# [AppName] — NSX Security Blueprint Template

Generic template for creating NSX tags, security groups, and a Distributed Firewall (DFW) policy for a new application. Copy this directory and replace `[AppName]` throughout.

## Application Overview

_Describe the application, its role in the environment, and the tiers that need to be segmented._

## Tiers & Tags

| Tag | Scope | Purpose |
|---|---|---|
| `[AppName]\|Web` | `AppName` | Web / presentation tier |
| `[AppName]\|App` | `AppName` | Application tier |
| `[AppName]\|DB` | `AppName` | Database tier |

_Add or remove tiers as needed._

## Security Groups

| Group | Membership Criteria | Purpose |
|---|---|---|
| `SG-[AppName]-Web` | Tag: `[AppName]\|Web` | Web-tier VMs |
| `SG-[AppName]-App` | Tag: `[AppName]\|App` | Application-tier VMs |
| `SG-[AppName]-DB` | Tag: `[AppName]\|DB` | Database-tier VMs |
| `SG-[AppName]-All` | All groups above | All app workloads — used in lockdown rule |

## DFW Policy: `Policy-[AppName]`

| # | Rule Name | Source | Destination | Service | Action | Applied To |
|---|---|---|---|---|---|---|
| 1 | Allow-HTTPS-Web | Any | SG-[AppName]-Web | HTTPS (443) | Allow | DFW |
| 2 | Allow-MSSQL-DB | SG-[AppName]-App | SG-[AppName]-DB | MSSQL (1433) | Allow | DFW |
| 3 | Allow-SSH-DB | SG-[AppName]-Mgmt | SG-[AppName]-DB | SSH (22) | Allow | DFW |
| 4 | Lockdown-[AppName] | Any | SG-[AppName]-All | Any | Deny | SG-[AppName]-All |

> **Lockdown rule** (last rule): set **Applied To** to `SG-[AppName]-All` so the deny is scoped to this application's workloads only and does not affect other traffic on the DFW.

## Infrastructure Policy

An infrastructure-category policy (`Policy-Infra-[AppName]`) should be used for cross-cutting concerns such as:
- DNS / NTP access from app workloads
- AD/LDAP access
- Monitoring and backup agent traffic
- Syslog forwarding

_This policy lives under the **Infrastructure** DFW category and is documented separately._

## Files

```
_template/
├── README.md
├── deploy.py          # Main entry point — orchestrates tags, groups, policy
├── tags.py            # Tag creation logic
├── security_groups.py # Security group creation logic
└── policy.py          # DFW policy and rule creation logic
```

## Usage

```bash
python <appname>/deploy.py \
  --nsx-manager <IP_OR_FQDN> \
  --username <admin_user> \
  --password <password>
```

### Optional flags
| Flag | Default | Description |
|---|---|---|
| `--dry-run` | False | Print planned changes without applying them |
| `--verify-ssl` | True | Disable with `--no-verify-ssl` for lab environments |

## Customization Checklist

- [ ] Replace all `[AppName]` placeholders
- [ ] Add/remove tiers to match actual application architecture
- [ ] Adjust services/ports in the policy table
- [ ] Define which group gets SSH admin access (Rule 3 source)
- [ ] Review lockdown rule — confirm Applied To is correct
- [ ] Add infrastructure policy rules as needed