tf/channels: add faslty configuration
zimbatm committed
Aug 30, 2021 at 21:38 UTC
3b40d61d113a9e97e8af67d9066d1045ca683c52
2 files changed
+93
terraform/channels.tf
+89
@@ -6,6 +6,11 @@ locals {
6
bucket_url = "https://${aws_s3_bucket.channels.bucket_domain_name}"
7
bucket_website = "https://${local.channels_domain}"
8
})
9
+
10
+ # Use the website endpoint because the bucket is configured with website
11
+ # enabled. This also means we can't use TLS between Fastly and AWS because
12
+ # the website endpoint only has port 80 open.
13
+ channels_backend = aws_s3_bucket.channels.website_endpoint
14
}
15
16
resource "aws_s3_bucket" "channels" {
@@ -146,3 +151,87 @@ resource "aws_acm_certificate" "channels" {
151
create_before_destroy = true
152
}
153
}
154
+
155
+resource "fastly_service_v1" "channels" {
156
+ name = local.channels_domain
157
+ default_ttl = 86400
158
+
159
+ backend {
160
+ address = local.channels_backend
161
+ auto_loadbalance = false
162
+ between_bytes_timeout = 10000
163
+ connect_timeout = 5000
164
+ error_threshold = 0
165
+ first_byte_timeout = 15000
166
+ max_conn = 200
167
+ name = local.channels_backend
168
+ override_host = local.channels_backend
169
+ port = 80
170
+ shield = "bwi-va-us"
171
+ use_ssl = false
172
+ weight = 100
173
+ }
174
+
175
+ condition {
176
+ name = "Generated by synthetic response for 404 page"
177
+ priority = 0
178
+ statement = "beresp.status == 404"
179
+ type = "CACHE"
180
+ }
181
+
182
+ condition {
183
+ name = "Match /"
184
+ priority = 10
185
+ statement = "req.url ~ \"^/$\""
186
+ type = "REQUEST"
187
+ }
188
+
189
+ domain {
190
+ name = local.channels_domain
191
+ }
192
+
193
+ header {
194
+ action = "set"
195
+ destination = "url"
196
+ ignore_if_set = false
197
+ name = "Landing page"
198
+ priority = 10
199
+ request_condition = "Match /"
200
+ source = "\"/index.html\""
201
+ type = "request"
202
+ }
203
+
204
+ response_object {
205
+ cache_condition = "Generated by synthetic response for 404 page"
206
+ content = "404"
207
+ content_type = "text/html"
208
+ name = "Generated by synthetic response for 404 page"
209
+ response = "Not Found"
210
+ status = 404
211
+ }
212
+
213
+ snippet {
214
+ content = <<-EOT
215
+ if (beresp.status == 403) {
216
+ set beresp.status = 404;
217
+ set beresp.ttl = 86400s;
218
+ set beresp.grace = 0s;
219
+ set beresp.cacheable = true;
220
+ }
221
+ EOT
222
+ name = "Change 403 from S3 to 404"
223
+ priority = 100
224
+ type = "fetch"
225
+ }
226
+}
227
+
228
+resource "fastly_tls_subscription" "channels" {
229
+ domains = [for domain in fastly_service_v1.channels.domain : domain.name]
230
+ configuration_id = local.fastly_tls12_sni_configuration_id
231
+ certificate_authority = "globalsign"
232
+}
233
+
234
+# TODO: move the DNS config to terraform
235
+output "channels-managed_dns_challenge" {
236
+ value = fastly_tls_subscription.channels.managed_dns_challenge
237
+}
terraform/locals.tf
new
+4
@@ -0,0 +1,4 @@
1
+locals {
2
+ # TLS v1.2, protocols HTTP/1.1 and HTTP/2
3
+ fastly_tls12_sni_configuration_id = "5PXBTa6c01Xoh54ylNwmVA"
4
+}