terraform: import the cache.nixos.org fastly backend
zimbatm committed
Aug 28, 2021 at 21:12 UTC
ee995c5f3fee6d645a4a8fb9a93c57f3763b9f07
1 file changed
+87
terraform/cache.tf
+87
@@ -139,6 +139,7 @@ resource "aws_cloudfront_distribution" "cache" {
139
default_root_object = "index.html"
140
}
141
142
+# TODO: this is not needed anymore because Fastly is generating their own cert
143
resource "aws_acm_certificate" "cache" {
144
provider = aws.us
145
domain_name = "cache.nixos.org"
@@ -148,3 +149,89 @@ resource "aws_acm_certificate" "cache" {
149
create_before_destroy = true
150
}
151
}
152
+
153
+locals {
154
+ cache_domain = "cache.nixos.org"
155
+}
156
+
157
+resource "fastly_service_v1" "cache" {
158
+ name = local.cache_domain
159
+ default_ttl = 86400
160
+
161
+ backend {
162
+ address = "s3.amazonaws.com"
163
+ auto_loadbalance = false
164
+ between_bytes_timeout = 10000
165
+ connect_timeout = 5000
166
+ error_threshold = 0
167
+ first_byte_timeout = 15000
168
+ max_conn = 200
169
+ name = "s3.amazonaws.com"
170
+ override_host = aws_s3_bucket.cache.bucket_domain_name
171
+ port = 443
172
+ shield = "bwi-va-us"
173
+ ssl_cert_hostname = "s3.amazonaws.com"
174
+ ssl_check_cert = true
175
+ use_ssl = true
176
+ weight = 100
177
+ }
178
+
179
+ condition {
180
+ name = "Generated by synthetic response for 404 page"
181
+ priority = 0
182
+ statement = "beresp.status == 404"
183
+ type = "CACHE"
184
+ }
185
+
186
+ condition {
187
+ name = "Match /"
188
+ priority = 10
189
+ statement = "req.url ~ \"^/$\""
190
+ type = "REQUEST"
191
+ }
192
+
193
+ domain {
194
+ name = "cache.nixos.org"
195
+ }
196
+
197
+ header {
198
+ action = "set"
199
+ destination = "url"
200
+ ignore_if_set = false
201
+ name = "Landing page"
202
+ priority = 10
203
+ request_condition = "Match /"
204
+ source = "\"/index.html\""
205
+ type = "request"
206
+ }
207
+
208
+ papertrail {
209
+ address = "logs7.papertrailapp.com"
210
+ format = "%h %l %u %t \"%r\" %>s %b %%{if(resp.status == 503, cstr_escape(resp.response), \"\")}V - %%{resp.http.X-Served-By}V"
211
+ name = "cache.nixos.org"
212
+ port = 36051
213
+ }
214
+
215
+ response_object {
216
+ cache_condition = "Generated by synthetic response for 404 page"
217
+ content = "404"
218
+ content_type = "text/html"
219
+ name = "Generated by synthetic response for 404 page"
220
+ response = "Not Found"
221
+ status = 404
222
+ }
223
+
224
+ snippet {
225
+ content = <<-EOT
226
+ if (beresp.status == 403) {
227
+ set beresp.status = 404;
228
+ set beresp.ttl = 86400s;
229
+ set beresp.grace = 0s;
230
+ set beresp.cacheable = true;
231
+ }
232
+ EOT
233
+ name = "Change 403 from S3 to 404"
234
+ priority = 100
235
+ type = "fetch"
236
+ }
237
+}