fastly/gh-releases: follow github redirects
this gives us ipv6 support
Jörg Thalheim committed
Jun 5, 2025 at 14:41 UTC
1e6f63123f4b1cce19f35e27ff9faa4222a4ee62
1 file changed
+95
-7
terraform/gh-releases.tf
+95
-7
@@ -1,3 +1,29 @@
1
+# GitHub Releases Proxy Service
2
+#
3
+# This service provides IPv6-enabled access to GitHub releases through Fastly CDN.
4
+# It transparently follows GitHub's S3 redirects to provide direct file access.
5
+#
6
+# Supported URL patterns:
7
+# - /nix/* -> /NixOS/experimental-nix-installer/releases/download/*
8
+# - /patchelf/* -> /NixOS/patchelf/releases/download/*
9
+#
10
+# Testing commands:
11
+#
12
+# Basic functionality tests:
13
+# curl -I https://gh-releases.nixos.org/nix/0.27.0/nix-installer.sh
14
+# curl -s https://gh-releases.nixos.org/nix/0.27.0/nix-installer.sh | head -n 5
15
+#
16
+# IPv6 connectivity test:
17
+# curl -6 -I https://gh-releases.nixos.org/nix/0.27.0/nix-installer.sh
18
+#
19
+# Performance comparison (should show redirect following):
20
+# time curl -s https://gh-releases.nixos.org/nix/0.27.0/nix-installer-x86_64-linux > /dev/null
21
+# time curl -s https://github.com/NixOS/experimental-nix-installer/releases/download/0.27.0/nix-installer-x86_64-linux > /dev/null
22
+#
23
+# Error cases (should return 404):
24
+# curl -I https://gh-releases.nixos.org/invalid/path
25
+# curl -I https://gh-releases.nixos.org/patchelf/999.999.999/nonexistent-file
26
+
27
locals {
28
gh_releases_domain = "gh-releases.nixos.org"
29
}
@@ -21,8 +47,42 @@ resource "fastly_service_vcl" "gh_releases" {
47
ssl_check_cert = true
48
use_ssl = true
49
weight = 100
50
+ request_condition = "Use GitHub backend"
51
+ }
52
+
53
+ backend {
54
+ address = "objects.githubusercontent.com"
55
+ auto_loadbalance = false
56
+ between_bytes_timeout = 10000
57
+ connect_timeout = 1000
58
+ error_threshold = 0
59
+ first_byte_timeout = 15000
60
+ max_conn = 200
61
+ name = "objects_githubusercontent_com"
62
+ override_host = "objects.githubusercontent.com"
63
+ port = 443
64
+ ssl_cert_hostname = "objects.githubusercontent.com"
65
+ ssl_check_cert = true
66
+ use_ssl = true
67
+ weight = 100
68
+ request_condition = "Use Objects backend"
69
+ }
70
+
71
+ condition {
72
+ name = "Use GitHub backend"
73
+ priority = 10
74
+ statement = "!req.http.X-Use-Objects-Backend"
75
+ type = "REQUEST"
76
+ }
77
+
78
+ condition {
79
+ name = "Use Objects backend"
80
+ priority = 10
81
+ statement = "req.http.X-Use-Objects-Backend"
82
+ type = "REQUEST"
83
}
84
85
+
86
request_setting {
87
name = "Redirect HTTP to HTTPS"
88
force_ssl = true
@@ -35,12 +95,17 @@ resource "fastly_service_vcl" "gh_releases" {
95
# Main VCL snippet to handle the redirect logic
96
snippet {
97
content = <<-EOT
38
- if (req.url ~ "^/nix/") {
39
- set req.url = regsub(req.url.path, "^/nix/", "/NixOS/experimental-nix-installer/releases/download/");
40
- } else if (req.url ~ "^/patchelf/") {
41
- set req.url = regsub(req.url.path, "^/patchelf/", "/NixOS/patchelf/releases/download/");
42
- } else {
43
- error 600;
98
+ # Only rewrite if this is the first request (not a restart)
99
+ if (!req.http.X-Rewritten) {
100
+ if (req.url ~ "^/nix/") {
101
+ set req.url = regsub(req.url.path, "^/nix/", "/NixOS/experimental-nix-installer/releases/download/");
102
+ set req.http.X-Rewritten = "true";
103
+ } else if (req.url ~ "^/patchelf/") {
104
+ set req.url = regsub(req.url.path, "^/patchelf/", "/NixOS/patchelf/releases/download/");
105
+ set req.http.X-Rewritten = "true";
106
+ } else {
107
+ error 600;
108
+ }
109
}
110
EOT
111
name = "GitHub releases redirect"
@@ -48,6 +113,29 @@ resource "fastly_service_vcl" "gh_releases" {
113
type = "recv"
114
}
115
116
+ # Handle redirects from GitHub to S3
117
+ snippet {
118
+ content = <<-EOT
119
+ if (beresp.status == 302 && beresp.http.Location ~ "^https://objects\.githubusercontent\.com/") {
120
+ # Extract the full path including query parameters
121
+ set req.url = regsub(beresp.http.Location, "^https://objects\.githubusercontent\.com", "");
122
+ set req.http.X-Use-Objects-Backend = "true";
123
+ # Set correct host header for S3
124
+ set req.http.Host = "objects.githubusercontent.com";
125
+ # Clear GitHub-specific headers that might interfere
126
+ unset req.http.Authorization;
127
+ unset req.http.Cookie;
128
+ restart;
129
+ }
130
+ EOT
131
+ name = "Follow GitHub redirects"
132
+ priority = 100
133
+ type = "fetch"
134
+ }
135
+
136
+
137
+
138
+
139
# Handle 404 errors
140
snippet {
141
content = <<-EOT
@@ -94,4 +182,4 @@ resource "fastly_tls_subscription" "gh_releases" {
182
183
output "gh-releases-managed_dns_challenge" {
184
value = fastly_tls_subscription.gh_releases.managed_dns_challenge
97
-}
\ No newline at end of file
185
+}