# EPIC EHR — NSX Security Blueprint

Automates NSX tags, security groups, and Distributed Firewall (DFW) policy for an EPIC Electronic Health Records deployment.

## Application Overview

EPIC is a multi-tier healthcare EHR platform. This blueprint segments the EPIC workloads into distinct security zones using NSX micro-segmentation.

## Tiers & Tags

| Tag | Scope | Purpose |
|---|---|---|
| `EPIC\|Web` | `AppName` | EPIC web/presentation tier |
| `EPIC\|App` | `AppName` | EPIC application tier |
| `EPIC\|DB` | `AppName` | EPIC database tier |
| `EPIC\|Mgmt` | `AppName` | EPIC management/Hyperspace servers |

## Security Groups

| Group | Membership Criteria | Purpose |
|---|---|---|
| `SG-EPIC-Web` | Tag: `EPIC\|Web` | Web-tier VMs |
| `SG-EPIC-App` | Tag: `EPIC\|App` | Application-tier VMs |
| `SG-EPIC-DB` | Tag: `EPIC\|DB` | Database-tier VMs |
| `SG-EPIC-Mgmt` | Tag: `EPIC\|Mgmt` | Management/Hyperspace VMs |
| `SG-EPIC-All` | Tag: `EPIC\|*` (all above) | All EPIC workloads — used in lockdown rules |

## DFW Policy: `Policy-EPIC`

| # | Rule Name | Source | Destination | Service | Action |
|---|---|---|---|---|---|
| 1 | Allow-HTTPS-Web | Any | SG-EPIC-Web | HTTPS (443) | Allow |
| 2 | Allow-App-to-DB | SG-EPIC-App | SG-EPIC-DB | MSSQL (1433) | Allow |
| 3 | Allow-SSH-DB | SG-EPIC-Mgmt | SG-EPIC-DB | SSH (22) | Allow |
| 4 | Allow-Web-to-App | SG-EPIC-Web | SG-EPIC-App | HTTP/HTTPS | Allow |
| 5 | Lockdown-EPIC | Any | SG-EPIC-All | Any | Deny |

> Rule 5 (Lockdown) has **Applied To** set to `SG-EPIC-All` to scope the deny to EPIC workloads only.

## Files

```
epic/
├── README.md
├── deploy.py          # Main entry point — orchestrates tags, groups, policy
├── tags.py            # Tag creation logic
├── security_groups.py # Security group creation logic
└── policy.py          # DFW policy and rule creation logic
```

## Usage

```bash
python epic/deploy.py \
  --nsx-manager <IP_OR_FQDN> \
  --username <admin_user> \
  --password <password>
```

### Optional flags
| Flag | Default | Description |
|---|---|---|
| `--dry-run` | False | Print planned changes without applying them |
| `--verify-ssl` | True | Disable with `--no-verify-ssl` for lab environments |