Exploit for randstad-linux-azure-architect-poc

## https://sploitus.com/exploit?id=254159E9-7A66-5CAD-91F8-E0B9C3E5CAD6
# Randstad Azure Linux Architect — POC

**GitHub:** https://github.com/saikirangvariganti/randstad-linux-azure-architect-poc

A proof-of-concept demonstrating the full Linux workload migration and operations stack for the Randstad Azure Linux Architect role. This repository covers Azure Migrate wave planning, Terraform Landing Zone, Ansible OS configuration, Chef idempotent cookbooks, Apache/Varnish/HAProxy web stack with TLS termination, and comprehensive HLD/LLD documentation.

---

## Architecture Overview

```
Internet → Azure Load Balancer (Public, Zone-Redundant)
             → HAProxy (TLS termination, port 443)
               → Varnish Cache (HTTP cache, port 6081)
                 → Apache (origin, port 8080)
                   → Internal LB → App Tier (RHEL 8 / Ubuntu 22.04)
                     → PostgreSQL Cluster (Data Tier)

Hub VNet: Azure Firewall, Bastion, Log Analytics
Spoke VNet: Web subnet, App subnet, Data subnet (hub-spoke peering)
```

---

## Repository Structure

```
randstad-linux-azure-architect-poc/
├── terraform/                    # Infrastructure as Code
│   ├── main.tf                   # Root module
│   ├── variables.tf
│   └── modules/
│       ├── landing_zone/         # Management groups, hub-spoke VNets, Azure Policy
│       ├── linux_vms/            # RHEL 8 + Ubuntu 22.04 IaaS VMs
│       ├── key_vault/            # Azure Key Vault with access policies
│       └── networking/           # NSGs, load balancers, route tables
├── ansible/                      # Ansible playbooks
│   ├── inventory.yml             # Inventory (web_tier, app_tier, data_tier groups)
│   ├── kernel_tuning.yml         # sysctl, hugepages, ulimits, tcp_bbr
│   ├── lvm_setup.yml             # LVM PV/VG/LV creation and mounting
│   ├── web_stack.yml             # Apache + Varnish + HAProxy deployment
│   ├── os_hardening.yml          # CIS Level 2 hardening (SSH, auditd, firewalld)
│   └── azure_iam.yml             # Azure AD integration, OMS agent
├── chef/                         # Chef cookbooks
│   └── cookbooks/
│       ├── linux_baseline/       # Baseline OS config, packages, chrony, rsyslog
│       ├── web_stack/            # Apache + Varnish + HAProxy cookbook
│       └── kernel_tuning/        # Kernel performance tuning cookbook
├── web_stack/                    # Web stack configuration files
│   ├── httpd.conf                # Apache config (origin on port 8080)
│   ├── default.vcl               # Varnish VCL (cache rules, backend health)
│   └── haproxy.cfg               # HAProxy config (TLS termination, LB rules)
├── migration/                    # Azure Migrate documentation
│   ├── assessment_plan.md        # Discovery methodology, dependency mapping
│   ├── wave_plan.md              # 7-wave migration plan with TCO details
│   ├── tco_model.py              # Python TCO calculator (3-year comparison)
│   └── cutover_runbook.md        # Step-by-step cutover procedure
├── hld_lld/                      # Architecture documentation
│   ├── HLD.md                    # High-Level Design (architecture principles, overview)
│   ├── LLD.md                    # Low-Level Design (NSG rules, VM specs, cipher suites)
│   └── bill_of_materials.md      # Full Azure resource and software BOM
├── scripts/                      # Utility scripts
│   ├── azure_migrate_prep.sh     # Pre-migration VM preparation
│   ├── kernel_benchmark.sh       # Post-migration kernel performance validation
│   └── tls_verify.sh             # TLS/SSL stack verification
├── .github/workflows/
│   ├── lint_and_test.yml         # pytest + Terraform fmt/validate + ShellCheck
│   └── ansible_lint.yml          # ansible-lint + Chef Cookstyle
└── tests/
    └── test_poc.py               # 85+ pytest tests (file existence, content validation)
```

---

## Key Technologies Demonstrated

| Technology | Usage |
|-----------|-------|
| **Terraform** (azurerm ~3.80) | Landing zone, hub-spoke topology, management groups, Azure Policy |
| **Ansible** (>= 2.15) | Kernel tuning (sysctl/hugepages/ulimits), LVM setup, OS hardening (CIS L2), web stack |
| **Chef** (>= 17.0) | Idempotent linux_baseline, web_stack, kernel_tuning cookbooks |
| **Azure Migrate** | Discovery, dependency mapping, wave-based migration |
| **HAProxy 2.8** | TLS 1.2/1.3 termination, HSTS, modern cipher suites (ECDHE/AES-GCM/ChaCha20) |
| **Varnish 7.x** | HTTP caching (VCL 4.1), TTL rules, PURGE ACLs |
| **Apache 2.4** | Origin server (port 8080), security headers, gzip, mod_proxy |
| **Hub-Spoke VNet** | Azure Firewall, Bastion, NSGs, load balancers, route tables |

---

## Running the TCO Model

```bash
python migration/tco_model.py
```

Outputs a 3-year TCO comparison across:
- On-premises (current state)
- Azure IaaS Pay-As-You-Go
- Azure IaaS 1-year Reserved Instances
- Azure IaaS 3-year Reserved Instances (best case)

---

## Running the Tests

```bash
# Install dependencies
pip install pytest pyyaml

# Run all 85+ tests
pytest tests/test_poc.py -v
```

---

## Deploying the Infrastructure

```bash
# Prerequisites: Azure CLI authenticated, subscription configured

cd terraform

# Initialise (replace with your backend config)
terraform init \
  -backend-config="resource_group_name=rg-tfstate-poc" \
  -backend-config="storage_account_name=strandstadtfstate" \
  -backend-config="container_name=tfstate"

# Plan
terraform plan -var="environment=nonprod" -out=tfplan

# Apply
terraform apply tfplan
```

---

## Applying Ansible Configuration

```bash
# From the Ansible control node (hub management subnet)
cd ansible

# OS hardening (all hosts)
ansible-playbook -i inventory.yml os_hardening.yml

# Kernel tuning (all hosts)
ansible-playbook -i inventory.yml kernel_tuning.yml

# Web stack (web tier only)
ansible-playbook -i inventory.yml web_stack.yml --limit web_tier
```

---

## Migration Wave Execution

1. Deploy Azure Landing Zone (Terraform)
2. Run Azure Migrate discovery (minimum 24 hours)
3. Review dependency maps and wave plan (`migration/wave_plan.md`)
4. Execute waves 0–7 per `migration/cutover_runbook.md`
5. Post-migration: apply Ansible config, validate with `scripts/kernel_benchmark.sh`

---

## TLS Verification

```bash
# After web stack deployment
./scripts/tls_verify.sh app.randstad.com 443

# Tests: certificate validity, TLS 1.0/1.1 rejection, cipher suites, HSTS
```

---

## Author

**Sai Kiran Goud Variganti**
GitHub: [saikirangvariganti](https://github.com/saikirangvariganti)
Role target: Azure Linux Architect — Randstad