tf: remove old CloudFront distributions
Cleanup after switching all the buckets to Fastly.
zimbatm committed
Sep 3, 2021 at 09:15 UTC
77923e56c351f3235488acd85477c08c31179e99
4 files changed
+13
-217
terraform/cache.tf
+4
-4
@@ -1,3 +1,7 @@
1
+locals {
2
+ cache_domain = "cache.nixos.org"
3
+}
4
+
5
resource "aws_s3_bucket" "cache" {
6
provider = aws.us
7
bucket = "nix-cache"
@@ -97,10 +101,6 @@ resource "aws_s3_bucket_policy" "cache" {
101
EOF
102
}
103
100
-locals {
101
- cache_domain = "cache.nixos.org"
102
-}
103
-
104
resource "fastly_service_v1" "cache" {
105
name = local.cache_domain
106
default_ttl = 86400
terraform/channels.tf
-63
@@ -89,69 +89,6 @@ resource "aws_s3_bucket_policy" "channels" {
89
EOF
90
}
91
92
-resource "aws_cloudfront_distribution" "channels" {
93
- enabled = true
94
- is_ipv6_enabled = true
95
- price_class = "PriceClass_All"
96
- aliases = ["channels.nixos.org"]
97
- default_root_object = "index.html"
98
-
99
- origin {
100
- origin_id = "default"
101
- domain_name = aws_s3_bucket.channels.website_endpoint
102
-
103
- custom_origin_config {
104
- http_port = "80"
105
- https_port = "443"
106
- origin_protocol_policy = "http-only"
107
- origin_ssl_protocols = ["TLSv1", "TLSv1.1", "TLSv1.2"]
108
- }
109
- }
110
-
111
- default_cache_behavior {
112
- viewer_protocol_policy = "redirect-to-https"
113
- compress = true
114
- allowed_methods = ["GET", "HEAD"]
115
- cached_methods = ["GET", "HEAD"]
116
- target_origin_id = "default"
117
- min_ttl = 0
118
- default_ttl = 60
119
- max_ttl = 86400
120
-
121
- forwarded_values {
122
- query_string = false
123
- cookies {
124
- forward = "none"
125
- }
126
- }
127
- }
128
-
129
- viewer_certificate {
130
- acm_certificate_arn = aws_acm_certificate.channels.arn
131
- ssl_support_method = "sni-only"
132
- }
133
-
134
- restrictions {
135
- geo_restriction {
136
- restriction_type = "none"
137
- }
138
- }
139
-
140
- logging_config {
141
- bucket = "nix-cache-logs.s3.amazonaws.com"
142
- }
143
-}
144
-
145
-resource "aws_acm_certificate" "channels" {
146
- provider = aws.us
147
- domain_name = "channels.nixos.org"
148
- validation_method = "DNS"
149
-
150
- lifecycle {
151
- create_before_destroy = true
152
- }
153
-}
154
-
92
resource "fastly_service_v1" "channels" {
93
name = local.channels_domain
94
default_ttl = 86400
terraform/nixpkgs-tarballs.tf
+9
-87
@@ -1,3 +1,11 @@
1
+locals {
2
+ tarballs_domain = "tarballs.nixos.org"
3
+ # Use the website endpoint because the bucket is configured with website
4
+ # enabled. This also means we can't use TLS between Fastly and AWS because
5
+ # the website endpoint only has port 80 open.
6
+ tarballs_backend = aws_s3_bucket.nixpkgs-tarballs.website_endpoint
7
+}
8
+
9
resource "aws_s3_bucket" "nixpkgs-tarballs" {
10
bucket = "nixpkgs-tarballs"
11
@@ -136,97 +144,11 @@ EOF
144
resource "aws_s3_bucket_object" "nixpkgs-tarballs-index" {
145
bucket = aws_s3_bucket.nixpkgs-tarballs.id
146
content_type = "text/html"
139
- etag = md5(file("${path.module}/nixpkgs-tarballs/index.html"))
147
+ etag = filemd5("${path.module}/nixpkgs-tarballs/index.html")
148
key = "index.html"
149
source = "${path.module}/nixpkgs-tarballs/index.html"
150
}
151
144
-resource "aws_cloudfront_distribution" "nixpkgs-tarballs" {
145
- enabled = true
146
- is_ipv6_enabled = true
147
- price_class = "PriceClass_All"
148
- aliases = ["tarballs.nixos.org"]
149
-
150
- # Urgh, can't use an S3 origin because it's configured as a website
151
- # (to serve HTTP redirects).
152
- /*
153
- origin {
154
- origin_id = "default"
155
- domain_name = "nixpkgs-tarballs.s3-eu-west-1.amazonaws.com"
156
- s3_origin_config {
157
- origin_access_identity = aws_cloudfront_origin_access_identity.nixpkgs-tarballs-identity.cloudfront_access_identity_path
158
- }
159
- }
160
- */
161
-
162
- origin {
163
- origin_id = "default"
164
- domain_name = "nixpkgs-tarballs.s3-website-eu-west-1.amazonaws.com"
165
-
166
- custom_origin_config {
167
- http_port = 80
168
- https_port = 443
169
- origin_protocol_policy = "http-only"
170
- origin_ssl_protocols = ["TLSv1.2"]
171
- }
172
- }
173
-
174
- default_cache_behavior {
175
- allowed_methods = ["HEAD", "GET"]
176
- cached_methods = ["HEAD", "GET"]
177
- target_origin_id = "default"
178
- viewer_protocol_policy = "allow-all"
179
- min_ttl = 0
180
- default_ttl = 86400
181
- max_ttl = 31536000
182
-
183
- forwarded_values {
184
- query_string = false
185
-
186
- cookies {
187
- forward = "none"
188
- }
189
- }
190
- }
191
- viewer_certificate {
192
- cloudfront_default_certificate = false
193
- acm_certificate_arn = aws_acm_certificate.nixpkgs-tarballs.arn
194
- ssl_support_method = "sni-only"
195
- }
196
- restrictions {
197
- geo_restriction {
198
- restriction_type = "none"
199
- }
200
- }
201
- logging_config {
202
- bucket = "nix-cache-logs.s3.amazonaws.com"
203
- }
204
-}
205
-
206
-resource "aws_acm_certificate" "nixpkgs-tarballs" {
207
- provider = aws.us
208
- domain_name = "tarballs.nixos.org"
209
- validation_method = "DNS"
210
-
211
- lifecycle {
212
- create_before_destroy = true
213
- }
214
-}
215
-
216
-/*
217
-resource "aws_cloudfront_origin_access_identity" "nixpkgs-tarballs" {
218
- comment = "Cloudfront identity for nixpkgs-tarballs"
219
-}
220
-*/
221
-
222
-locals {
223
- tarballs_domain = "tarballs.nixos.org"
224
- # Use the website endpoint because the bucket is configured with website
225
- # enabled. This also means we can't use TLS between Fastly and AWS because
226
- # the website endpoint only has port 80 open.
227
- tarballs_backend = aws_s3_bucket.nixpkgs-tarballs.website_endpoint
228
-}
229
-
152
resource "fastly_service_v1" "nixpkgs-tarballs" {
153
name = local.tarballs_domain
154
default_ttl = 86400
terraform/releases.tf
-63
@@ -78,69 +78,6 @@ resource "aws_s3_bucket_policy" "releases" {
78
EOF
79
}
80
81
-resource "aws_cloudfront_distribution" "releases" {
82
- enabled = true
83
- is_ipv6_enabled = true
84
- price_class = "PriceClass_All"
85
- aliases = [local.releases_domain]
86
- default_root_object = "index.html"
87
-
88
- origin {
89
- origin_id = "default"
90
- domain_name = aws_s3_bucket.releases.bucket_domain_name
91
-
92
- #s3_origin_config {
93
- # origin_access_identity = ""
94
-
95
- # #origin_access_identity = aws_cloudfront_origin_access_identity.releases.cloudfront_access_identity_path
96
- #}
97
- }
98
-
99
- default_cache_behavior {
100
- allowed_methods = ["HEAD", "GET"]
101
- cached_methods = ["HEAD", "GET"]
102
- target_origin_id = "default"
103
- viewer_protocol_policy = "allow-all"
104
- min_ttl = 0
105
- default_ttl = 86400
106
- max_ttl = 31536000
107
-
108
- forwarded_values {
109
- query_string = false
110
-
111
- cookies {
112
- forward = "none"
113
- }
114
- }
115
- }
116
-
117
- viewer_certificate {
118
- cloudfront_default_certificate = false
119
- acm_certificate_arn = aws_acm_certificate.releases.arn
120
- ssl_support_method = "sni-only"
121
- }
122
-
123
- restrictions {
124
- geo_restriction {
125
- restriction_type = "none"
126
- }
127
- }
128
-
129
- logging_config {
130
- bucket = "nix-cache-logs.s3.amazonaws.com"
131
- }
132
-}
133
-
134
-resource "aws_acm_certificate" "releases" {
135
- provider = aws.us
136
- domain_name = local.releases_domain
137
- validation_method = "DNS"
138
-
139
- lifecycle {
140
- create_before_destroy = true
141
- }
142
-}
143
-
81
resource "fastly_service_v1" "releases" {
82
name = local.releases_domain
83
default_ttl = 86400