Add fastly configuration for gh-releases.nixos.org
This new Fastly service redirects GitHub release URLs from a custom domain to the actual GitHub releases. For example: - gh-releases.nixos.org/releases/0.27.0/nix-installer-x86_64-linux redirects to: - github.com/NixOS/experimental-nix-installer/releases/download/0.27.0/nix-installer-x86_64-linux The service includes: - Fastly VCL configuration with redirect logic - HTTPS enforcement with HSTS headers - Logging to S3
Jörg Thalheim committed
Jun 5, 2025 at 12:57 UTC
11436f3fe692529a1737ae7401bbdc9f9581bcca
1 file changed
+97
terraform/gh-releases.tf
new
+97
@@ -0,0 +1,97 @@
1
+locals {
2
+ gh_releases_domain = "gh-releases.nixos.org"
3
+}
4
+
5
+resource "fastly_service_vcl" "gh_releases" {
6
+ name = local.gh_releases_domain
7
+ default_ttl = 3600
8
+
9
+ backend {
10
+ address = "github.com"
11
+ auto_loadbalance = false
12
+ between_bytes_timeout = 10000
13
+ connect_timeout = 1000
14
+ error_threshold = 0
15
+ first_byte_timeout = 15000
16
+ max_conn = 200
17
+ name = "github.com"
18
+ override_host = "github.com"
19
+ port = 443
20
+ ssl_cert_hostname = "github.com"
21
+ ssl_check_cert = true
22
+ use_ssl = true
23
+ weight = 100
24
+ }
25
+
26
+ request_setting {
27
+ name = "Redirect HTTP to HTTPS"
28
+ force_ssl = true
29
+ }
30
+
31
+ domain {
32
+ name = local.gh_releases_domain
33
+ }
34
+
35
+ # Main VCL snippet to handle the redirect logic
36
+ snippet {
37
+ content = <<-EOT
38
+ if (req.url ~ "^/nix/") {
39
+ set req.url = regsub(req.url.path, "^/nix/", "/NixOS/experimental-nix-installer/releases/download/");
40
+ } else if (req.url ~ "^/patchelf/") {
41
+ set req.url = regsub(req.url.path, "^/patchelf/", "/NixOS/patchelf/releases/download/");
42
+ } else {
43
+ error 600;
44
+ }
45
+ EOT
46
+ name = "GitHub releases redirect"
47
+ priority = 100
48
+ type = "recv"
49
+ }
50
+
51
+ # Handle 404 errors
52
+ snippet {
53
+ content = <<-EOT
54
+ if (obj.status == 600) {
55
+ set obj.status = 404;
56
+ set obj.http.Content-Type = "text/html";
57
+ synthetic {"<h1>Not Found</h1>"};
58
+ return(deliver);
59
+ }
60
+ EOT
61
+ name = "Handle 404 errors"
62
+ priority = 100
63
+ type = "error"
64
+ }
65
+
66
+ # Add HSTS header for security
67
+ header {
68
+ destination = "http.Strict-Transport-Security"
69
+ type = "response"
70
+ action = "set"
71
+ name = "Add HSTS"
72
+ source = "\"max-age=300\""
73
+ }
74
+
75
+ logging_s3 {
76
+ name = "${local.gh_releases_domain}-to-s3"
77
+ bucket_name = local.fastlylogs["bucket_name"]
78
+ compression_codec = "zstd"
79
+ domain = local.fastlylogs["s3_domain"]
80
+ format = local.fastlylogs["format"]
81
+ format_version = 2
82
+ path = "${local.gh_releases_domain}/"
83
+ period = local.fastlylogs["period"]
84
+ message_type = "blank"
85
+ s3_iam_role = local.fastlylogs["iam_role_arn"]
86
+ }
87
+}
88
+
89
+resource "fastly_tls_subscription" "gh_releases" {
90
+ domains = [for domain in fastly_service_vcl.gh_releases.domain : domain.name]
91
+ configuration_id = local.fastly_tls12_sni_configuration_id
92
+ certificate_authority = "lets-encrypt"
93
+}
94
+
95
+output "gh-releases-managed_dns_challenge" {
96
+ value = fastly_tls_subscription.gh_releases.managed_dns_challenge
97
+}
\ No newline at end of file