워드프레스와 containerd를 함께 쓰기 가성비 좋은 클라우드를 정리

root /var/www/html;
index index.php index.html;

client_max_body_size 64m;

location / {
try_files $uri $uri/ /index.php?$args;
}

location ~ \.php$ {
include fastcgi_params;
fastcgi_pass wp-wordpress:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}

sudo nerdctl run -d --name wp-mariadb --network wp-net \
-e MARIADB_ROOT_PASSWORD='RootPass123!' \
-e MARIADB_DATABASE='wordpress' \
-e MARIADB_USER='wpuser' \
-e MARIADB_PASSWORD='WpPass123!' \
-v /srv/wp/mariadb:/var/lib/mysql \
--restart unless-stopped mariadb:11.4

sudo nerdctl run -d --name wp-wordpress --network wp-net \
-e WORDPRESS_DB_HOST='wp-mariadb:3306' \
-e WORDPRESS_DB_NAME='wordpress' \
-e WORDPRESS_DB_USER='wpuser' \
-e WORDPRESS_DB_PASSWORD='WpPass123!' \
-v /srv/wp/wordpress:/var/www/html \
--restart unless-stopped wordpress:php8.3-fpm

location ^~ /.well-known/acme-challenge/ {
root /var/www/letsencrypt;
default_type "text/plain";
}

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

add_header Strict-Transport-Security "max-age=63072000" always;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;

root /var/www/html;
index index.php index.html;

client_max_body_size 64m;

location / {
try_files $uri $uri/ /index.php?$args;
}

location ~ \.php$ {
include fastcgi_params;
fastcgi_pass wp-wordpress:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}

[Service]
Restart=always
RestartSec=5
ExecStartPre=/usr/bin/nerdctl rm -f wp-mariadb
ExecStart=/usr/bin/nerdctl run --name wp-mariadb --network wp-net \
-e MARIADB_ROOT_PASSWORD=RootPass123! \
-e MARIADB_DATABASE=wordpress \
-e MARIADB_USER=wpuser \
-e MARIADB_PASSWORD=WpPass123! \
-v /srv/wp/mariadb:/var/lib/mysql \
mariadb:11.4
ExecStop=/usr/bin/nerdctl stop wp-mariadb
ExecStopPost=/usr/bin/nerdctl rm -f wp-mariadb

[Service]
Restart=always
RestartSec=5
ExecStartPre=/usr/bin/nerdctl rm -f wp-wordpress
ExecStart=/usr/bin/nerdctl run --name wp-wordpress --network wp-net \
-e WORDPRESS_DB_HOST=wp-mariadb:3306 \
-e WORDPRESS_DB_NAME=wordpress \
-e WORDPRESS_DB_USER=wpuser \
-e WORDPRESS_DB_PASSWORD=WpPass123! \
-v /srv/wp/wordpress:/var/www/html \
wordpress:php8.3-fpm
ExecStop=/usr/bin/nerdctl stop wp-wordpress
ExecStopPost=/usr/bin/nerdctl rm -f wp-wordpress

location ^~ /.well-known/acme-challenge/ {
root /var/www/letsencrypt;
default_type "text/plain";
}

location / {
return 301 https://$host$request_uri;
}
}

server {
listen 443 ssl http2;
server_name example.com www.example.com;

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

add_header Strict-Transport-Security "max-age=63072000" always;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;

root /var/www/html;
index index.php index.html;

client_max_body_size 64m;

location / {
try_files $uri $uri/ /index.php?$args;
}

location ~ \.php$ {
include fastcgi_params;
fastcgi_pass wp-wordpress:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}

[Service]
Restart=always
RestartSec=5
ExecStartPre=/usr/bin/nerdctl rm -f wp-nginx
ExecStart=/usr/bin/nerdctl run --name wp-nginx --network wp-net \
-p 80:80 -p 443:443 \
-v /etc/nginx/sites-available/wp.conf:/etc/nginx/conf.d/default.conf:ro \
-v /srv/wp/wordpress:/var/www/html \
-v /etc/letsencrypt:/etc/letsencrypt:ro \
-v /var/www/letsencrypt:/var/www/letsencrypt \
nginx:1.27
ExecStop=/usr/bin/nerdctl stop wp-nginx
ExecStopPost=/usr/bin/nerdctl rm -f wp-nginx

# WordPress
WORDPRESS_DB_HOST=wp-mariadb:3306
WORDPRESS_DB_NAME=wordpress
WORDPRESS_DB_USER=wpuser
WORDPRESS_DB_PASSWORD=WpPass123!

[Service]
Restart=always
RestartSec=5
ExecStartPre=/usr/bin/nerdctl rm -f wp-mariadb
ExecStart=/usr/bin/nerdctl run --name wp-mariadb --network wp-net \
--env-file /srv/wp/.env \
-v /srv/wp/mariadb:/var/lib/mysql \
mariadb:11.4
ExecStop=/usr/bin/nerdctl stop wp-mariadb
ExecStopPost=/usr/bin/nerdctl rm -f wp-mariadb

[Service]
Restart=always
RestartSec=5
ExecStartPre=/usr/bin/nerdctl rm -f wp-wordpress
ExecStart=/usr/bin/nerdctl run --name wp-wordpress --network wp-net \
--env-file /srv/wp/.env \
-v /srv/wp/wordpress:/var/www/html \
wordpress:php8.3-fpm
ExecStop=/usr/bin/nerdctl stop wp-wordpress
ExecStopPost=/usr/bin/nerdctl rm -f wp-wordpress

location ^~ /.well-known/acme-challenge/ {
root /var/www/letsencrypt;
default_type "text/plain";
}

location / {
return 301 https://$host$request_uri;
}
}

server {
listen 443 ssl http2;
server_name ${DOMAIN} www.${DOMAIN};

ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

add_header Strict-Transport-Security "max-age=63072000" always;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;

root /var/www/html;
index index.php index.html;

client_max_body_size 64m;

location / {
try_files $uri $uri/ /index.php?$args;
}

location ~ \.php$ {
include fastcgi_params;
fastcgi_pass wp-wordpress:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}

[Service]
Restart=always
RestartSec=5
ExecStartPre=/usr/bin/nerdctl rm -f wp-nginx
ExecStart=/usr/bin/nerdctl run --name wp-nginx --network wp-net \
-p 80:80 -p 443:443 \
-v /srv/wp/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro \
-v /srv/wp/wordpress:/var/www/html \
-v /etc/letsencrypt:/etc/letsencrypt:ro \
-v /var/www/letsencrypt:/var/www/letsencrypt \
--env-file /srv/wp/.env \
nginx:1.27
ExecStop=/usr/bin/nerdctl stop wp-nginx
ExecStopPost=/usr/bin/nerdctl rm -f wp-nginx

set -e

BACKUP_DIR="/srv/wp/backup"
DATE=$(date +%Y%m%d_%H%M%S)
WP_DIR="/srv/wp/wordpress"
DB_NAME="wordpress"
DB_USER="wpuser"
DB_PASS="WpPass123!"
DB_HOST="wp-mariadb"
LOG_FILE="/srv/wp/backup.log"

mkdir -p "$BACKUP_DIR"

# WordPress 파일 백업
echo "$(date): Starting WordPress backup..." >> "$LOG_FILE"
tar czf "$BACKUP_DIR/wp-files-$DATE.tar.gz" -C "$WP_DIR/.." wordpress >> "$LOG_FILE" 2>&1

# MariaDB 덤프 백업
echo "$(date): Starting DB backup..." >> "$LOG_FILE"
nerdctl exec wp-mariadb mysqldump -u "$DB_USER" -p"$DB_PASS" -h "$DB_HOST" "$DB_NAME" > "$BACKUP_DIR/wp-db-$DATE.sql" >> "$LOG_FILE" 2>&1

# 오래된 백업 삭제 (7일)
find "$BACKUP_DIR" -name "wp-*.tar.gz" -mtime +7 -delete
find "$BACKUP_DIR" -name "wp-*.sql" -mtime +7 -delete

# 2. systemd
sudo systemctl daemon-reload
sudo systemctl enable --now wp-mariadb wp-wordpress wp-nginx

# 3. HTTPS 발급
sudo certbot certonly --webroot -w /var/www/letsencrypt -d example.com -d www.example.com

# 4. 백업 테스트
sudo /srv/wp/backup.sh

[Service]
Restart=always
ExecStartPre=/usr/bin/nerdctl rm -f wp-node-exporter
ExecStart=/usr/bin/nerdctl run --name wp-node-exporter --network wp-net \
-p 9100:9100 \
prom/node-exporter:latest
ExecStop=/usr/bin/nerdctl stop wp-node-exporter

[Service]
Restart=always
ExecStartPre=/usr/bin/nerdctl rm -f wp-prometheus
ExecStart=/usr/bin/nerdctl run --name wp-prometheus --network wp-net \
-p 9090:9090 \
-v /srv/wp/monitoring:/etc/prometheus \
prom/prometheus:latest
ExecStop=/usr/bin/nerdctl stop wp-prometheus

[Service]
Restart=always
ExecStartPre=/usr/bin/nerdctl rm -f wp-grafana
ExecStart=/usr/bin/nerdctl run --name wp-grafana --network wp-net \
-p 3000:3000 \
-v /srv/wp/grafana:/var/lib/grafana \
grafana/grafana:latest
ExecStop=/usr/bin/nerdctl stop wp-grafana

# 연결 설정
max_connections = 100
wait_timeout = 300

# 테이블/쿼리 캐시
table_open_cache = 2000
query_cache_size = 64M
query_cache_type = 1

# 연결 최적화
worker_processes auto;
worker_connections 1024;

[Service]
Restart=always
ExecStartPre=/usr/bin/nerdctl rm -f wp-redis
ExecStart=/usr/bin/nerdctl run --name wp-redis --network wp-net \
-p 6379:6379 \
-v /srv/wp/redis:/data \
redis:7-alpine
ExecStop=/usr/bin/nerdctl stop wp-redis

# 2. systemd 추가
sudo systemctl daemon-reload
sudo systemctl enable --now wp-node-exporter wp-prometheus wp-grafana wp-redis

# 3. MariaDB 튜닝
sudo nerdctl cp /srv/wp/mariadb/my.cnf wp-mariadb:/etc/mysql/conf.d/
sudo nerdctl restart wp-mariadb

# 4. Nginx 재시작
sudo nerdctl restart wp-nginx

variables:
DOCKER_DRIVER: overlay2
DOCKER_TLS_CERTDIR: "/certs"

test:
stage: test
image: wordpress:php8.3-cli
services:
- mariadb:11.4
script:
- cp wp-config.php wp-config-test.php
- wp core install --url=http://localhost --title="Test" --admin_user=admin --admin_password=pass --admin_email=test@example.com
- wp theme activate twenty twenty-four
- wp plugin install --activate --path=/srv/wp-plugins/ your-plugin
- wp core verify-checksums
- wp doctor check --all
artifacts:
reports:
junit: phpunit.xml

build:
stage: build
image: docker:27
services:
- docker:dind
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
- docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
- docker tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA $CI_REGISTRY_IMAGE:latest
- docker push $CI_REGISTRY_IMAGE:latest
only:
- main
- develop

deploy-staging:
stage: deploy
image: alpine/k8s:1.30.0
script:
- apk add --no-cache kubectl
- echo "$KUBE_CONFIG_STAGING" | base64 -d > kubeconfig
- export KUBECONFIG=kubeconfig
- kubectl set image deployment/wp-app wp-app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n staging
- kubectl rollout status deployment/wp-app -n staging
environment:
name: staging
only:
- develop

# 테마/플러그인 추가
COPY ./wp-content/themes /var/www/html/wp-content/themes
COPY ./wp-content/plugins /var/www/html/wp-content/plugins

# Redis 캐시 활성화
RUN pecl install redis && docker-php-ext-enable redis

# Ingress 상태
kubectl get ingress