B システム設計/インフラ — 決済連携サービス マルチリージョンDR（Cloud Runリージョン複製 × Cloud SQLクロスリージョンリードレプリカ+昇格手順 × Cloud DNSフェイルオーバールーティング × 検知/通知自動化+DB昇格は人間承認 × RPO/RTO明文化+DRドリル × Terraformリージョンmodule化 × Secret Manager自動レプリケーション）（MOps payment-gateway-relay Bad→Good）

📋 コピー# ── modules/regional-service/variables.tf ──────────────────
variable "region" {
  description = "デプロイ先リージョン（例: asia-northeast1, asia-northeast2）"
  type        = string
}
variable "project_id" { type = string }
variable "is_primary" {
  description = "true: Cloud SQLのプライマリインスタンスを持つリージョンか"
  type        = bool
}

# ── modules/regional-service/main.tf ────────────────────────
# 修正①⑥: リージョンをmodule変数化し、東京・大阪を同一コードから展開
resource "google_cloud_run_v2_service" "payment_relay" {
  project  = var.project_id
  name     = "payment-gateway-relay"
  location = var.region
  template {
    containers {
      image = "asia-northeast1-docker.pkg.dev/${var.project_id}/mops/payment-gateway-relay:latest"
    }
  }
}

# ── ルート main.tf ───────────────────────────────────────────
module "payment_relay_primary" {
  source     = "./modules/regional-service"
  project_id = var.project_id
  region     = "asia-northeast1"
  is_primary = true
}
module "payment_relay_secondary" {
  source     = "./modules/regional-service"
  project_id = var.project_id
  region     = "asia-northeast2"
  is_primary = false
}

# ── Cloud SQL: プライマリ + クロスリージョンリードレプリカ（修正②）
resource "google_sql_database_instance" "primary" {
  project           = var.project_id
  name              = "payment-relay-db-primary"
  region            = "asia-northeast1"
  database_version  = "POSTGRES_16"
  settings {
    tier              = "db-custom-4-16384"
    availability_type = "REGIONAL"
    backup_configuration {
      enabled                        = true
      point_in_time_recovery_enabled = true
    }
  }
  deletion_protection = true
}

resource "google_sql_database_instance" "replica_osaka" {
  project              = var.project_id
  name                 = "payment-relay-db-replica-osaka"
  region               = "asia-northeast2"
  database_version     = "POSTGRES_16"
  master_instance_name = google_sql_database_instance.primary.name
  replica_configuration {
    failover_target = false   # 手動承認による昇格運用（修正④と対応）
  }
  settings { tier = "db-custom-4-16384" }
}

# 修正②: レプリケーション遅延の可視化（RPO判断の根拠データ）
resource "google_monitoring_alert_policy" "replica_lag" {
  project      = var.project_id
  display_name = "payment-relay-db 大阪レプリカ遅延超過"
  combiner     = "OR"
  conditions {
    display_name = "replication_lag > 300秒（RPO 5分を超過）"
    condition_threshold {
      filter          = "resource.type=\"cloudsql_database\" AND metric.type=\"cloudsql.googleapis.com/database/replication/replica_lag\""
      comparison      = "COMPARISON_GT"
      threshold_value = 300
      duration        = "60s"
    }
  }
  notification_channels = [var.pagerduty_notification_channel_id]
}

# ── Cloud DNS: ヘルスチェック連動フェイルオーバー（修正③）────────
resource "google_compute_health_check" "payment_relay_tokyo" {
  project             = var.project_id
  name                = "payment-relay-tokyo-health"
  check_interval_sec  = 10
  unhealthy_threshold = 3
  https_health_check {
    port         = 443
    request_path = "/healthz"
  }
}

resource "google_dns_record_set" "payment_relay" {
  project      = var.project_id
  managed_zone = var.dns_zone_name
  name         = "payment-relay.example.com."
  type         = "A"
  ttl          = 60   # 修正③: 86400秒 → 60秒
  routing_policy {
    primary_backup {
      trickle_ratio = 0.0
      primary {
        internal_load_balancers {
          load_balancer_type = "regionalL7ilb"
          ip_address          = module.payment_relay_primary.lb_ip
          port                = "443"
          ip_protocol         = "tcp"
          network_url         = var.network_self_link
          project              = var.project_id
          region               = "asia-northeast1"
        }
      }
      backup_geo {
        location = "asia-northeast2"
        rrdatas  = [module.payment_relay_secondary.lb_ip]
      }
    }
  }
}

# ── 検知〜通知の自動化（修正④: DB昇格は人間承認）──────────────
resource "google_monitoring_alert_policy" "tokyo_region_down" {
  project      = var.project_id
  display_name = "payment-relay 東京リージョン ヘルスチェック失敗"
  combiner     = "OR"
  conditions {
    display_name = "healthz 3回連続失敗"
    condition_threshold {
      filter          = "resource.type=\"uptime_url\" AND resource.labels.host=\"payment-relay.example.com\""
      comparison      = "COMPARISON_GT"
      threshold_value = 1
      duration        = "30s"
    }
  }
  notification_channels = [
    var.pagerduty_notification_channel_id,
    google_monitoring_notification_channel.dr_runbook_trigger.id,
  ]
}

resource "google_monitoring_notification_channel" "dr_runbook_trigger" {
  project      = var.project_id
  type         = "pubsub"
  display_name = "DR runbook trigger"
  labels       = { topic = google_pubsub_topic.dr_failover_trigger.id }
}

resource "google_pubsub_topic" "dr_failover_trigger" {
  project = var.project_id
  name    = "payment-relay-dr-failover-trigger"
}

# ── Secret Manager: 自動レプリケーション（修正⑦）───────────────
resource "google_secret_manager_secret" "payment_gateway_api_key" {
  project   = var.project_id
  secret_id = "payment-gateway-api-key"
  replication {
    auto {}   # user_managed(東京単一)から自動レプリケーションへ変更
  }
}