services:
  jenkins:
    image: jenkins/jenkins:lts-jdk21
    container_name: jenkins
    restart: unless-stopped
    user: "1000:1000"
    environment:
      - TZ=Asia/Tokyo
      # 2GB VPS向けにJVMメモリを最大512MBに抑制し、SerialGCでオーバーヘッドを極小化
      - JAVA_OPTS=-Xms128m -Xmx512m -XX:+UseSerialGC
    deploy:
      resources:
        limits:
          memory: 768M
    labels:
      - traefik.enable=true
      - traefik.http.routers.jenkins.rule=Host(`jenkinsのサブドメイン`)
      - traefik.http.services.jenkins.loadbalancer.server.port=8080
      - logging=promtail
    volumes:
      - jenkins-data:/var/jenkins_home
    networks:
      ride_webservice_network:
    extra_hosts:
      - "host.docker.internal:host-gateway"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  jenkins-data:

networks:
  ride_webservice_network:
    external: true

pipeline {
    agent any

    options {
        // Jenkins コンテナ内に巨大リポジトリ（200MB超の Git LFS ファイル等）をチェックアウトするのをスキップ
        // （ホスト側で SSH 経由で pull・デプロイするため Jenkins 側への clone は不要）
        skipDefaultCheckout(true)
    }

    parameters {
        choice(
            name: 'TARGET_SERVICE',
            choices: ['Service1', 'Service2', 'Service3', 'ALL'],
            description: 'リリース対象のサービスを選択してください'
        )
        string(
            name: 'BRANCH',
            defaultValue: 'main',
            description: 'Git取得元ブランチ'
        )
        booleanParam(
            name: 'CONFIRM_DEPLOY',
            defaultValue: false,
            description: '【重要】本番リリースを実行する場合はチェックを入れてください'
        )
    }

    stages {
        stage('Release Confirmation') {
            steps {
                script {
                    if (!params.CONFIRM_DEPLOY) {
                        error('本番リリースチェックが無効です。誤操作防止のためジョブを中止しました。')
                    }
                }
            }
        }

        stage('Execute Deploy') {
            steps {
                script {
                    def targets = []
                    if (params.TARGET_SERVICE == 'ALL') {
                        targets = ['Service1', 'Service2', 'Service3']
                    } else {
                        targets = [params.TARGET_SERVICE]
                    }

                    sshagent(credentials: ['設定したクレデンシャル']) {
                        for (target in targets) {
                            echo "========================================="
                            echo "Deploying target service: ${target}"
                            echo "========================================="
                            sh """
                                ssh -o StrictHostKeyChecking=no user@host.docker.internal '
                                    set -e
                                    cd /home/user/${target}
                                    echo "Working directory: \$(pwd)"
                                    if [ -d .git ]; then
                                        echo "Pulling latest git changes..."
                                        git pull origin ${params.BRANCH} || git pull || true
                                    fi
                                    echo "Executing deploy.sh..."
                                    ./deploy.sh
                                '
                            """
                        }
                    }
                }
            }
        }
    }

    post {
        success {
            echo "✓ [${params.TARGET_SERVICE}] 本番リリース処理が正常に完了しました！"
        }
        failure {
            echo "✗ [${params.TARGET_SERVICE}] 本番リリース処理に失敗しました。ログを確認してください。"
        }
    }
}

ssh -i /path/to/[ダウンロードしたSSH秘密鍵] opc@[パブリックIP]
※パブリックIPはOracle Cloud InfrastractureのInstancリストから確認できます

** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html

sudo dnf install -y nginx

mysql -u user -p -h 127.0.0.1 → TCP/IP接続
mysql -u user -p -h localhost → Unixソケット接続

mysql -u user -p -h 127.0.0.1

ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)

mysql -u user -p -h localhost --protocol=TCP

brew install kind

kind version
↓
kind v0.33.0 go1.27.0 darwin/amd64

kind create cluster --name study
↓
Creating cluster "study" ...
 ✓ Ensuring node image (kindest/node:v1.37.0) 🖼
 ✓ Preparing nodes 📦
 ✓ Writing configuration 📜
 ✓ Starting control-plane 🕹
 ✓ Installing CNI 🔌
 ✓ Installing StorageClass 💾
Set kubectl context to "kind-study"
You can now use your cluster with:

kubectl cluster-info --context kind-study

Thanks for using kind! 😊

kubectl cluster-info --context kind-study
↓
Kubernetes control plane is running at https://127.0.0.1:57690
CoreDNS is running at https://127.0.0.1:57690/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

kubectl get nodes
↓
NAME                  STATUS   ROLES           AGE    VERSION
study-control-plane   Ready    control-plane   4m6s   v1.37.0

kubectl get pods -A
↓
NAMESPACE            NAME                                          READY   STATUS    RESTARTS   AGE
kube-system          coredns-559f6c778d-d8txz                      1/1     Running   0          5m55s
kube-system          coredns-559f6c778d-n79ln                      1/1     Running   0          5m55s
kube-system          etcd-study-control-plane                      1/1     Running   0          6m3s
kube-system          kindnet-v2z9q                                 1/1     Running   0          5m55s
kube-system          kube-apiserver-study-control-plane            1/1     Running   0          6m3s
kube-system          kube-controller-manager-study-control-plane   1/1     Running   0          6m3s
kube-system          kube-proxy-p7qb4                              1/1     Running   0          5m55s
kube-system          kube-scheduler-study-control-plane            1/1     Running   0          6m3s
local-path-storage   local-path-provisioner-75f7fc7dc5-6mlb9       1/1     Running   0          5m55s

kubectl run nginx --image=nginx
↓
pod/nginx created

kubectl get pods
↓
NAME    READY   STATUS    RESTARTS   AGE
nginx   1/1     Running   0          83s

より詳しい情報を見る
kubectl describe pod nginx
↓
Name:             nginx
Namespace:        default
Priority:         0
Service Account:  default
Node:             study-control-plane/172.19.0.2
Start Time:       Wed, 02 Sep 2026 10:46:34 +0900
Labels:           run=nginx
Annotations:      <none>
Status:           Running
IP:               10.244.0.5
IPs:
  IP:  10.244.0.5
Containers:
  nginx:
    Container ID:   containerd://e7921ffe7728e479ab0cd4fcc004e3b98bfb8537289a535942d25d2920ad8967
    Image:          nginx
    Image ID:       docker.io/library/nginx@sha256:b34848eff6db786b6b1282d3a9c3fd0b5563dfb6d261df4923378b419e0d24f0
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Wed, 02 Sep 2026 10:46:44 +0900
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-r6x7t (ro)
Conditions:
  Type                        Status
  PodReadyToStartContainers   True
  Initialized                 True
  Ready                       True
  ContainersReady             True
  PodScheduled                True
Volumes:
  kube-api-access-r6x7t:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    Optional:                false
    DownwardAPI:             true
QoS Class:                   BestEffort
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason     Age    From               Message
  ----    ------     ----   ----               -------
  Normal  Scheduled  2m26s  default-scheduler  Successfully assigned default/nginx to study-control-plane
  Normal  Pulling    2m26s  kubelet            spec.containers{nginx}: Pulling image "nginx"
  Normal  Pulled     2m16s  kubelet            spec.containers{nginx}: Successfully pulled image "nginx" in 9.876s (9.877s including waiting). Image size: 63348835 bytes.
  Normal  Created    2m16s  kubelet            spec.containers{nginx}: Container created
  Normal  Started    2m16s  kubelet            spec.containers{nginx}: Container started

kubectl logs nginx
↓
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
/docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
/docker-entrypoint.sh: Configuration complete; ready for start up
2026/09/02 01:46:44 [notice] 1#1: using the "epoll" event method
2026/09/02 01:46:44 [notice] 1#1: nginx/1.31.4
2026/09/02 01:46:44 [notice] 1#1: built by gcc 14.2.0 (Debian 14.2.0-19)
2026/09/02 01:46:44 [notice] 1#1: OS: Linux 7.0.12-linuxkit
2026/09/02 01:46:44 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1073741816:1073741816
2026/09/02 01:46:44 [notice] 1#1: start worker processes
2026/09/02 01:46:44 [notice] 1#1: start worker process 33
2026/09/02 01:46:44 [notice] 1#1: start worker process 34
2026/09/02 01:46:44 [notice] 1#1: start worker process 35
2026/09/02 01:46:44 [notice] 1#1: start worker process 36
2026/09/02 01:46:44 [notice] 1#1: start worker process 37
2026/09/02 01:46:44 [notice] 1#1: start worker process 38
2026/09/02 01:46:44 [notice] 1#1: start worker process 39
2026/09/02 01:46:44 [notice] 1#1: start worker process 40
2026/09/02 01:46:44 [notice] 1#1: start worker process 41
2026/09/02 01:46:44 [notice] 1#1: start worker process 42
2026/09/02 01:46:44 [notice] 1#1: start worker process 43
2026/09/02 01:46:44 [notice] 1#1: start worker process 44

kubectl port-forward pod/nginx 8080:80
↓
Forwarding from 127.0.0.1:8080 -> 80
Forwarding from [::1]:8080 -> 80

kubectl logs nginx
↓
34#34: *2 open() "/usr/share/nginx/html/tools" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: "GET /tools HTTP/1.1", host: "localhost:8080", referrer: "http://localhost:8080/"
127.0.0.1 - - [02/Sep/2026:01:58:42 +0000] "GET /tools HTTP/1.1" 404 555 "http://localhost:8080/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "-"
127.0.0.1 - - [02/Sep/2026:01:58:43 +0000] "GET /build.json HTTP/1.1" 404 555 "http://localhost:8080/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "-"
2026/09/02 01:58:43 [error] 35#35: *3 open() "/usr/share/nginx/html/build.json" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: "GET /build.json HTTP/1.1", host: "localhost:8080", referrer: "http://localhost:8080/"
2026/09/02 01:58:43 [error] 35#35: *3 open() "/usr/share/nginx/html/props" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: "GET /props?autoload=false HTTP/1.1", host: "localhost:8080", referrer: "http://localhost:8080/"
127.0.0.1 - - [02/Sep/2026:01:58:43 +0000] "GET /props?autoload=false HTTP/1.1" 404 555 "http://localhost:8080/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "-"
2026/09/02 01:58:43 [error] 35#35: *3 open() "/usr/share/nginx/html/v1/models" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: "GET /v1/models HTTP/1.1", host: "localhost:8080", referrer: "http://localhost:8080/"
127.0.0.1 - - [02/Sep/2026:01:58:43 +0000] "GET /v1/models HTTP/1.1" 404 555 "http://localhost:8080/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "-"
127.0.0.1 - - [02/Sep/2026:01:58:45 +0000] "GET /sw.js HTTP/1.1" 404 555 "http://localhost:8080/sw.js" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "-"
2026/09/02 01:58:45 [error] 35#35: *3 open() "/usr/share/nginx/html/sw.js" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: "GET /sw.js HTTP/1.1", host: "localhost:8080", referrer: "http://localhost:8080/sw.js"
127.0.0.1 - - [02/Sep/2026:01:59:05 +0000] "GET / HTTP/1.1" 200 896 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "-"
2026/09/02 01:59:05 [error] 36#36: *4 open() "/usr/share/nginx/html/favicon.ico" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: "GET /favicon.ico HTTP/1.1", host: "localhost:8080", referrer: "http://localhost:8080/"
127.0.0.1 - - [02/Sep/2026:01:59:05 +0000] "GET /favicon.ico HTTP/1.1" 404 555 "http://localhost:8080/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36" "-"

kubectl delete pod nginx
↓
pod "nginx" deleted from default namespace

kubectl get pods
↓
No resources found in default namespace.

AZURE_WEBAPP_PUBLISH_PROFILE	
→.PublishSettingsの中身をまるごと貼り付け

AZURE_WEBAPP_NAME
→App Serviceの名前

name: Deploy to Azure App Service

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Deploy to Azure App Service
        uses: azure/webapps-deploy@v2
        with:
          app-name: ${{ secrets.AZURE_WEBAPP_NAME }}
          publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}
          package: .

CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
SHOW DATABASES;
EXIT;

項目値サービスアカウント名:main-operator
サービスアカウントID:自動入力でOK
説明:任意
権限：編集者
アクセス権を持つプリンシバル：未入力

sudo apt update && sudo apt upgrade -y

sudo apt install -y nginx
sudo systemctl start nginx
sudo systemctl enable nginx

sudo apt install -y php php-fpm php-mysql php-gd php-xml php-mbstring php-json php-curl
sudo systemctl start php-fpm
sudo systemctl enable php-fpm

sudo apt install -y mariadb-server
sudo systemctl start mariadb
sudo systemctl enable mariadb
sudo mysql_secure_installation

php -v
sudo systemctl list-units | grep php

sudo systemctl start php8.4-fpm
sudo systemctl enable php8.4-fpm

/usr/bin/mariadb-secure-installation

NOTE: MariaDB is secure by default in Debian. Running this script is
      useless at best, and misleading at worst. This script will be
      removed in a future MariaDB release in Debian. Please read
      /usr/share/doc/mariadb-server/README.Debian.gz for details.

Enter root user password or leave blank:

Enter current password for root (enter for none): 
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] 
Enabled successfully (or at least no errors was emitted)!
Reloading privilege tables..
 ... Success!


You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] 
New password: <パスワードを入力>
Re-enter new password: <パスワードを入力>
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] 
SQL executed without errors!
The operation might have been successful, or it might have not done anything.

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] 
SQL executed without errors!
The operation might have been successful, or it might have not done anything.

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] 
 - Dropping test database...
SQL executed without errors!
The operation might have been successful, or it might have not done anything.
 - Removing privileges on test database...
SQL executed without errors!
The operation might have been successful, or it might have not done anything.

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] 
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

sudo mariadb -u root -p

CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'パスワード';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

cd /tmp
wget https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gz
sudo mv wordpress /var/www/html/
sudo chown -R www-data:www-data /var/www/html/wordpress

sudo vi /etc/nginx/sites-available/wordpress

server {
    listen 80;
    server_name _;

    root /var/www/html/wordpress;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }
}

sudo ln -s /etc/nginx/sites-available/wordpress /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default

sudo nginx -t
sudo systemctl reload nginx

steps:
  # zipに圧縮してアップロード
  - name: "gcr.io/cloud-builders/gsutil"
    entrypoint: "bash"
    args:
      - "-c"
      - |
        zip -r wordpress.zip . -x "*.git*"
        gsutil cp wordpress.zip gs://<後に設定するCloud Storageバケット名>/wordpress.zip

  # VMにSSHしてzipを取得・展開
  - name: "gcr.io/google.com/cloudsdktool/cloud-sdk"
    entrypoint: "bash"
    args:
      - "-c"
      - |
        gcloud compute ssh <プロジェクトID>-compute@wordpress-vm \
          --zone=us-central1-a \
          --command="gsutil cp gs://<後に設定するCloud Storageバケット名>/wordpress.zip /tmp/ && sudo unzip -o /tmp/wordpress.zip -d /var/www/html/wordpress && sudo chown -R www-data:www-data /var/www/html/wordpress && sudo systemctl reload nginx php8.4-fpm"

options:
  logging: CLOUD_LOGGING_ONLY

AWSコンソール
  → 右上のアカウント名クリック
  → 「請求とコスト管理」
  → 左メニュー「請求設定」
  → 「アラート設定」「AWS 無料利用枠アラート」にチェック
  → 保存

AWSコンソール
　→ https://us-east-1.console.aws.amazon.com/cloudwatch/home?region=us-east-1#home:
　→ 左メニュー「アラーム」
　→ 右上「アラーム作成」
　→ メトリクスの選択で「EstimatedCharges」を選択してメトリクスを追加
　→ 条件を「静的」「しきい値以上」「3(ドル)」で次へ
　→ アラーム状態トリガー「アラーム状態」、通知の送信先:BillingCharges
　→ 名前をつける
　→ アラームの作成を押して終了

cd Project/AWS
ssh -i PersonalLern.pem ec2-user@IPアドレス

sudo dnf update -y

sudo dnf install -y nginx
sudo systemctl start nginx
sudo systemctl enable nginx

sudo dnf install -y php php-fpm php-mysqlnd php-gd php-xml php-mbstring php-json
sudo systemctl start php-fpm
sudo systemctl enable php-fpm

sudo dnf install -y mariadb1011-server
sudo systemctl start mariadb
sudo systemctl enable mariadb
sudo mysql_secure_installation

[ec2-user@ip- ~]$ sudo mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] n
 ... skipping.

You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] n
 ... skipping.

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] Y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] Y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] Y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

sudo systemctl status nginx
sudo systemctl status php-fpm
sudo systemctl status mariadb

sudo mysql -u root -p

CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'パスワード';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

cd /tmp
wget https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gz
rm -f latest.tar.gz
sudo mv wordpress /var/www/html/
sudo chown -R nginx:nginx /var/www/html/wordpress

sudo vi /etc/nginx/conf.d/wordpress.conf

server {
    listen 80;
    server_name _;

    root /var/www/html/wordpress;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php-fpm/www.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }
}

基本設定の一部を無効化
sudo vi /etc/nginx/nginx.conf

serverブロックを削除

NginXリロード
sudo nginx -t
sudo systemctl reload nginx

cd /var/www/html/wordpress
sudo cp wp-config-sample.php wp-config.php
sudo vi wp-config.php

開いたファイルの以下を修正
define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'wpuser' );
define( 'DB_PASSWORD', '設定したパスワード' );

sudo dnf install -y ruby wget

以下は北米(バージニア北部)の例なので、別リージョンならus-east-1の部分を変更してください
cd /home/ec2-user
wget https://aws-codedeploy-us-east-1.s3.us-east-1.amazonaws.com/latest/install

chmod +x ./install
sudo ./install auto

インストール確認
sudo systemctl status codedeploy-agent

name: Deploy to EC2 via CodeDeploy

on:
  push:
    branches:
      - main

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Zip and upload to S3
        run: |
          zip -r deploy.zip . -x "*.git*"
          aws s3 cp deploy.zip s3://${{ secrets.S3_BUCKET }}/deploy.zip

      - name: Deploy via CodeDeploy
        run: |
          aws deploy create-deployment \
            --application-name wordpress-app \
            --deployment-group-name wordpress-deploy-group \
            --s3-location bucket=${{ secrets.S3_BUCKET }},key=deploy.zip,bundleType=zip \
            --region ${{ secrets.AWS_REGION }}

#!/bin/bash
systemctl restart php-fpm
systemctl restart nginx

# WordPress - ignore core, configuration, examples, uploads and logs.
# https://github.com/github/gitignore/blob/main/WordPress.gitignore

# Core
#
# Note: if you want to stage/commit WP core files
# you can delete this whole section/until Configuration.
/wp-admin/
/wp-content/index.php
/wp-content/languages
/wp-content/plugins/index.php
/wp-content/themes/index.php
/wp-includes/
/index.php
/license.txt
/readme.html
/wp-*.php
/xmlrpc.php

# Configuration
wp-config.php

# Example themes
/wp-content/themes/twenty*/

# Example plugin
/wp-content/plugins/hello.php

# Uploads
/wp-content/uploads/

# Log files
*.log

# htaccess
/.htaccess

# All plugins
#
# Note: If you wish to whitelist plugins,
# uncomment the next line
#/wp-content/plugins

# All themes
#
# Note: If you wish to whitelist themes,
# uncomment the next line
#/wp-content/themes

version: 0.0
os: linux
files:
  - source: /
    destination: /var/www/html/wordpress
file_exists_behavior: OVERWRITE

permissions:
  - object: /var/www/html/wordpress
    pattern: "**"
    owner: nginx
    group: nginx

hooks:
  AfterInstall:
    - location: scripts/after_install.sh
      timeout: 300
      runas: root

タイプ:TXT
ホスト:_dmarc.example.com
値:v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com