DigitalOceanでTerraformを実行する方法

curl -o ~/terraform.zip https://releases.hashicorp.com/terraform/1.7.2/terraform_1.7.2_darwin_amd64.zip

curl -o ~/terraform.zip https://releases.hashicorp.com/terraform/1.7.2/terraform_1.7.2_linux_amd64.zip

mkdir -p ~/opt/terraform

sudo apt install unzip

unzip ~/terraform.zip -d ~/opt/terraform

nano ~/.bashrc

export PATH=$PATH:~/opt/terraform

. ~/.bashrc

. .bash_profile

. .zshrc

terraform

OutputUsage: terraform [global options] <subcommand> [args]
The available commands for execution are listed below.
The primary workflow commands are given first, followed by
less common or more advanced commands.
Main commands:
init Prepare your working directory for other commands
validate Check whether the configuration is valid
plan Show changes required by the current configuration
apply Create or update infrastructure
destroy Destroy previously-created infrastructure
All other commands:
console Try Terraform expressions at an interactive command prompt
fmt Reformat your configuration in the standard style
force-unlock Release a stuck lock on the current workspace
get Install or upgrade remote Terraform modules
graph Generate a Graphviz graph of the steps in an operation
import Associate existing infrastructure with a Terraform resource
login Obtain and save credentials for a remote host
logout Remove locally-stored credentials for a remote host
output Show output values from your root module
providers Show the providers required for this configuration
refresh Update the state to match remote systems
show Show the current state or a saved plan
state Advanced state management
taint Mark a resource instance as not fully functional
test Experimental support for module integration testing
untaint Remove the 'tainted' state from a resource instance
version Show the current Terraform version
workspace Workspace management
Global options (use these before the subcommand, if any):
-chdir=DIR Switch to a different working directory before executing the
given subcommand.
-help Show this help output, or the help for a specified subcommand.
-version An alias for the "version" subcommand.

export DO_PAT="your_personal_access_token"

mkdir ~/loadbalance

cd ~/loadbalance

nano provider.tf

terraform {
required_providers {
digitalocean = {
source = "digitalocean/digitalocean"
version = "~> 2.0"
}
}
}

...
variable "do_token" {}
variable "pvt_key" {}

...
provider "digitalocean" {
token = var.do_token
}

...
data "digitalocean_ssh_key" "terraform" {
name = "terraform"
}

terraform {
required_providers {
digitalocean = {
source = "digitalocean/digitalocean"
version = "~> 2.0"
}
}
}
variable "do_token" {}
variable "pvt_key" {}
provider "digitalocean" {
token = var.do_token
}
data "digitalocean_ssh_key" "terraform" {
name = "terraform"
}

terraform init

OutputInitializing the backend...
Initializing provider plugins...
- Finding digitalocean/digitalocean versions matching "~> 2.0"...
- Installing digitalocean/digitalocean v2.34.1...
- Installed digitalocean/digitalocean v2.34.1 (signed by a HashiCorp partner, key ID F82037E524B9C0E8)
Partner and community providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://www.terraform.io/docs/cli/plugins/signing.html
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.
Terraform has been successfully initialized!
You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.
If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

nano www-1.tf

resource "digitalocean_droplet" "www-1" {
image = "ubuntu-20-04-x64"
name = "www-1"
region = "nyc3"
size = "s-1vcpu-1gb"
ssh_keys = [
data.digitalocean_ssh_key.terraform.id
]

...
connection {
host = self.ipv4_address
user = "root"
type = "ssh"
private_key = file(var.pvt_key)
timeout = "2m"
}

...
provisioner "remote-exec" {
inline = [
"export PATH=$PATH:/usr/bin",
# install nginx
"sudo apt update",
"sudo apt install -y nginx"
]
}
}

resource "digitalocean_droplet" "www-1" {
image = "ubuntu-20-04-x64"
name = "www-1"
region = "nyc3"
size = "s-1vcpu-1gb"
ssh_keys = [
data.digitalocean_ssh_key.terraform.id
]
connection {
host = self.ipv4_address
user = "root"
type = "ssh"
private_key = file(var.pvt_key)
timeout = "2m"
}
provisioner "remote-exec" {
inline = [
"export PATH=$PATH:/usr/bin",
# install nginx
"sudo apt update",
"sudo apt install -y nginx"
]
}
}

terraform plan \
-var "do_token=${DO_PAT}" \
-var "pvt_key=$HOME/.ssh/id_rsa"

OutputTerraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# digitalocean_droplet.www-1 will be created
+ resource "digitalocean_droplet" "www-1" {
+ backups = false
+ created_at = (known after apply)
+ disk = (known after apply)
+ graceful_shutdown = false
+ id = (known after apply)
+ image = "ubuntu-20-04-x64"
+ ipv4_address = (known after apply)
+ ipv4_address_private = (known after apply)
+ ipv6 = false
+ ipv6_address = (known after apply)
+ locked = (known after apply)
+ memory = (known after apply)
+ monitoring = false
+ name = "www-1"
+ price_hourly = (known after apply)
+ price_monthly = (known after apply)
+ private_networking = (known after apply)
+ region = "nyc3"
+ resize_disk = true
+ size = "s-1vcpu-1gb"
+ ssh_keys = [
+ "...",
]
+ status = (known after apply)
+ urn = (known after apply)
+ vcpus = (known after apply)
+ volume_ids = (known after apply)
+ vpc_uuid = (known after apply)
}
Plan: 1 to add, 0 to change, 0 to destroy.
───────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.

terraform apply \
-var "do_token=${DO_PAT}" \
-var "pvt_key=$HOME/.ssh/id_rsa"

Output...
Plan: 1 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes

Outputdigitalocean_droplet.www-1: Creating...

Output
digitalocean_droplet.www-1: Provisioning with 'remote-exec'...
....
digitalocean_droplet.www-1: Creation complete after 1m54s [id=your_www-1_droplet_id]
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
...

terraform show terraform.tfstate

Outputresource "digitalocean_droplet" "www-1" {
backups = false
created_at = "..."
disk = 25
id = "your_www-1_droplet_id"
image = "ubuntu-20-04-x64"
ipv4_address = "your_www-1_server_ip"
ipv4_address_private = "10.128.0.2"
...

sed 's/www-1/www-2/g' www-1.tf > www-2.tf

terraform plan \
-var "do_token=${DO_PAT}" \
-var "pvt_key=$HOME/.ssh/id_rsa"

OutputTerraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# digitalocean_droplet.www-2 will be created
+ resource "digitalocean_droplet" "www-2" {
+ backups = false
+ created_at = (known after apply)
+ disk = (known after apply)
+ id = (known after apply)
+ image = "ubuntu-20-04-x64"
+ ipv4_address = (known after apply)
+ ipv4_address_private = (known after apply)
+ ipv6 = false
+ ipv6_address = (known after apply)
+ locked = (known after apply)
+ memory = (known after apply)
+ monitoring = false
+ name = "www-2"
+ price_hourly = (known after apply)
+ price_monthly = (known after apply)
+ private_networking = true
+ region = "nyc3"
+ resize_disk = true
+ size = "s-1vcpu-1gb"
+ ssh_keys = [
+ "...",
]
+ status = (known after apply)
+ urn = (known after apply)
+ vcpus = (known after apply)
+ volume_ids = (known after apply)
+ vpc_uuid = (known after apply)
}
Plan: 1 to add, 0 to change, 0 to destroy.
...

terraform apply \
-var "do_token=${DO_PAT}" \
-var "pvt_key=$HOME/.ssh/id_rsa"

Outputdigitalocean_droplet.www-2: Creation complete after 1m47s [id=your_www-2_droplet_id]
...
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

nano loadbalancer.tf

resource "digitalocean_loadbalancer" "www-lb" {
name = "www-lb"
region = "nyc3"
forwarding_rule {
entry_port = 80
entry_protocol = "http"
target_port = 80
target_protocol = "http"
}
healthcheck {
port = 22
protocol = "tcp"
}
droplet_ids = [digitalocean_droplet.www-1.id, digitalocean_droplet.www-2.id ]
}

check "health_check" {
data "http" "lb_check" {
url = "http://${digitalocean_loadbalancer.www-lb.ip}"
}
assert {
condition = data.http.lb_check.status_code == 200
error_message = "${data.http.lb_check.url} returned an unhealthy status code"
}
}

terraform plan \
-var "do_token=${DO_PAT}" \
-var "pvt_key=$HOME/.ssh/id_rsa"

Output...
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create
<= read (data resources)
Terraform will perform the following actions:
# data.http.lb_check will be read during apply
# (config refers to values not yet known)
<= data "http" "lb_check" {
+ body = (known after apply)
+ id = (known after apply)
+ response_body = (known after apply)
+ response_body_base64 = (known after apply)
+ response_headers = (known after apply)
+ status_code = (known after apply)
+ url = (known after apply)
}
# digitalocean_loadbalancer.www-lb will be created
+ resource "digitalocean_loadbalancer" "www-lb" {
+ algorithm = "round_robin"
+ disable_lets_encrypt_dns_records = false
+ droplet_ids = [
+ ...,
+ ...,
]
+ enable_backend_keepalive = false
+ enable_proxy_protocol = false
+ http_idle_timeout_seconds = (known after apply)
+ id = (known after apply)
+ ip = (known after apply)
+ name = "www-lb"
+ project_id = (known after apply)
+ redirect_http_to_https = false
+ region = "nyc3"
+ size_unit = (known after apply)
+ status = (known after apply)
+ urn = (known after apply)
+ vpc_uuid = (known after apply)
+ forwarding_rule {
+ certificate_id = (known after apply)
+ certificate_name = (known after apply)
+ entry_port = 80
+ entry_protocol = "http"
+ target_port = 80
+ target_protocol = "http"
+ tls_passthrough = false
}
+ healthcheck {
+ check_interval_seconds = 10
+ healthy_threshold = 5
+ port = 22
+ protocol = "tcp"
+ response_timeout_seconds = 5
+ unhealthy_threshold = 3
}
}
Plan: 1 to add, 0 to change, 0 to destroy.
│ Warning: Check block assertion known after apply
│ on loadbalancer.tf line 27, in check "health_check":
│ 27: condition = data.http.lb_check.status_code == 200
│ ├────────────────
│ │ data.http.lb_check.status_code is a number
│
│ The condition could not be evaluated at this time, a result will be known when this plan is applied.
╵
...

terraform init -upgrade

terraform apply \
-var "do_token=${DO_PAT}" \
-var "pvt_key=$HOME/.ssh/id_rsa"

Output...
digitalocean_loadbalancer.www-lb: Creating...
...
digitalocean_loadbalancer.www-lb: Creation complete after 1m18s [id=your_load_balancer_id]
data.http.lb_check: Reading...
data.http.lb_check: Read complete after 0s [id=http://lb-ip]
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
...

terraform show terraform.tfstate

Output...
# digitalocean_loadbalancer.www-lb:
resource "digitalocean_loadbalancer" "www-lb" {
algorithm = "round_robin"
disable_lets_encrypt_dns_records = false
droplet_ids = [
your_www-1_droplet_id,
your_www-2_droplet_id,
]
enable_backend_keepalive = false
enable_proxy_protocol = false
id = "your_load_balancer_id"
ip = "your_load_balancer_ip"
name = "www-lb"
...

nano domain_root.tf

resource "digitalocean_domain" "default" {
name = "your_domain"
ip_address = digitalocean_loadbalancer.www-lb.ip
}

nano domain_cname.tf

resource "digitalocean_record" "CNAME-www" {
domain = digitalocean_domain.default.name
type = "CNAME"
name = "www"
value = "@"
}

terraform plan -destroy -out=terraform.tfplan \
-var "do_token=${DO_PAT}" \
-var "pvt_key=$HOME/.ssh/id_rsa"

terraform apply terraform.tfplan