn:ietf:params:scim:schemas:oracle:idcs:App"]

  display_name    = "${var.project_name}-${var.environment}-apex-archive"
  description     = "Confidential OIDC application for PeopleSoft Archive APEX authentication."
  active          = true
  is_oauth_client = true
  client_type     = "confidential"

  based_on_template {
    value = var.identity_domain_app_template_id
  }

  allowed_grants            = var.apex_oidc_allowed_grants
  redirect_uris             = var.apex_oidc_redirect_uris
  post_logout_redirect_uris = var.apex_post_logout_redirect_uris
}

resource "oci_identity_domains_group" "peoplesoft_archive_group" {
  for_each = var.enable_sso ? toset(var.peoplesoft_archive_groups) : toset([])

  idcs_endpoint = var.identity_domain_url
  schemas       = ["urn:ietf:params:scim:schemas:core:2.0:Group"]
  display_name  = each.value
}

data "oci_objectstorage_namespace" "current" {
  compartment_id = var.tenancy_ocid
}

resource "oci_objectstorage_bucket" "archive" {
  compartment_id = oci_identity_compartment.peoplesoftarchive.id
  namespace      = data.oci_objectstorage_namespace.current.namespace
  name           = "${var.project_name}-${var.environment}-archive"
  access_type    = "NoPublicAccess"
  storage_tier   = "Standard"
}

resource "oci_identity_group" "archive_admins" {
  compartment_id = var.tenancy_ocid
  name           = "${var.project_name}-${var.environment}-archive-admins"
  description    = "Admins who can manage PeopleSoft Archive storage resources."
}

resource "oci_identity_policy" "archive_admins_object_storage" {
  compartment_id = oci_identity_compartment.peoplesoftarchive.id
  name           = "${var.project_name}-${var.environment}-object-storage-admins"
  description    = "Allow archive admins to manage Object Storage resources."

  statements = [
    "Allow group ${oci_identity_group.archive_admins.name} to manage object-family in compartment ${oci_identity_compartment.peoplesoftarchive.name}"
  ]
}

resource "oci_bastion_bastion" "admin" {
  count = var.enable_bastion ? 1 : 0

  compartment_id               = oci_identity_compartment.peoplesoftarchive.id
  target_subnet_id             = oci_core_subnet.private_db_endpoint.id
  bastion_type                 = "STANDARD"
  name                         = "${var.project_name}-${var.environment}-admin-bastion"
  client_cidr_block_allow_list = var.bastion_client_cidr_blocks
  max_session_ttl_in_seconds   = 10800
}

resource "oci_core_drg" "main" {
  count = var.enable_ipsec_vpn ? 1 : 0

  compartment_id = oci_identity_compartment.peoplesoftarchive.id
  display_name   = "${var.project_name}-${var.environment}-drg"
}

resource "oci_core_drg_attachment" "vcn" {
  count = var.enable_ipsec_vpn ? 1 : 0

  drg_id       = oci_core_drg.main[0].id
  vcn_id       = oci_core_vcn.main.id
  display_name = "${var.project_name}-${var.environment}-drg-vcn-attachment"
}

resource "oci_core_cpe" "customer" {
  count = var.enable_ipsec_vpn ? 1 : 0

  compartment_id = oci_identity_compartment.peoplesoftarchive.id
  ip_address     = var.customer_cpe_public_ip
  display_name   = "${var.project_name}-${var.environment}-customer-cpe"
}

resource "oci_core_ipsec" "customer" {
  count = var.enable_ipsec_vpn ? 1 : 0

  compartment_id = oci_identity_compartment.peoplesoftarchive.id
  cpe_id         = oci_core_cpe.customer[0].id
  drg_id         = oci_core_drg.main[0].id
  static_routes  = var.customer_on_prem_cidr_blocks
  display_name   = "${var.project_name}-${var.environment}-ipsec"
}

resource "oci_core_route_table" "private_db_endpoint" {
  count = var.enable_ipsec_vpn ? 1 : 0

  compartment_id = oci_identity_compartment.peoplesoftarchive.id
  vcn_id         = oci_core_vcn.main.id
  display_name   = "${var.project_name}-${var.environment}-private-db-endpoint-routes"

  dynamic "route_rules" {
    for_each = var.customer_on_prem_cidr_blocks

    content {
      destination       = route_rules.value
      destination_type  = "CIDR_BLOCK"
      network_entity_id = oci_core_drg.main[0].id
    }
  }
}

resource "oci_core_network_security_group_security_rule" "adbsql_from_on_prem" {
  for_each = var.enable_ipsec_vpn ? toset(var.customer_on_prem_cidr_blocks) : toset([])

  network_security_group_id = oci_core_network_security_group.archive_db.id
  direction                 = "INGRESS"
  protocol                  = "6"
  source                    = each.value
  source_type               = "CIDR_BLOCK"

  tcp_options {
    destination_port_range {
      min = 1522
      max = 1522
    }
  }
}

resource "oci_core_network_security_group_security_rule" "adb_https_from_on_prem" {
  for_each = var.enable_ipsec_vpn ? toset(var.customer_on_prem_cidr_blocks) : toset([])

  network_security_group_id = oci_core_network_security_group.archive_db.id
  direction                 = "INGRESS"
  protocol                  = "6"
  source                    = each.value
  source_type               = "CIDR_BLOCK"

  tcp_options {
    destination_port_range {
      min = 443
      max = 443
    }
  }
}

data "oci_core_vcn_dns_resolver_association" "main" {
  vcn_id = oci_core_vcn.main.id
}

resource "oci_dns_resolver_endpoint" "inbound" {
  count = var.enable_dns_resolver_endpoint ? 1 : 0

  resolver_id   = data.oci_core_vcn_dns_resolver_association.main.dns_resolver_id
  name          = "${var.project_name}-${var.environment}-inbound-dns"
  subnet_id     = oci_core_subnet.private_db_endpoint.id
  is_listening  = true
  is_forwarding = false
}

# terraform.tfvars.example
tenancy_ocid     = "ocid1.tenancy.oc1..example"
user_ocid        = "ocid1.user.oc1..example"
fingerprint      = "00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00"
private_key_path = "~/.oci/oci_api_key.pem"
region           = "us-phoenix-1"

project_name = "peoplesoftarchive"
environment  = "prod"

vcn_cidr_block                = "10.20.0.0/16"
private_db_endpoint_subnet_cidr_block = "10.20.10.0/24"

archive_db_name        = "PSARCH"
# Do not put the real ADMIN password in this file.
# Pass it with TF_VAR_adw_admin_password, OCI Vault, or your approved secret manager.

enable_bastion = false
bastion_client_cidr_blocks = ["203.0.113.10/32"]

enable_ipsec_vpn = true
customer_cpe_public_ip = "203.0.113.20"
customer_on_prem_cidr_blocks = ["10.50.0.0/16"]

enable_dns_resolver_endpoint = true

enable_sso = true
identity_domain_url = "https://idcs-example.identity.oraclecloud.com"
identity_domain_app_template_id = "CustomWebAppTemplateId"
apex_oidc_redirect_uris = [
  "https://archive.example.com/ords/apex_authentication.callback"
]
apex_post_logout_redirect_uris = [
  "https://archive.example.com/ords/"
]
apex_oidc_allowed_grants = [
  "authorization_code",
  "refresh_token"
]
peoplesoft_archive_groups = [
  "PS_HCM",
    "PS_BENEFITS",
    "PS_PAYROLL",
    "PS_PAYROLL_DOCUMENTS",
    "PS_GL",
  "PS_AP",
  "PS_AR",
  "PS_BILLING",
  "PS_ASSET_MANAGEMENT",
  "PS_PURCHASING",
  "PS_INVENTORY",
  "PS_ORDER_MANAGEMENT",
  "PS_PROJECT_COSTING",
  "PS_AUDIT",
  "PS_ARCHIVE_ADMIN"
]

# outputs.tf
output "peoplesoftarchive_compartment_id" { value = oci_identity_compartment.peoplesoftarchive.id }
output "vcn_id" { value = oci_core_vcn.main.id }
output "private_db_endpoint_subnet_id" { value = oci_core_subnet.private_db_endpoint.id }
output "archive_bucket_name" { value = oci_objectstorage_bucket.archive.name }
output "archive_db_id" { value = oci_database_autonomous_database.archive.id }
output "archive_db_private_endpoint" { value = oci_database_autonomous_database.archive.private_endpoint }
output "bastion_id" { value = try(oci_bastion_bastion.admin[0].id, null) }
output "drg_id" { value = try(oci_core_drg.main[0].id, null) }
output "ipsec_connection_id" { value = try(oci_core_ipsec.customer[0].id, null) }
output "inbound_dns_resolver_ip" { value = try(oci_dns_resolver_endpoint.inbound[0].listening_address, null) }
output "apex_oidc_client_id" { value = try(oci_identity_domains_app.apex_archive[0].name, null) }