1
2
3
4
5
6

# 既存KCMサーバー確認
ping -c 1 kcm.sample-project-dev.local
# → x.x.x.x (確認済み)

# VM詳細確認
gcloud compute instances describe kcm-server --zone=asia-northeast1-a --project=sample-project-dev

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

# KCM Test Instance
resource "google_compute_instance" "keeper_kcm_server" {
  project      = var.project
  name         = "keeper-kcm-server"
  machine_type = "e2-standard-4"
  zone         = "${var.region}-b"

  tags = ["kcm-test"]

  boot_disk {
    initialize_params {
      image = "ubuntu-os-cloud/ubuntu-2204-lts"
      size  = 50
      type  = "pd-balanced"
    }
  }

  network_interface {
    network            = "test-network"
    subnetwork         = "test-network-sub"
    subnetwork_project = var.project
    
    access_config {
      // Ephemeral public IP
    }
  }

  metadata = {
    startup-script = "echo 'KCM Instance Created: $(date)' > /var/log/startup.log"
  }

  labels = {
    purpose = "kcm-test"
    env     = "test"
  }
}

# Firewall for KCM
resource "google_compute_firewall" "keeper_kcm_test_http_https" {
  project = var.project
  name    = "allow-keeper-kcm-test-http-https"
  network = "test-network"

  allow {
    protocol = "tcp"
    ports    = ["80", "443", "8080", "8443"]
  }

  source_ranges = ["0.0.0.0/0"]
  target_tags   = ["kcm-test"]
}

output "keeper_kcm_server_ip" {
  value = google_compute_instance.keeper_kcm_server.network_interface[0].access_config[0].nat_ip
}

1
2
3

terraform init
terraform plan -target=google_compute_instance.keeper_kcm_server
terraform apply -target=google_compute_instance.keeper_kcm_server -auto-approve

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# 新規テスト環境への接続
gcloud compute ssh keeper-kcm-server --zone=asia-northeast1-b --project=sample-project-dev

# または既存環境への接続
gcloud compute ssh kcm-server --zone=asia-northeast1-a --project=sample-project-dev

# システム更新
sudo apt-get update && sudo apt-get upgrade -y

# 必要パッケージインストール
sudo apt-get install -y curl wget unzip jq htop net-tools

# Docker インストール
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

# ユーザー権限設定
sudo usermod -aG docker ubuntu

# Docker Compose インストール
sudo curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose

1
2
3
4
5
6
7
8
9

# 完全SSH再接続（重要：権限反映のため必須）
exit

# 再度SSH接続
gcloud compute ssh keeper-kcm-server --zone=asia-northeast1-b --project=sample-project-dev

# Docker動作確認
docker --version
docker run hello-world

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# KCMディレクトリ作成
sudo mkdir -p /opt/kcm
sudo chown ubuntu:ubuntu /opt/kcm
cd /opt/kcm

# kcm-setup.run取得（既存環境からコピー推奨）
# Option A: 既存サーバーから直接コピー
gcloud compute scp kcm-server:/opt/kcm/kcm-setup.run /tmp/ --zone=asia-northeast1-a --project=sample-project-dev
gcloud compute scp /tmp/kcm-setup.run keeper-kcm-server:/tmp/ --zone=asia-northeast1-b --project=sample-project-dev
sudo mv /tmp/kcm-setup.run /opt/kcm/
sudo chown ubuntu:ubuntu /opt/kcm/kcm-setup.run
sudo chmod +x /opt/kcm/kcm-setup.run

# Option B: 公式インストーラー実行（代替手段）
# curl -sSL https://keepersecurity.com/kcm/install | bash

1
2

cd /opt/kcm
sudo ./kcm-setup.run

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

Installation has completed successfully!

Access URL: https://kcm.sample-project-dev.local/
Administrator credentials:
    Username: guacadmin
    Password: [自動生成パスワード]

Docker containers:
- kcm-ssl-1 (nginx SSL termination)
- kcm-guacamole-1 (Apache Guacamole)
- kcm-db-1 (PostgreSQL)
- kcm-guacd-1 (Guacamole daemon)

1
2
3
4
5
6
7
8
9

# コンテナ状態確認
sudo docker ps

# 期待される出力:
# CONTAINER ID   IMAGE                           PORTS                    NAMES
# xxxxxxxxx     keeper/guacamole-ssl-nginx:2    0.0.0.0:80->80/tcp       kcm-ssl-1
# xxxxxxxxx     keeper/guacamole:2              8080/tcp                 kcm-guacamole-1
# xxxxxxxxx     keeper/guacamole-db-postgres:2  5432/tcp                 kcm-db-1
# xxxxxxxxx     keeper/guacd:2                  4822/tcp                 kcm-guacd-1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# ローカルアクセス確認
curl -I https://localhost -k

# 外部IPアクセス確認
EXTERNAL_IP=$(curl -s ifconfig.me)
curl -I https://$EXTERNAL_IP -k

# ドメインアクセス確認（DNSが設定されている場合）
curl -I https://kcm.sample-project-dev.local -k
curl -I https://keeper-kcm-server.sample-project-dev.local -k

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# DNS解決確認
nslookup kcm.sample-project-dev.local
# Server: xxx.xxx.xxx.xxx
# Address: xxx.xxx.xxx.xxx#53
# 
# Name: kcm.sample-project-dev.local
# Address: x.x.x.x

ping -c 1 kcm.sample-project-dev.local
# PING kcm.sample-project-dev.local (x.x.x.x)

1
2
3
4
5

# 証明書確認
openssl s_client -connect kcm.sample-project-dev.local:443 -servername kcm.sample-project-dev.local < /dev/null 2>/dev/null | openssl x509 -text -noout

# KCM SSL設定確認
curl -I https://kcm.sample-project-dev.local -k

1
2
3
4
5
6

# コンテナ状態確認
sudo docker ps

# アプリケーション確認
curl -I https://localhost -k
curl -I https://kcm.sample-project-dev.local -k

1
2
3
4
5

# 各コンテナのログ
sudo docker logs kcm-ssl-1
sudo docker logs kcm-guacamole-1
sudo docker logs kcm-db-1
sudo docker logs kcm-guacd-1

1
2
3

# KCMアップデート
cd /opt/kcm
sudo ./kcm-setup.run update

1
2

# KCM設定のバックアップ
sudo tar -czf /tmp/kcm-backup-$(date +%Y%m%d).tar.gz /opt/kcm

1
2

# PostgreSQLデータバックアップ
sudo docker exec kcm-db-1 pg_dumpall -U [username] > /tmp/kcm-db-backup-$(date +%Y%m%d).sql