Terraform実装完了！GCP上でWordPressマルチテナント環境を構築【terraform plan検証済み】

 1# Homebrewのterraformをアンインストール
 2brew uninstall terraform
 3
 4# 最新版バイナリをダウンロード
 5cd /tmp
 6wget https://releases.hashicorp.com/terraform/1.13.5/terraform_1.13.5_linux_amd64.zip
 7unzip terraform_1.13.5_linux_amd64.zip
 8sudo mv terraform /usr/local/bin/
 9
10# バージョン確認
11terraform version
12# Terraform v1.13.5

1cat LICENSE.txt | head -20
2# Business Source License (BUSL)
3# 競合サービス提供時のみ制限
4# 自社インフラ管理には影響なし

 1# Application Default Credentials設定
 2gcloud auth application-default login
 3
 4# 必要なAPI一括有効化
 5gcloud services enable \
 6  compute.googleapis.com \
 7  servicenetworking.googleapis.com \
 8  sqladmin.googleapis.com \
 9  file.googleapis.com \
10  secretmanager.googleapis.com \
11  cloudresourcemanager.googleapis.com \
12  --project=infra-ai-agent
13
14# 成功: Operation "operations/..." finished successfully.

 1# modules/network/service_networking.tf
 2
 3# API有効化
 4resource "google_project_service" "servicenetworking" {
 5  service            = "servicenetworking.googleapis.com"
 6  disable_on_destroy = false
 7}
 8
 9# IP範囲予約
10resource "google_compute_global_address" "private_ip_address" {
11  name          = "${var.env}-sql-private-ip"
12  purpose       = "VPC_PEERING"
13  address_type  = "INTERNAL"
14  prefix_length = 16
15  network       = google_compute_network.vpc.id
16}
17
18# VPC Peering接続
19resource "google_service_networking_connection" "private_vpc_connection" {
20  network                 = google_compute_network.vpc.id
21  service                 = "servicenetworking.googleapis.com"
22  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
23  
24  depends_on = [google_project_service.servicenetworking]
25}

 1# modules/iam/main.tf
 2
 3# ✅ 読み取り専用
 4resource "google_project_iam_member" "web_secret_accessor" {
 5  role = "roles/secretmanager.secretAccessor"
 6  member  = "serviceAccount:${google_service_account.web_server.email}"
 7}
 8
 9# ✅ Secret新規作成のみ
10resource "google_project_iam_member" "web_secret_creator" {
11  role = "roles/secretmanager.secretCreator"
12  member  = "serviceAccount:${google_service_account.web_server.email}"
13}
14
15# ✅ 既存Secretへのバージョン追加のみ
16resource "google_project_iam_member" "web_secret_version_adder" {
17  role = "roles/secretmanager.secretVersionAdder"
18  member  = "serviceAccount:${google_service_account.web_server.email}"
19}

 1# modules/database/databases.tf
 2
 3# サイト数 = ドメイン数
 4locals {
 5  site_count = length(var.domains)
 6}
 7
 8# DB自動生成
 9resource "google_sql_database" "wordpress_sites" {
10  count     = local.site_count
11  name      = "wordpress_site_${count.index + 1}"
12  instance  = google_sql_database_instance.wordpress.name
13  charset   = "utf8mb4"
14  collation = "utf8mb4_unicode_ci"
15}
16
17# DBユーザー自動生成
18resource "google_sql_user" "wordpress_users" {
19  count    = local.site_count
20  name     = "wp_user_${count.index + 1}"
21  instance = google_sql_database_instance.wordpress.name
22  password = random_password.db_passwords[count.index].result
23}
24
25# パスワードをSecret Managerに保存
26resource "google_secret_manager_secret" "db_passwords" {
27  count     = local.site_count
28  secret_id = "${var.env}-wordpress-db-password-${count.index + 1}"
29  
30  replication {
31    auto {}
32  }
33}

 1# terraform/scripts/startup_script.sh
 2
 3#!/bin/bash
 4set -e
 5
 6# Filestore NFSマウント
 7mount -t nfs ${NFS_IP}:${NFS_PATH} /var/www/wordpress
 8
 9# ドメインリストから動的にNginx設定生成
10DOMAINS_JSON='${domains_json}'
11DOMAIN_COUNT=$(echo "$DOMAINS_JSON" | jq '. | length')
12
13for i in $(seq 1 $DOMAIN_COUNT); do
14  DOMAIN=$(echo "$DOMAINS_JSON" | jq -r ".[$((i-1))]")
15  
16  # Nginx仮想ホスト生成
17  cat > /etc/nginx/sites-available/site${i} << EOF
18server {
19    listen 80;
20    server_name ${DOMAIN};
21    root /var/www/wordpress/site${i};
22    
23    location ~ \.php$ {
24        fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
25        # ...
26    }
27}
28EOF
29  ln -sf /etc/nginx/sites-available/site${i} /etc/nginx/sites-enabled/
30done
31
32# WordPress自動セットアップスクリプト生成
33cat > /usr/local/bin/setup-wordpress-site.sh << 'SCRIPT'
34#!/bin/bash
35SITE_NUM=$1
36DB_PASS=$(gcloud secrets versions access latest \
37  --secret="${ENV}-wordpress-db-password-${SITE_NUM}")
38
39# WordPress インストール
40wp core download
41wp config create --dbname="wordpress_site_${SITE_NUM}" --dbpass="$DB_PASS"
42wp core install --url="https://${DOMAIN}" --admin_password="$(openssl rand -base64 32)"
43
44# 管理者パスワードをSecret Managerに保存
45gcloud secrets create "${ENV}-wordpress-admin-password-${SITE_NUM}" || \
46gcloud secrets versions add "${ENV}-wordpress-admin-password-${SITE_NUM}"
47SCRIPT

1cd terraform
2terraform fmt -recursive
3
4# 22ファイル自動整形
5environments/dev/main.tf
6environments/prod/main.tf
7modules/compute/autoscaling.tf
8modules/database/databases.tf
9# ...

 1# prod環境
 2cd environments/prod
 3terraform init
 4terraform validate
 5# ✅ Success! The configuration is valid.
 6
 7# dev環境
 8cd ../dev
 9terraform init
10terraform validate
11# ✅ Success! The configuration is valid.

1cd environments/prod
2terraform plan
3
4# Plan: 94 to add, 0 to change, 0 to destroy.

1cd ../dev
2terraform plan
3
4# Plan: 59 to add, 0 to change, 0 to destroy.

1# ❌ 古い構文
2replication {
3  automatic = true
4}
5
6# ✅ 新しい構文
7replication {
8  auto {}
9}

1# ❌ PostgreSQL/SQL Server用
2backup_configuration {
3  point_in_time_recovery_enabled = true
4}
5
6# ✅ MySQL用
7backup_configuration {
8  binary_log_enabled = var.availability_type == "REGIONAL"
9}

1# terraform.tfvars
2domains = [
3  "example1.com",
4  "example2.com",
5  # ... 10個
6]

1db_availability_type = "REGIONAL"  # HA有効
2db_tier              = "db-custom-2-7680"  # 2 vCPU
3machine_type         = "e2-small"
4min_replicas         = 2

1db_availability_type = "ZONAL"  # 単一インスタンス
2db_tier              = "db-custom-1-3840"  # 1 vCPU
3machine_type         = "e2-micro"
4min_replicas         = 1

1locals {
2  site_count = length(var.domains)
3}
4
5resource "google_sql_database" "wordpress_sites" {
6  count = local.site_count
7  # ...
8}

1# terraform.tfvarsに実際のドメインを設定
2vi environments/prod/terraform.tfvars
3
4# 実行計画の保存
5terraform plan -out=tfplan
6
7# 実際のデプロイ（慎重に！）
8terraform apply tfplan