# 冪等性の実例
初期状態: インスタンス0台
1回目実行: 3台作成 → 結果: 3台
2回目実行: 変更なし → 結果: 3台（変わらず）
3回目実行: 変更なし → 結果: 3台（変わらず）

# 設定変更時
設定変更: instance_type を t3.large に変更
4回目実行: 3台を更新 → 結果: 3台（t3.large）

# プルリクエストでのインフラ変更レビュー
レビュープロセス:
  1. 変更案の作成:
     - ブランチで変更を実装
     - terraform plan の結果を確認
     
  2. プルリクエスト:
     - 変更の意図を説明
     - 影響範囲を明記
     - コスト影響を記載
     
  3. レビュー:
     - セキュリティチェック
     - ベストプラクティス確認
     - コスト最適化の検討
     
  4. 承認と適用:
     - 複数人による承認
     - 自動テストの通過
     - 本番環境への適用

レベル1 - 手動運用:
  特徴:
    - GUI/CLIでの手動設定
    - ドキュメント化されていない
    - 再現性なし
  リスク:
    - ヒューマンエラー
    - 環境間の不整合
    - 障害復旧の遅延

レベル2 - スクリプト化:
  特徴:
    - シェルスクリプトでの部分自動化
    - 基本的なバージョン管理
    - 限定的な再現性
  改善点:
    - 手動作業の削減
    - 基本的な標準化

レベル3 - IaCツール導入:
  特徴:
    - Terraform/CloudFormation使用
    - コードレビュー実施
    - 環境別管理
  利点:
    - 宣言的管理
    - 状態管理
    - ドリフト検出

レベル4 - 完全自動化:
  特徴:
    - CI/CDパイプライン統合
    - 自動テスト実装
    - Policy as Code
  成果:
    - 継続的デリバリー
    - コンプライアンス自動化
    - セルフサービス化

レベル5 - GitOps:
  特徴:
    - Git as Single Source of Truth
    - Pull型デプロイメント
    - 継続的な同期
  最終形:
    - 完全な監査証跡
    - 自動ロールバック
    - 宣言的運用

# IaCと構成管理の責任分担
Infrastructure as Code (Terraform):
  - ネットワークの作成
  - サーバーのプロビジョニング
  - ロードバランサーの設定
  - データベースの作成
  - セキュリティグループの定義

Configuration Management (Ansible):
  - OSの設定とハードニング
  - ミドルウェアのインストール
  - アプリケーションのデプロイ
  - 設定ファイルの管理
  - ユーザーと権限の管理

---
# site.yml - マスターPlaybook
- name: Common configuration for all servers
  hosts: all
  become: yes
  roles:
    - common
    - security

- name: Configure web servers
  hosts: webservers
  become: yes
  roles:
    - nginx
    - app-deploy
  vars:
    app_version: "``{{ lookup('env', 'APP_VERSION') | default('latest', true) }}``"

- name: Configure database servers
  hosts: databases
  become: yes
  roles:
    - postgresql
    - backup

# group_vars/all.yml - 全ホスト共通変数
---
ntp_servers:
  - ntp.nict.jp
  - ntp.jst.mfeed.ad.jp

timezone: Asia/Tokyo

security_ssh_port: 22
security_ssh_password_authentication: "no"
security_ssh_permit_root_login: "no"

# group_vars/webservers.yml - Webサーバー用変数
---
nginx_worker_processes: "``{{ ansible_processor_vcpus }}``"
nginx_worker_connections: 2048

app_user: webapp
app_group: webapp
app_home: /var/www/app
app_port: 3000

# group_vars/production.yml - 本番環境用変数
---
nginx_server_tokens: "off"
nginx_ssl_protocols: "TLSv1.2 TLSv1.3"
nginx_ssl_ciphers: "HIGH:!aNULL:!MD5"

enable_monitoring: true
enable_log_shipping: true

# roles/nginx/tasks/main.yml
---
- name: Include OS-specific variables
  include_vars: "``{{ ansible_os_family }}``.yml"

- name: Install Nginx
  package:
    name: "``{{ nginx_package_name }}``"
    state: present
  notify: restart nginx

- name: Create Nginx directories
  file:
    path: "``{{ item }}``"
    state: directory
    owner: root
    group: root
    mode: '0755'
  loop:
    - /etc/nginx/sites-available
    - /etc/nginx/sites-enabled
    - /etc/nginx/ssl
    - /var/log/nginx

- name: Generate DH parameters
  openssl_dhparam:
    path: /etc/nginx/ssl/dhparams.pem
    size: 2048
  when: nginx_use_ssl | default(false)

- name: Configure Nginx
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
    owner: root
    group: root
    mode: '0644'
    validate: 'nginx -t -c %s'
  notify: reload nginx

- name: Configure virtual hosts
  template:
    src: vhost.conf.j2
    dest: "/etc/nginx/sites-available/``{{ item.name }}``"
    owner: root
    group: root
    mode: '0644'
  loop: "``{{ nginx_vhosts }}``"
  when: nginx_vhosts is defined
  notify: reload nginx

- name: Enable virtual hosts
  file:
    src: "/etc/nginx/sites-available/``{{ item.name }}``"
    dest: "/etc/nginx/sites-enabled/``{{ item.name }}``"
    state: link
  loop: "``{{ nginx_vhosts }}``"
  when: nginx_vhosts is defined
  notify: reload nginx

- name: Remove default site
  file:
    path: /etc/nginx/sites-enabled/default
    state: absent
  notify: reload nginx

- name: Ensure Nginx is running
  systemd:
    name: nginx
    state: started
    enabled: yes
    daemon_reload: yes

# roles/nginx/templates/nginx.conf.j2
user ``{{ nginx_user }}``;
worker_processes ``{{ nginx_worker_processes }}``;
pid /run/nginx.pid;

events {
    worker_connections ``{{ nginx_worker_connections }}``;
    multi_accept on;
    use epoll;
}

http {
    # 基本設定
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    server_tokens ``{{ nginx_server_tokens | default('on') }}``;
    
    # MIME types
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # SSL設定
    {% if nginx_use_ssl | default(false) %}
    ssl_protocols {{ nginx_ssl_protocols }};
    ssl_ciphers {{ nginx_ssl_ciphers }};
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_stapling on;
    ssl_stapling_verify on;
    {% endif %}
    
    # ログ設定
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;
    
    # Gzip圧縮
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml application/atom+xml image/svg+xml;
    
    # バーチャルホスト設定
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

# roles/nginx/handlers/main.yml
---
- name: restart nginx
  systemd:
    name: nginx
    state: restarted
  when: nginx_restart_on_change | default(true)

- name: reload nginx
  systemd:
    name: nginx
    state: reloaded
  when: nginx_reload_on_change | default(true)

- name: validate nginx configuration
  command: nginx -t
  changed_when: false

# 冪等性を保証する書き方の例
---
- name: 冪等性のあるタスク例
  hosts: all
  become: yes
  
  tasks:
    # GOOD: 冪等性あり - ファイルが既に存在すれば変更なし
    - name: Create application directory
      file:
        path: /opt/myapp
        state: directory
        owner: myapp
        group: myapp
        mode: '0755'
    
    # GOOD: 冪等性あり - 行が既に存在すれば追加しない
    - name: Add configuration line
      lineinfile:
        path: /etc/sysctl.conf
        line: 'vm.swappiness=10'
        state: present
    
    # GOOD: 冪等性あり - パッケージが既にインストール済みなら何もしない
    - name: Install required packages
      package:
        name:
          - git
          - python3-pip
          - nginx
        state: present
    
    # BAD: 冪等性なし - 実行するたびにファイルに追記される
    - name: Append to log file (非推奨)
      shell: echo "Deployment at $(date)" >> /var/log/deploy.log
    
    # GOOD: 上記の冪等性のある代替案
    - name: Record deployment
      copy:
        content: "Last deployment: ``{{ ansible_date_time.iso8601 }}``\n"
        dest: /var/log/last_deploy.log
        owner: root
        group: root
        mode: '0644'
    
    # 条件付き実行で冪等性を確保
    - name: Initialize database
      command: /opt/myapp/bin/init_db.sh
      args:
        creates: /opt/myapp/db/.initialized
      # .initializedファイルが存在する場合は実行しない
    
    # チェックモードでの動作確認
    - name: Configure service
      template:
        src: myapp.service.j2
        dest: /etc/systemd/system/myapp.service
      register: service_config
      check_mode: yes
      
    - name: Reload systemd if needed
      systemd:
        daemon_reload: yes
      when: service_config.changed

# Vault暗号化されたファイルの作成
# ansible-vault create vars/secrets.yml

# 平文の secrets.yml
---
database_password: "super-secret-password"
api_keys:
  stripe: "sk_live_..."
  aws_access_key: "AKIA..."
  aws_secret_key: "..."

# 暗号化後
$ANSIBLE_VAULT;1.1;AES256
39613836386435386...（暗号化されたデータ）

# Playbookでの使用
---
- name: Deploy application with secrets
  hosts: webservers
  vars_files:
    - vars/common.yml
    - vars/secrets.yml  # Vault暗号化されたファイル
  
  tasks:
    - name: Create database configuration
      template:
        src: database.yml.j2
        dest: "``{{ app_home }}``/config/database.yml"
        owner: "``{{ app_user }}``"
        group: "``{{ app_group }}``"
        mode: '0600'  # 機密情報のため厳格な権限
      no_log: true    # ログに機密情報を出力しない

# templates/database.yml.j2
production:
  adapter: postgresql
  encoding: unicode
  database: ``{{ database_name }}``
  pool: ``{{ database_pool | default(5) }}``
  username: ``{{ database_user }}``
  password: ``{{ database_password }}``  # Vaultから取得
  host: ``{{ database_host }}``
  port: ``{{ database_port | default(5432) }}``

# 実行時
# ansible-playbook -i inventory site.yml --ask-vault-pass
# または
# ansible-playbook -i inventory site.yml --vault-password-file ~/.vault_pass

パイプライン設計の原則:
  高速フィードバック:
    - 問題の早期発見
    - 10分以内の基本的なフィードバック
    - 段階的な詳細検証
    
  自動化の徹底:
    - 手動プロセスの排除
    - 一貫性の確保
    - ヒューマンエラーの防止
    
  段階的なリスク管理:
    - 環境を段階的に昇格
    - 各段階での検証強化
    - ロールバック可能性の確保
    
  監査証跡:
    - すべての変更の記録
    - 承認プロセスの可視化
    - コンプライアンス対応

# .github/workflows/infrastructure-pipeline.yml
name: Infrastructure CI/CD Pipeline

on:
  pull_request:
    branches: [main]
    paths:
      - 'terraform/**'
      - 'ansible/**'
  push:
    branches: [main]
    paths:
      - 'terraform/**'
      - 'ansible/**'

env:
  TF_VERSION: '1.5.0'
  ANSIBLE_VERSION: '2.15.0'
  AWS_REGION: 'ap-northeast-1'

jobs:
  # 1. 静的解析とlint
  static-analysis:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ``${{ env.TF_VERSION }}``
          
      - name: Terraform Format Check
        run: |
          cd terraform
          terraform fmt -check -recursive
          
      - name: Terraform Validate
        run: |
          cd terraform
          for dir in $(find . -type f -name "*.tf" -exec dirname {} \; | sort -u); do
            echo "Validating $dir"
            (cd "$dir" && terraform init -backend=false && terraform validate)
          done
          
      - name: TFLint
        uses: terraform-linters/setup-tflint@v3
        with:
          tflint_version: latest
          
      - name: Run TFLint
        run: |
          cd terraform
          tflint --init
          tflint --recursive
          
      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
          
      - name: Install Ansible and ansible-lint
        run: |
          pip install ansible=``${{ env.ANSIBLE_VERSION }}`` ansible-lint
          
      - name: Ansible Lint
        run: |
          cd ansible
          ansible-lint

  # 2. セキュリティスキャン
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Checkov Security Scan
        id: checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: terraform/
          framework: terraform
          output_format: sarif
          output_file_path: reports/checkov.sarif
          
      - name: Upload Checkov results
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: reports/checkov.sarif
          
      - name: Terrascan
        run: |
          wget https://github.com/tenable/terrascan/releases/latest/download/terrascan_Linux_x86_64.tar.gz
          tar -xf terrascan_Linux_x86_64.tar.gz
          ./terrascan scan -i terraform -d terraform/
          
      - name: Secrets Scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ``${{ github.event.repository.default_branch }}``
          head: HEAD

  # 3. コスト見積もり
  cost-estimation:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Infracost
        uses: infracost/setup-infracost@v2
        with:
          api-key: ``${{ secrets.INFRACOST_API_KEY }}``
          
      - name: Generate Infracost JSON
        run: |
          cd terraform/environments/prod
          infracost breakdown --path . \
            --format json \
            --out-file /tmp/infracost.json
            
      - name: Post Infracost comment
        uses: infracost/infracost-comment@v1
        with:
          path: /tmp/infracost.json
          behavior: update

  # 4. Terraformプラン（PR時）
  terraform-plan:
    needs: [static-analysis, security-scan]
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    strategy:
      matrix:
        environment: [dev, staging, prod]
    permissions:
      contents: read
      pull-requests: write
      id-token: write
      
    steps:
      - uses: actions/checkout@v4
      
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ``${{ secrets[format('AWS_{0}_ROLE', matrix.environment)] }}``
          aws-region: ``${{ env.AWS_REGION }}``
          
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ``${{ env.TF_VERSION }}``
          
      - name: Terraform Init
        run: |
          cd terraform/environments/``${{ matrix.environment }}``
          terraform init
          
      - name: Terraform Plan
        id: plan
        run: |
          cd terraform/environments/``${{ matrix.environment }}``
          terraform plan -out=tfplan -no-color | tee plan_output.txt
          
      - name: Create Plan Summary
        uses: actions/github-script@v6
        if: github.event_name == 'pull_request'
        with:
          script: |
            const output = `#### Terraform Plan - ``${{ matrix.environment }}`` 📋
            
            <details><summary>Show Plan</summary>
            
            \`\`\`terraform
            ${require('fs').readFileSync('terraform/environments/``${{ matrix.environment }}``/plan_output.txt', 'utf8')}
            \`\`\`
            
            </details>
            
            *Pushed by: @``${{ github.actor }}``, Action: \``${{ github.event_name }}``\`*`;
            
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })

  # 5. 統合テスト環境の構築
  integration-test:
    needs: terraform-plan
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4
      
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ``${{ secrets.AWS_TEST_ROLE }}``
          aws-region: ``${{ env.AWS_REGION }}``
          
      - name: Create Test Environment
        id: test-env
        run: |
          cd terraform/environments/test
          terraform init
          terraform apply -auto-approve \
            -var="pr_number=``${{ github.event.pull_request.number }}``"
          
          # 出力値を環境変数に設定
          echo "test_url=$(terraform output -raw test_environment_url)" >> $GITHUB_OUTPUT
          
      - name: Run Integration Tests
        run: |
          cd tests/integration
          npm install
          npm run test:integration -- \
            --url "``${{ steps.test-env.outputs.test_url }}``"
            
      - name: Run E2E Tests
        uses: cypress-io/github-action@v5
        with:
          config: baseUrl=``${{ steps.test-env.outputs.test_url }}``
          spec: tests/e2e/**/*.cy.js
          
      - name: Cleanup Test Environment
        if: always()
        run: |
          cd terraform/environments/test
          terraform destroy -auto-approve \
            -var="pr_number=``${{ github.event.pull_request.number }}``"

  # 6. プロダクションデプロイ
  deploy-infrastructure:
    needs: [static-analysis, security-scan, cost-estimation]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    strategy:
      matrix:
        environment: [dev, staging, prod]
      max-parallel: 1  # 環境を順番にデプロイ
    environment: ``${{ matrix.environment }}``
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ``${{ secrets[format('AWS_{0}_ROLE', matrix.environment)] }}``
          aws-region: ``${{ env.AWS_REGION }}``
          
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ``${{ env.TF_VERSION }}``
          
      - name: Terraform Apply
        run: |
          cd terraform/environments/``${{ matrix.environment }}``
          terraform init
          terraform apply -auto-approve
          
      - name: Run Smoke Tests
        run: |
          cd tests/smoke
          ./run_smoke_tests.sh ``${{ matrix.environment }}``
          
      - name: Update Documentation
        if: matrix.environment == 'prod'
        run: |
          cd terraform/environments/``${{ matrix.environment }}``
          terraform show -json > ../../../docs/infrastructure-state.json
          terraform graph | dot -Tpng > ../../../docs/infrastructure-diagram.png

  # 7. 構成管理の適用
  configure-servers:
    needs: deploy-infrastructure
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    strategy:
      matrix:
        environment: [dev, staging, prod]
      max-parallel: 1
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
          
      - name: Install Ansible
        run: |
          pip install ansible=``${{ env.ANSIBLE_VERSION }}``
          pip install boto3  # AWS動的インベントリ用
          
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ``${{ secrets[format('AWS_{0}_ROLE', matrix.environment)] }}``
          aws-region: ``${{ env.AWS_REGION }}``
          
      - name: Run Ansible Playbook
        env:
          ANSIBLE_HOST_KEY_CHECKING: False
          ANSIBLE_VAULT_PASSWORD: ``${{ secrets.ANSIBLE_VAULT_PASSWORD }}``
        run: |
          cd ansible
          
          # Vault パスワードファイルの作成
          echo "$ANSIBLE_VAULT_PASSWORD" > .vault_pass
          
          # 動的インベントリを使用してPlaybook実行
          ansible-playbook -i inventory/aws_ec2.yml \
            site.yml \
            --limit "``${{ matrix.environment }}``" \
            --vault-password-file .vault_pass
            
          # クリーンアップ
          rm -f .vault_pass

  # 8. 監視とアラートの設定
  setup-monitoring:
    needs: configure-servers
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Configure Datadog
        env:
          DD_API_KEY: ``${{ secrets.DATADOG_API_KEY }}``
          DD_APP_KEY: ``${{ secrets.DATADOG_APP_KEY }}``
        run: |
          cd monitoring/datadog
          ./setup_monitors.sh
          
      - name: Configure PagerDuty
        env:
          PAGERDUTY_TOKEN: ``${{ secrets.PAGERDUTY_TOKEN }}``
        run: |
          cd monitoring/pagerduty
          ./setup_escalation_policies.sh

# kubernetes/canary-deployment.yaml
apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  selector:
    app: myapp
  ports:
    - port: 80
      targetPort: 8080
---
# 安定版（90%のトラフィック）
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-stable
spec:
  replicas: 9
  selector:
    matchLabels:
      app: myapp
      version: stable
  template:
    metadata:
      labels:
        app: myapp
        version: stable
    spec:
      containers:
      - name: myapp
        image: myapp:v1.0.0
        ports:
        - containerPort: 8080
---
# カナリア版（10%のトラフィック）
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-canary
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
      version: canary
  template:
    metadata:
      labels:
        app: myapp
        version: canary
    spec:
      containers:
      - name: myapp
        image: myapp:v2.0.0
        ports:
        - containerPort: 8080

---
# 自動化されたカナリア分析
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: myapp
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  service:
    port: 80
  analysis:
    interval: 1m
    threshold: 10
    maxWeight: 50
    stepWeight: 5
    metrics:
    - name: request-success-rate
      thresholdRange:
        min: 99
      interval: 1m
    - name: request-duration
      thresholdRange:
        max: 500
      interval: 1m
    webhooks:
    - name: load-test
      url: http://loadtester/
      metadata:
        cmd: "hey -z 1m -c 10 -q 20 http://myapp/"

# argocd/application.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: infrastructure
  namespace: argocd
spec:
  project: default
  
  source:
    repoURL: https://github.com/myorg/infrastructure
    targetRevision: HEAD
    path: kubernetes/overlays/production
    
  destination:
    server: https://kubernetes.default.svc
    namespace: production
    
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
    - CreateNamespace=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m
        
  # Terraform連携
  initContainers:
  - name: terraform-apply
    image: hashicorp/terraform:1.5.0
    command:
    - sh
    - -c
    - |
      cd /terraform
      terraform init
      terraform apply -auto-approve
    volumeMounts:
    - name: terraform-config
      mountPath: /terraform
      
  # Post-sync hooks
  postSync:
  - name: smoke-tests
    container:
      image: postman/newman
      command: ["newman", "run", "smoke-tests.json"]
  - name: notify-slack
    container:
      image: curlimages/curl
      command: 
      - sh
      - -c
      - |
        curl -X POST $SLACK_WEBHOOK \
          -H 'Content-type: application/json' \
          -d '{"text":"Deployment completed successfully"}'