Initial commit

2026-04-18 10:12:10 -05:00
1 parent 37a2659067
commit 2e3c012074
@@ -0,0 +1,64 @@
+# EPIC EHR — NSX Security Blueprint
+
+Automates NSX tags, security groups, and Distributed Firewall (DFW) policy for an EPIC Electronic Health Records deployment.
+
+## Application Overview
+
+EPIC is a multi-tier healthcare EHR platform. This blueprint segments the EPIC workloads into distinct security zones using NSX micro-segmentation.
+
+## Tiers & Tags
+
+| Tag | Scope | Purpose |
+|---|---|---|
+| `EPIC\|Web` | `AppName` | EPIC web/presentation tier |
+| `EPIC\|App` | `AppName` | EPIC application tier |
+| `EPIC\|DB` | `AppName` | EPIC database tier |
+| `EPIC\|Mgmt` | `AppName` | EPIC management/Hyperspace servers |
+
+## Security Groups
+
+| Group | Membership Criteria | Purpose |
+|---|---|---|
+| `SG-EPIC-Web` | Tag: `EPIC\|Web` | Web-tier VMs |
+| `SG-EPIC-App` | Tag: `EPIC\|App` | Application-tier VMs |
+| `SG-EPIC-DB` | Tag: `EPIC\|DB` | Database-tier VMs |
+| `SG-EPIC-Mgmt` | Tag: `EPIC\|Mgmt` | Management/Hyperspace VMs |
+| `SG-EPIC-All` | Tag: `EPIC\|*` (all above) | All EPIC workloads — used in lockdown rules |
+
+## DFW Policy: `Policy-EPIC`
+
+| # | Rule Name | Source | Destination | Service | Action |
+|---|---|---|---|---|---|
+| 1 | Allow-HTTPS-Web | Any | SG-EPIC-Web | HTTPS (443) | Allow |
+| 2 | Allow-App-to-DB | SG-EPIC-App | SG-EPIC-DB | MSSQL (1433) | Allow |
+| 3 | Allow-SSH-DB | SG-EPIC-Mgmt | SG-EPIC-DB | SSH (22) | Allow |
+| 4 | Allow-Web-to-App | SG-EPIC-Web | SG-EPIC-App | HTTP/HTTPS | Allow |
+| 5 | Lockdown-EPIC | Any | SG-EPIC-All | Any | Deny |
+
+> Rule 5 (Lockdown) has **Applied To** set to `SG-EPIC-All` to scope the deny to EPIC workloads only.
+
+## Files
+
+```
+epic/
+├── README.md
+├── deploy.py          # Main entry point — orchestrates tags, groups, policy
+├── tags.py            # Tag creation logic
+├── security_groups.py # Security group creation logic
+└── policy.py          # DFW policy and rule creation logic
+```
+
+## Usage
+
+```bash
+python epic/deploy.py \
+  --nsx-manager <IP_OR_FQDN> \
+  --username <admin_user> \
+  --password <password>
+```
+
+### Optional flags
+| Flag | Default | Description |
+|---|---|---|
+| `--dry-run` | False | Print planned changes without applying them |
+| `--verify-ssl` | True | Disable with `--no-verify-ssl` for lab environments |