GCP上でWordPressマルチテナント環境を設計する【要件定義からTerraform設計まで完全解説】

1// WordPressプラグインでの実装例
2header('Cache-Control: public, max-age=300, s-maxage=600');

1# Web ServerサービスアカウントのIAM権限
2roles/secretmanager.secretAccessor       // DB読み取り専用
3roles/secretmanager.secretCreator        // Secret新規作成のみ
4roles/secretmanager.secretVersionAdder   // バージョン追加のみ
5roles/cloudsql.client                    // Cloud SQL接続
6roles/file.editor                        // Filestoreアクセス

 1# modules/network/service_networking.tf
 2
 3# Service Networking API有効化
 4resource "google_project_service" "servicenetworking" {
 5  service = "servicenetworking.googleapis.com"
 6}
 7
 8# Private IP範囲を予約（/16）
 9resource "google_compute_global_address" "private_ip_address" {
10  name          = "private-ip-address"
11  purpose       = "VPC_PEERING"
12  address_type  = "INTERNAL"
13  prefix_length = 16
14  network       = google_compute_network.vpc.id
15}
16
17# Service Networking接続を作成
18resource "google_service_networking_connection" "private_vpc_connection" {
19  network                 = google_compute_network.vpc.id
20  service                 = "servicenetworking.googleapis.com"
21  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
22  
23  depends_on = [google_project_service.servicenetworking]
24}

1# environments/prod/main.tf
2
3module "database" {
4  source = "../../modules/database"
5  
6  # 重要: Service Networking接続が完了してからCloud SQL作成
7  depends_on = [module.network]
8}

 1# modules/filestore/main.tf
 2
 3# Filestore用IP範囲を予約（/29）
 4resource "google_compute_global_address" "filestore_ip" {
 5  name          = "filestore-ip-range"
 6  purpose       = "VPC_PEERING"
 7  address_type  = "INTERNAL"
 8  prefix_length = 29
 9  network       = var.network_id
10}
11
12resource "google_filestore_instance" "wordpress" {
13  name     = "wordpress-filestore"
14  tier     = "BASIC_HDD"  # コスト最適化
15  
16  file_shares {
17    name        = "wordpress"
18    capacity_gb = 1024
19  }
20  
21  networks {
22    network           = var.network_id  # フルリソース名が必須
23    modes             = ["MODE_IPV4"]
24    connect_mode      = "DIRECT_PEERING"
25    reserved_ip_range = google_compute_global_address.filestore_ip.name
26  }
27  
28  depends_on = [google_project_service.filestore]
29}

 1# scripts/startup_script.sh
 2
 3# Filestoreマウント
 4FILESTORE_IP="${filestore_ip}"
 5FILESTORE_SHARE="wordpress"
 6
 7apt-get install -y nfs-common
 8mkdir -p /mnt/wordpress
 9mount -t nfs $FILESTORE_IP:/$FILESTORE_SHARE /mnt/wordpress
10
11# fstabに追加（再起動後も自動マウント）
12echo "$FILESTORE_IP:/$FILESTORE_SHARE /mnt/wordpress nfs defaults 0 0" >> /etc/fstab

1# environments/prod/terraform.tfvars
2
3domains = [
4  "example1.com",
5  "example2.com",
6  // ... 10サイト分
7]

 1# modules/database/databases.tf
 2
 3locals {
 4  site_count = length(var.domains)  # ドメイン数から自動算出
 5}
 6
 7# 各サイト用のDB作成
 8resource "google_sql_database" "wordpress_db" {
 9  count    = local.site_count
10  name     = "wordpress_site${count.index + 1}"
11  instance = google_sql_database_instance.main.name
12}
13
14# 各サイト用のDBユーザー作成
15resource "google_sql_user" "wordpress_user" {
16  count    = local.site_count
17  name     = "wp_user_site${count.index + 1}"
18  instance = google_sql_database_instance.main.name
19  password = random_password.db_password[count.index].result
20}

 1# scripts/startup_script.sh
 2
 3# メタデータからドメインリストを取得
 4DOMAINS_JSON=$(curl -H "Metadata-Flavor: Google" \
 5  http://metadata.google.internal/computeMetadata/v1/instance/attributes/domains)
 6
 7# 各サイト用のディレクトリ作成
 8for i in {1..10}; do
 9  mkdir -p /mnt/wordpress/site${i}
10  chown -R www-data:www-data /mnt/wordpress/site${i}
11  
12  # Nginx仮想ホスト生成
13  DOMAIN=$(echo $DOMAINS_JSON | jq -r ".[$((i-1))]")
14  cat > /etc/nginx/sites-available/site${i}.conf <<EOF
15server {
16    listen 80;
17    server_name $DOMAIN;
18    root /mnt/wordpress/site${i};
19    
20    location / {
21        try_files \$uri \$uri/ /index.php?\$args;
22    }
23    
24    location ~ \.php$ {
25        fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
26        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
27        include fastcgi_params;
28    }
29}
30EOF
31  ln -s /etc/nginx/sites-available/site${i}.conf /etc/nginx/sites-enabled/
32done
33
34nginx -t && systemctl reload nginx

 1# /usr/local/bin/setup-wordpress-site.sh
 2
 3#!/bin/bash
 4SITE_NUM=$1
 5DB_PASSWORD=$(gcloud secrets versions access latest --secret="prod-wordpress-db-password-${SITE_NUM}")
 6ADMIN_PASSWORD=$(openssl rand -base64 24)
 7
 8cd /mnt/wordpress/site${SITE_NUM}
 9wp core download --allow-root
10wp config create \
11  --dbname="wordpress_site${SITE_NUM}" \
12  --dbuser="wp_user_site${SITE_NUM}" \
13  --dbpass="$DB_PASSWORD" \
14  --dbhost="10.x.x.x" \
15  --allow-root
16
17wp core install \
18  --url="https://$(echo $DOMAINS_JSON | jq -r ".[${SITE_NUM}-1]")" \
19  --title="Site ${SITE_NUM}" \
20  --admin_user="admin" \
21  --admin_password="$ADMIN_PASSWORD" \
22  --admin_email="admin@example.com" \
23  --allow-root
24
25# 管理者パスワードをSecret Managerに保存
26gcloud secrets create prod-wordpress-admin-password-${SITE_NUM} \
27  --data-file=<(echo -n "$ADMIN_PASSWORD") || \
28gcloud secrets versions add prod-wordpress-admin-password-${SITE_NUM} \
29  --data-file=<(echo -n "$ADMIN_PASSWORD")
30
31echo "✅ Site ${SITE_NUM} セットアップ完了"
32echo "管理者パスワードは以下で取得:"
33echo "gcloud secrets versions access latest --secret=prod-wordpress-admin-password-${SITE_NUM}"

 1# modules/database/variables.tf
 2
 3variable "availability_type" {
 4  description = "Cloud SQL HA設定"
 5  type        = string
 6  
 7  validation {
 8    condition     = contains(["REGIONAL", "ZONAL"], var.availability_type)
 9    error_message = "availability_type must be REGIONAL or ZONAL."
10  }
11}

 1# modules/database/main.tf
 2
 3resource "google_sql_database_instance" "main" {
 4  name             = "${var.environment}-mysql"
 5  database_version = "MYSQL_8_0"
 6  region           = var.region
 7  
 8  settings {
 9    tier              = "db-custom-2-7680"  # HA対応スペック
10    availability_type = var.availability_type
11    
12    backup_configuration {
13      enabled            = true
14      start_time         = "03:00"
15      binary_log_enabled = var.availability_type == "REGIONAL"  # HAの場合のみ有効
16    }
17    
18    ip_configuration {
19      ipv4_enabled    = false
20      private_network = var.network_id
21    }
22  }
23  
24  depends_on = [module.network]
25}

1# environments/prod/terraform.tfvars
2db_availability_type = "REGIONAL"  # 本番: HA有効
3
4# environments/dev/terraform.tfvars
5db_availability_type = "ZONAL"     # 開発: 単一インスタンス

1# ❌ 過剰権限
2resource "google_project_iam_member" "web_secret_admin" {
3  role = "roles/secretmanager.admin"  # 何でもできてしまう
4}

 1# modules/iam/main.tf
 2
 3# ✅ 読み取り専用
 4resource "google_project_iam_member" "web_secret_accessor" {
 5  role = "roles/secretmanager.secretAccessor"
 6}
 7
 8# ✅ Secret新規作成のみ
 9resource "google_project_iam_member" "web_secret_creator" {
10  role = "roles/secretmanager.secretCreator"
11}
12
13# ✅ 既存Secretへのバージョン追加のみ
14resource "google_project_iam_member" "web_secret_version_adder" {
15  role = "roles/secretmanager.secretVersionAdder"
16}

1depends_on = [var.some_variable]           # 変数は不可
2depends_on = [module.network.output_name]   # 出力値は不可

1depends_on = [module.network]              # モジュール全体
2depends_on = [google_project_service.api]  # リソース