Update nixpkgs-tarballs cloudfront distribution
Eelco Dolstra committed
Jul 19, 2018 at 16:29 UTC
0ce423411287d93659a97310edcc267571d7f3b7
2 files changed
+54
-21
terraform/nixpkgs-tarballs.tf
+49
-21
@@ -1,36 +1,36 @@
1
-/*
2
-resource "aws_s3_bucket" "nixpkgs-tarballs" {
3
- bucket = "nixpkgs-tarballs"
4
- region = "eu-west-1"
5
- acl = "public-read"
6
-
7
- website {
8
- index_document = "index.html"
9
- }
10
-}
11
-*/
12
-
13
-locals {
14
- nixpkgs-tarballs_website_domain = "nixpkgs-tarballs.s3-website-eu-west-1.amazonaws.com" # "${aws_s3_bucket.nixpkgs-tarballs.website_domain}"
15
- nixpkgs-tarballs_name = "nixpkgs-tarballs" # "#{aws_s3_bucket.nixpkgs-tarballs.name}"
16
-}
17
-
1
resource "aws_cloudfront_distribution" "nixpkgs-tarballs" {
2
enabled = true
3
is_ipv6_enabled = true
21
- default_root_object = "index.html"
4
price_class = "PriceClass_All"
5
aliases = ["tarballs.nixos.org"]
6
7
+ # Urgh, can't use an S3 origin because it's configured as a website
8
+ # (to serve HTTP redirects).
9
+ /*
10
+ origin {
11
+ origin_id = "default"
12
+ domain_name = "nixpkgs-tarballs.s3-eu-west-1.amazonaws.com"
13
+ s3_origin_config {
14
+ origin_access_identity = "${aws_cloudfront_origin_access_identity.nixpkgs-tarballs-identity.cloudfront_access_identity_path}"
15
+ }
16
+ }
17
+ */
18
+
19
origin {
26
- domain_name = "${local.nixpkgs-tarballs_website_domain}"
27
- origin_id = "${local.nixpkgs-tarballs_name}"
20
+ origin_id = "default"
21
+ domain_name = "nixpkgs-tarballs.s3-website-eu-west-1.amazonaws.com"
22
+ custom_origin_config {
23
+ http_port = 80
24
+ https_port = 443
25
+ origin_protocol_policy = "http-only"
26
+ origin_ssl_protocols = ["TLSv1.2"]
27
+ }
28
}
29
30
default_cache_behavior {
31
allowed_methods = ["HEAD", "GET"]
32
cached_methods = ["HEAD", "GET"]
33
- target_origin_id = "${local.nixpkgs-tarballs_name}"
33
+ target_origin_id = "default"
34
viewer_protocol_policy = "allow-all"
35
min_ttl = 0
36
default_ttl = 86400
@@ -47,5 +47,33 @@ resource "aws_cloudfront_distribution" "nixpkgs-tarballs" {
47
48
viewer_certificate {
49
cloudfront_default_certificate = true
50
+ acm_certificate_arn = "${aws_acm_certificate.nixpkgs-tarballs.arn}"
51
+ ssl_support_method = "sni-only"
52
}
53
+
54
+ restrictions {
55
+ geo_restriction {
56
+ restriction_type = "none"
57
+ }
58
+ }
59
+
60
+ logging_config {
61
+ bucket = "nix-cache-logs.s3.amazonaws.com"
62
+ }
63
+}
64
+
65
+resource "aws_acm_certificate" "nixpkgs-tarballs" {
66
+ provider = "aws.us"
67
+ domain_name = "tarballs.nixos.org"
68
+ validation_method = "DNS"
69
+
70
+ lifecycle {
71
+ create_before_destroy = true
72
+ }
73
+}
74
+
75
+/*
76
+resource "aws_cloudfront_origin_access_identity" "nixpkgs-tarballs" {
77
+ comment = "Cloudfront identity for nixpkgs-tarballs"
78
}
79
+*/
\ No newline at end of file
terraform/providers.tf
+5
@@ -1,3 +1,8 @@
1
provider "aws" {
2
+ region = "eu-west-1"
3
+}
4
+
5
+provider "aws" {
6
+ alias = "us"
7
region = "us-east-1"
8
}