# NSX Security Blueprints

Python-based automation scripts for deploying NSX tags, security groups, and security policies for enterprise applications.

## Supported NSX Versions
- NSX 4.x
- NSX 9.x

## Structure

```
nsx_blueprints/
├── shared/                  # Shared utilities, NSX API client, constants
├── infra/                   # Infrastructure policy (DNS, NTP, AD) — Infrastructure DFW category
├── epic/                    # EPIC EHR application blueprint
├── horizon_view/            # Omnissa Horizon View (VDI) blueprint
└── _template/               # Generic blueprint template for new applications
```

## Blueprints

| Blueprint | DFW Category | Description |
|---|---|---|
| [Infrastructure](infra/) | Infrastructure | Shared services — DNS, NTP, Active Directory security groups and policy |
| [EPIC](epic/) | Application | EPIC Electronic Health Records — tags, security groups, and DFW policy |
| [Horizon View](horizon_view/) | Application | Omnissa Horizon View VDI — tags, security groups, and DFW policy |
| [Template](\_template/) | Application | Generic starting point for new application blueprints |

## Conventions

### Tag Naming
`<AppName>|<Tier>` — e.g. `EPIC|Web`, `EPIC|App`, `EPIC|DB`

### Security Group Naming
`SG-<AppName>-<Tier>` — e.g. `SG-EPIC-Web`, `SG-EPIC-DB`

### Policy / Rule Naming
- Policy: `Policy-<AppName>`
- Rules: descriptive action-first names, e.g. `Allow-HTTPS-Web`, `Deny-All`

## Prerequisites
- Python 3.10+
- `requests` library
- NSX Manager credentials with appropriate RBAC permissions

## Usage

Each blueprint directory contains its own `README.md` with application-specific setup and run instructions.

```bash
pip install -r requirements.txt
python epic/deploy.py --nsx-manager <IP> --username <user> --password <pass>
```