terraform/nixpkgs-tarballs: use the website endpoint
As long as the S3 bucket has the website endpoint enabled. Once the migration is over, we will be able to switch of the S3 website and use the same config as cache.nixos.org.
zimbatm committed
Aug 30, 2021 at 10:51 UTC
c1bcc855dfc44e2b7b83d523acaa46de5048499f
1 file changed
+9
-7
terraform/nixpkgs-tarballs.tf
+9
-7
@@ -221,6 +221,10 @@ resource "aws_cloudfront_origin_access_identity" "nixpkgs-tarballs" {
221
222
locals {
223
tarballs_domain = "tarballs.nixos.org"
224
+ # Use the website endpoint because the bucket is configured with website
225
+ # enabled. This also means we can't use TLS between Fastly and AWS because
226
+ # the website endpoint only has port 80 open.
227
+ tarballs_backend = aws_s3_bucket.nixpkgs-tarballs.website_endpoint
228
}
229
230
resource "fastly_service_v1" "nixpkgs-tarballs" {
@@ -228,20 +232,18 @@ resource "fastly_service_v1" "nixpkgs-tarballs" {
232
default_ttl = 86400
233
234
backend {
231
- address = "s3.amazonaws.com"
235
+ address = local.tarballs_backend
236
auto_loadbalance = false
237
between_bytes_timeout = 10000
238
connect_timeout = 5000
239
error_threshold = 0
240
first_byte_timeout = 15000
241
max_conn = 200
238
- name = "s3.amazonaws.com"
239
- override_host = aws_s3_bucket.nixpkgs-tarballs.bucket_domain_name
240
- port = 443
242
+ name = local.tarballs_backend
243
+ override_host = local.tarballs_backend
244
+ port = 80
245
shield = "bwi-va-us"
242
- ssl_cert_hostname = "s3.amazonaws.com"
243
- ssl_check_cert = true
244
- use_ssl = true
246
+ use_ssl = false
247
weight = 100
248
}
249