Skip to content

Oracle Cloud

  • 最終更新日: 2025年3月2日

概要

本文書では、個人用RedmineをホストしているOracle Cloudの設定を記載します。

Identity & Security

Default Domain

唯一のドメインです。

Users

  • forgejo-backup
    • OCID: ocid1.user.oc1..aaaaaaaaa34m7dvpl2ps6425tvszkjaa725dnmrmzismddpxbhvuz7jyfrdq
    • forgejoは運用停止しており不要なため、削除予定です。
  • redmine-backup
    • OCID: ocid1.user.oc1..aaaaaaaaonpbd3rdactdcamsjso3m3jzswwu7lbqezzfycmmtp72tm5i4kpq
    • redmineのバックアップデータを保存するBucketへのアクセス用に作成しました。が、Instance Principalベースの管理に移行しており、不要となる予定です。
      • redmineを稼働しているinstanceをDynamic Groupでメンバーに入れ、Dynamic Groupに対して権限を付与していく予定です。
  • tack41@gmail.com
    • OCID: ocid1.user.oc1..aaaaaaaa6hfcbjndjjsvxztmnpibsla4rkzcrpbj3yfgarbv4hs3rltpmqxq
    • Oracle Cloudのログインユーザです。

Groups

  • forgejo-backup-group
    • OCID: ocid1.group.oc1..aaaaaaaah3zodi4efiwh36bcm7copswldvqhhiklc5stmem6qkucgvbmx6ka
    • forgejoは運用停止しており不要なため、削除予定です。
  • redmine-backup-group
    • OCID: ocid1.group.oc1..aaaaaaaa22mwtllilpzupw3zuce7hww4muqow7glaqbgc5wxbkb2cxxwvg4q
    • redmineのバックアップデータを保存するBucketへのアクセス用に作成しました。が、Instance Principalベースの管理に移行しており、不要となる予定です。
      • redmineを稼働しているinstanceをDynamic Groupでメンバーに入れ、Dynamic Groupに対して権限を付与していく予定です。
  • All Domain Users
    • OCID: ocid1.group.oc1..aaaaaaaambjqczt3zecroufmwnv3sllz7tzwxft2avjfc5ixkp3cdcdqdfia
  • Administrators
    • OCID: ocid1.group.oc1..aaaaaaaalf4bno7d6ff7vsrahvazaqfwsqm256wybqp4dr4njmhduzvleela

Dynamic Groups

  • instances_to_access_backup_data_of_redmine
    • OCID: ocid1.dynamicgroup.oc1..aaaaaaaaixyfc5jdyojxnnpqrakbqarjxhnmabqwbishoslxztuhnkfj76ja
    • redmineを稼働させているインスタンスを含むグループです。バックアップを保存するBucketに対するアクセス権限を付与するために作成しました。 
instance.id = 'ocid1.instance.oc1.ap-osaka-1.anvwsljrh4w6idac6r4cbyguueum3brtuyelqkdqsg4wumhla6p3a4ordy3q'

Policies

  • allow_access_to_bucket_tack41-forgejo_backup
  • OCID: ocid1.policy.oc1..aaaaaaaaqfje7edgewcfkxo5jnmtoblvysdumdbixjdcztpdofamnbg6czwa
  • forgejoは運用停止しており不要なため、削除予定です。
Allow group forgejo-backup-group to read buckets in tenancy
Allow group forgejo-backup-group to manage objects in tenancy where all {target.bucket.name='tack41-forgejo_backup', any {request.permission='OBJECT_INSPECT',request.permission='OBJECT_READ'}}
Allow group forgejo-backup-group to manage objects in tenancy where all {target.bucket.name='tack41-forgejo_backup', any {request.permission='OBJECT_INSPECT',request.permission='OBJECT_CREATE',request.permission='OBJECT_OVERWRITE'}}
  • objectstorage-can-manage-ap-osaka-1
    • OCID: ocid1.policy.oc1..aaaaaaaahvafbs5le4n73w7chl4nz2axbdmxop35q6iisxaepfwbsizivmjq
    • これがないとBucketへのバックアップがうまくいかなかったような気が... なくても動くかもしれません。
Allow service objectstorage-ap-osaka-1 to manage object-family in tenancy
  • allow_access_to_bucket_tack41-redmine_backup
    • OCID: ocid1.policy.oc1..aaaaaaaa5ifjd3og56ye4ttclgsja2k3bc35x6qqew2mfrmmmhisad5c5wuq
    • Compartment: tack41 (root)
    • redmineのバックアップデータをBucketに保存、Bucketから取得するためのものです。前半3行が旧サーバ用でUserベースのアクセス許可をしており、後半3行が新サーバ用でInstance Principalベースです。
Allow group redmine-backup-group to read buckets in tenancy
Allow group redmine-backup-group to manage objects in tenancy where all {target.bucket.name='tack41-redmine_backup', any {request.permission='OBJECT_INSPECT',request.permission='OBJECT_READ'}}
Allow group redmine-backup-group to manage objects in tenancy where all {target.bucket.name='tack41-redmine_backup', any {request.permission='OBJECT_INSPECT',request.permission='OBJECT_CREATE',request.permission='OBJECT_OVERWRITE'}}
Allow dynamic-group instances_to_access_backup_data_of_redmine to read buckets in tenancy
Allow dynamic-group instances_to_access_backup_data_of_redmine to manage objects in tenancy where all {target.bucket.name='tack41-redmine_backup', any {request.permission='OBJECT_INSPECT',request.permission='OBJECT_READ'}}
Allow dynamic-group instances_to_access_backup_data_of_redmine to manage objects in tenancy where all {target.bucket.name='tack41-redmine_backup', any {request.permission='OBJECT_INSPECT',request.permission='OBJECT_CREATE',request.permission='OBJECT_OVERWRITE'}}
  • console-iam-policy-20230205-0352
    • OCID: ocid1.policy.oc1..aaaaaaaap7afxcqkc6sccxbrfesdr2kjxm6gsjam7qkuitfxpqswaedlw2zq
    • Compartment: tack41 (root)
    • Description: コンソールにより、2023年2月4日(土) 18:52:45 UTCにIAMポリシー・ステートメントが作成されました
Allow service objectstorage-ap-osaka-1 to manage object-family in tenancy
  • PSM-root-policy
    • OCID: ocid1.policy.oc1..aaaaaaaaw6cav6in42mmakpwhklyp5xgoddtmr3jw7sewqctoey3llnp4jfa
    • Compartment: tack41 (root)
    • Description: PSM managed compartment root policy
allow service PSM to manage all-resources in compartment managedcompartmentforpaas
allow service OracleEnterpriseManager to manage all-resources in compartment managedcompartmentforpaas
allow service PSM to manage users in tenancy where target.user.name = /__PSM*/
allow any-user to manage all-resources in compartment managedcompartmentforpaas where request.user.name = /__PSM*/
allow any-user to manage all-resources in compartment managedcompartmentforpaas where request.instance.compartment.id = 'ocid1.compartment.oc1..aaaaaaaakeckig5ens55nlrd7pflskjt66mjlahbaf27thgcjnhnkyowvggq'
allow service PSM to inspect tenant in tenancy
allow service PSM to inspect compartments in tenancy
  • Tenant Admin Policy
    • OCID: ocid1.policy.oc1..aaaaaaaa2pq44glgxygabsod7zl3osspgvqquobexgylgmjx7ii5kf2tnnhq
    • Compartment: tack41 (root)
    • Description: Tenant Admin Policy
ALLOW GROUP Administrators to manage all-resources IN TENANCY
  • BootstrapProvisioning
    • OCID: ocid1.policy.oc1..aaaaaaaawzfxuosq4x7jntdfsn4ob3de7cuwxxb4m27prusqxjgafawfga7a
    • Compartment: tack41 (root)
    • Description: Temporary policy for /bootstrapDefaultDomain API's whitelisted services. Gives access to IAM work request APIs and ability to delete these policy when access is no longer needed.
ALLOW SERVICE tenancylifecycleservice to {IAM_WORKREQUEST_READ, IAM_WORKREQUEST_INSPECT} IN TENANCY
ALLOW SERVICE tenancylifecycleservice to {POLICY_DELETE} IN TENANCY where target.policy.name='BootstrapProvisioning'

Compute

Instances

  • oci-vm_arm64-ubuntu2404
    • General Information
      • OCID: ocid1.instance.oc1.ap-osaka-1.anvwsljrh4w6idac6r4cbyguueum3brtuyelqkdqsg4wumhla6p3a4ordy3q
      • Compartment: tack41 (root)
    • Image details
      • Operating system: Canonical Ubuntu
      • Version: 24.04 Minimal aarch64
    • Shape configuration
      • Shape: VM.Standard.A1.Flex
      • OCPU count: 2
      • Network bandwidth (Gbps): 2
      • Memory (GB): 12
      • Local disk: Block storage only
  • Primary VNIC
    • Public IPv4 address: 64.110.104.123
    • Private IPv4 address: 10.0.0.72
    • Route table: Default Route Table for vcn-20220404-1358
    • Network security groups: Allow443TCP2
    • Subnet: subnet-20220404-1358
    • Private DNS record: Enable
    • Hostname: instance-20250206-0520

Networking

Virtual Cloud Networks

  • vcn-20220404-1358
    • Network Security Groups
      • Allow443TCP
        • Stateless: False
        • Direction: Ingress
        • Source Type: CIDR
        • Source CIDR: 0.0.0.0/0
        • IP Protocal: TCP
        • Source Port Range: All
        • Destination Port Range: 443

以上です。