fastly: use shielding POPs that match backend location
We were previously always shielding via the Virginia POP which is closest to us-east-1. However the S3 buckets for releases.nixos.org and tarballs.nixos.org are hosted in eu-west-1 (Dublin). Let's save on some transatlantic roundtrips, and maybe even improve #212.
Pierre Bourdon committed
Apr 10, 2024 at 15:14 UTC
07282134506f8882054d769999e564f415f453ee
5 files changed
+4
-6
terraform/cache.tf
+1
-1
@@ -122,7 +122,7 @@ resource "fastly_service_vcl" "cache" {
122
name = "s3.amazonaws.com"
123
override_host = aws_s3_bucket.cache.bucket_domain_name
124
port = 443
125
- shield = local.fastly_shield
125
+ shield = "iad-va-us"
126
ssl_cert_hostname = "s3.amazonaws.com"
127
ssl_check_cert = true
128
use_ssl = true
terraform/channels.tf
+1
-1
@@ -100,7 +100,7 @@ resource "fastly_service_vcl" "channels" {
100
name = local.channels_backend
101
override_host = local.channels_backend
102
request_condition = "not-flake-registry"
103
- shield = local.fastly_shield
103
+ shield = "iad-va-us"
104
}
105
106
backend {
terraform/locals.tf
-2
@@ -4,8 +4,6 @@ locals {
4
# TLS v1.2, protocols HTTP/1.1 and HTTP/2
5
fastly_tls12_sni_configuration_id = "5PXBTa6c01Xoh54ylNwmVA"
6
7
- fastly_shield = "iad-va-us"
8
-
7
cache-iam = data.terraform_remote_state.terraform-iam.outputs.cache
8
fastlylogs = data.terraform_remote_state.terraform-iam.outputs.fastlylogs
9
terraform/nixpkgs-tarballs.tf
+1
-1
@@ -164,7 +164,7 @@ resource "fastly_service_vcl" "nixpkgs-tarballs" {
164
name = local.tarballs_backend
165
override_host = local.tarballs_backend
166
port = 80
167
- shield = local.fastly_shield
167
+ shield = "dub-dublin-ie"
168
use_ssl = false
169
weight = 100
170
}
terraform/releases.tf
+1
-1
@@ -102,7 +102,7 @@ resource "fastly_service_vcl" "releases" {
102
name = local.releases_backend
103
override_host = local.releases_backend
104
port = 443
105
- shield = local.fastly_shield
105
+ shield = "dub-dublin-ie"
106
ssl_cert_hostname = local.releases_backend
107
ssl_check_cert = true
108
use_ssl = true