terraform: create new tls configurations for fastly hosts
This excludes artifacts, because Fastly doesn't allow more than one TLS configuration using the same CA.
Martin Weinelt committed
Nov 14, 2025 at 04:57 UTC
20ffe3a0f868d7aea4a67432d1eb9a55a1762bdf
4 files changed
+28
-3
terraform/cache.tf
+10
@@ -304,3 +304,13 @@ resource "fastly_tls_subscription" "cache" {
304
configuration_id = local.fastly_tls12_sni_configuration_id
305
certificate_authority = "globalsign"
306
}
307
+
308
+resource "fastly_tls_subscription" "cache-2025-11" {
309
+ domains = [for domain in fastly_service_vcl.cache.domain : domain.name]
310
+ configuration_id = local.fastly_tls13_quic_configuration_id
311
+ certificate_authority = "lets-encrypt"
312
+}
313
+
314
+output "cache-managed_dns_challenge" {
315
+ value = fastly_tls_subscription.cache.managed_dns_challenges
316
+}
terraform/channels.tf
+6
-1
@@ -296,7 +296,12 @@ resource "fastly_tls_subscription" "channels" {
296
certificate_authority = "globalsign"
297
}
298
299
-# TODO: move the DNS config to terraform
299
+resource "fastly_tls_subscription" "channels-2025-11" {
300
+ domains = [for domain in fastly_service_vcl.channels.domain : domain.name]
301
+ configuration_id = local.fastly_tls13_quic_configuration_id
302
+ certificate_authority = "lets-encrypt"
303
+}
304
+
305
output "channels-managed_dns_challenge" {
306
value = fastly_tls_subscription.channels.managed_dns_challenges
307
}
terraform/nixpkgs-tarballs.tf
+6
-1
@@ -292,7 +292,12 @@ resource "fastly_tls_subscription" "nixpkgs-tarballs" {
292
certificate_authority = "globalsign"
293
}
294
295
-# TODO: move the DNS config to terraform
295
+resource "fastly_tls_subscription" "nixpkgs-tarballs-2025-11" {
296
+ domains = [for domain in fastly_service_vcl.nixpkgs-tarballs.domain : domain.name]
297
+ configuration_id = local.fastly_tls13_quic_configuration_id
298
+ certificate_authority = "lets-encrypt"
299
+}
300
+
301
output "nixpkgs-tarballs-managed_dns_challenge" {
302
value = fastly_tls_subscription.nixpkgs-tarballs.managed_dns_challenges
303
}
terraform/releases.tf
+6
-1
@@ -261,7 +261,12 @@ resource "fastly_tls_subscription" "releases" {
261
certificate_authority = "globalsign"
262
}
263
264
-# TODO: move the DNS config to terraform
264
+resource "fastly_tls_subscription" "releases-2025-11" {
265
+ domains = [for domain in fastly_service_vcl.releases.domain : domain.name]
266
+ configuration_id = local.fastly_tls13_quic_configuration_id
267
+ certificate_authority = "lets-encrypt"
268
+}
269
+
270
output "releases-managed_dns_challenge" {
271
value = fastly_tls_subscription.releases.managed_dns_challenges
272
}