Movable Type と WordPress の DB 接続情報を AWS Secrets Manager で管理する 一時ファイルを作らず、systemd の起動ラッパーだけで DB パスワードを渡す

やりたいこと

• mt-config.cgi と wp-config.php に DB パスワードを書かない
• DB 接続情報を Git や AMI へ含めない
• EC2 インスタンスロールで Secrets Manager を読み取る
• 平文の接続情報をディスクへ書き出さない
• パッケージ更新の影響を受けにくい形で systemd を拡張する
• Movable Type と WordPress で同じ仕組みを使う

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadCmsDatabaseSecrets",
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      "Resource": [
        "arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:prod/movabletype/mysql-??????",
        "arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:prod/wordpress/mysql-??????"
      ]
    }
  ]
}

sudo dnf install -y jq

#!/usr/bin/env bash
set -euo pipefail

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

: "${APP_KIND:?APP_KIND is required}"
: "${AWS_REGION:?AWS_REGION is required}"
: "${DB_SECRET_ARN:?DB_SECRET_ARN is required}"

if (( $# == 0 )); then
  echo "Command is required" >&2
  exit 1
fi

secret_json="$(
  aws secretsmanager get-secret-value \
    --region "$AWS_REGION" \
    --secret-id "$DB_SECRET_ARN" \
    --query SecretString \
    --output text
)"

if ! printf '%s' "$secret_json" | jq -e '
  (.host | type == "string" and length > 0) and
  (.port | (type == "string" or type == "number") and (tostring | length > 0)) and
  (.user | type == "string" and length > 0) and
  (.password | type == "string" and length > 0) and
  (.dbname | type == "string" and length > 0)
' >/dev/null; then
  echo "Database secret has missing or invalid fields" >&2
  exit 1
fi

db_host="$(printf '%s' "$secret_json" | jq -r '.host')"
db_port="$(printf '%s' "$secret_json" | jq -r '.port')"
db_user="$(printf '%s' "$secret_json" | jq -r '.user')"
db_password="$(printf '%s' "$secret_json" | jq -r '.password')"
db_name="$(printf '%s' "$secret_json" | jq -r '.dbname')"

case "$APP_KIND" in
  movabletype)
    export MT_CONFIG_DBHOST="$db_host"
    export MT_CONFIG_DBPORT="$db_port"
    export MT_CONFIG_DBUSER="$db_user"
    export MT_CONFIG_DBPASSWORD="$db_password"
    export MT_CONFIG_DATABASE="$db_name"
    ;;
  wordpress)
    export WP_DB_HOST="${db_host}:${db_port}"
    export WP_DB_USER="$db_user"
    export WP_DB_PASSWORD="$db_password"
    export WP_DB_NAME="$db_name"
    ;;
  *)
    echo "Unsupported APP_KIND: $APP_KIND" >&2
    exit 1
    ;;
esac

unset secret_json db_host db_port db_user db_password db_name
unset APP_KIND DB_SECRET_ARN AWS_REGION

exec "$@"

Movable Type へ環境変数を渡す

• MT_CONFIG_DATABASE
• MT_CONFIG_DBHOST
• MT_CONFIG_DBPORT
• MT_CONFIG_DBUSER
• MT_CONFIG_DBPASSWORD

mt-config.cgi にある Database、DBHost、DBPort、DBUser、DBPassword は削除します。

環境変数へ移したあともファイル側に値を残していると、どちらが使われているのか分かりにくくなるためです。

systemctl cat httpd

[Service]
Environment="APP_KIND=movabletype"
Environment="AWS_REGION=ap-northeast-1"
Environment="DB_SECRET_ARN=arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:prod/movabletype/mysql-XXXXXX"
ExecStart=
ExecStart=/usr/local/sbin/db-env-wrapper.sh /usr/sbin/httpd $OPTIONS -DFOREGROUND

PSGI で動かす場合

[Service]
Environment="APP_KIND=movabletype"
Environment="AWS_REGION=ap-northeast-1"
Environment="DB_SECRET_ARN=arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:prod/movabletype/mysql-XXXXXX"
ExecStart=
ExecStart=/usr/local/sbin/db-env-wrapper.sh /usr/local/bin/starman --workers=${WORKERS} --listen ${SOCKET} ${MT_HOME}/mt.psgi

WordPress へ環境変数を渡す

[Service]
Environment="APP_KIND=wordpress"
Environment="AWS_REGION=ap-northeast-1"
Environment="DB_SECRET_ARN=arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:prod/wordpress/mysql-XXXXXX"
ExecStart=
ExecStart=/usr/local/sbin/db-env-wrapper.sh /usr/sbin/php-fpm --nodaemonize

env[WP_DB_HOST] = $WP_DB_HOST
env[WP_DB_USER] = $WP_DB_USER
env[WP_DB_PASSWORD] = $WP_DB_PASSWORD
env[WP_DB_NAME] = $WP_DB_NAME

$wp_db_host = getenv( 'WP_DB_HOST' );
$wp_db_user = getenv( 'WP_DB_USER' );
$wp_db_password = getenv( 'WP_DB_PASSWORD' );
$wp_db_name = getenv( 'WP_DB_NAME' );

if (
	false === $wp_db_host || '' === $wp_db_host ||
	false === $wp_db_user || '' === $wp_db_user ||
	false === $wp_db_password || '' === $wp_db_password ||
	false === $wp_db_name || '' === $wp_db_name
) {
	throw new RuntimeException( 'WordPress database environment variables are not configured.' );
}

define( 'DB_HOST', $wp_db_host );
define( 'DB_USER', $wp_db_user );
define( 'DB_PASSWORD', $wp_db_password );
define( 'DB_NAME', $wp_db_name );

sudo php-fpm -t
sudo systemctl daemon-reload
sudo systemctl restart php-fpm

WP-CLI や Movable Type のツールから使う

sudo -u apache env \
  APP_KIND=wordpress \
  AWS_REGION=ap-northeast-1 \
  DB_SECRET_ARN=arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:prod/wordpress/mysql-XXXXXX \
  /usr/local/sbin/db-env-wrapper.sh \
  wp --path=/var/www/html db check

sudo -u movabletype env \
  APP_KIND=movabletype \
  AWS_REGION=ap-northeast-1 \
  DB_SECRET_ARN=arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:prod/movabletype/mysql-XXXXXX \
  /usr/local/sbin/db-env-wrapper.sh \
  /path/to/movabletype/tools/upgrade --name example

動作確認

sudo systemctl status httpd movabletype php-fpm
sudo journalctl -u httpd -u movabletype -u php-fpm --since "10 minutes ago"

シークレットを更新したときの動き

sudo systemctl restart httpd
sudo systemctl restart movabletype
sudo systemctl restart php-fpm

この構成で気をつけること

• set -x を有効にする
• 取得した JSON や環境変数をログへ出す
• デバッグ目的で env や ps eww の結果を保存する
• シークレットの実値を systemd の Environment= に書く
• シークレットの実値をコマンドライン引数で渡す

まとめ