terraform: remove now unused cache-staging
The TLS subscription will have to be removed separately since I don't have destroy permissions on those resources.
Pierre Bourdon committed
Nov 4, 2023 at 15:58 UTC
b3385ad3768154778afafe042b74dd34eb1ecbba
2 files changed
+1
-158
terraform/cache.tf
+1
-153
@@ -274,159 +274,7 @@ resource "fastly_tls_subscription" "cache" {
274
certificate_authority = "globalsign"
275
}
276
277
-# Temporarily duplicated while testing VCL fragment for Fastly<->S3 authn. TF
278
-# doesn't make it particularly easy to avoid this duplication.
279
-#
280
-# TODO: remove once the Fastly<->S3 authn is deployed to the main cache
281
-# Fastly service.
282
-resource "fastly_service_vcl" "cache-staging" {
283
- name = "cache-staging.nixos.org"
284
- default_ttl = 86400
285
-
286
- backend {
287
- address = "s3.amazonaws.com"
288
- auto_loadbalance = false
289
- between_bytes_timeout = 10000
290
- connect_timeout = 5000
291
- error_threshold = 0
292
- first_byte_timeout = 15000
293
- max_conn = 200
294
- name = "s3.amazonaws.com"
295
- override_host = aws_s3_bucket.cache.bucket_domain_name
296
- port = 443
297
- shield = local.fastly_shield
298
- ssl_cert_hostname = "s3.amazonaws.com"
299
- ssl_check_cert = true
300
- use_ssl = true
301
- weight = 100
302
- }
303
-
304
- condition {
305
- name = "is-404"
306
- priority = 0
307
- statement = "beresp.status == 404"
308
- type = "CACHE"
309
- }
310
-
311
- condition {
312
- name = "Match /"
313
- priority = 10
314
- statement = "req.url ~ \"^/$\""
315
- type = "REQUEST"
316
- }
317
-
318
- domain {
319
- name = "cache-staging.nixos.org"
320
- }
321
-
322
- header {
323
- action = "set"
324
- destination = "url"
325
- ignore_if_set = false
326
- name = "Landing page"
327
- priority = 10
328
- request_condition = "Match /"
329
- source = "\"/index.html\""
330
- type = "request"
331
- }
332
-
333
- # Clean headers for caching
334
- header {
335
- destination = "http.x-amz-request-id"
336
- type = "cache"
337
- action = "delete"
338
- name = "remove x-amz-request-id"
339
- }
340
- header {
341
- destination = "http.x-amz-version-id"
342
- type = "cache"
343
- action = "delete"
344
- name = "remove x-amz-version-id"
345
- }
346
- header {
347
- destination = "http.x-amz-id-2"
348
- type = "cache"
349
- action = "delete"
350
- name = "remove x-amz-id-2"
351
- }
352
-
353
- # Enable Streaming Miss.
354
- # https://docs.fastly.com/en/guides/streaming-miss
355
- # https://github.com/NixOS/nixos-org-configurations/issues/212#issuecomment-1187568233
356
- header {
357
- priority = 20
358
- destination = "do_stream"
359
- type = "cache"
360
- action = "set"
361
- name = "Enabling Streaming Miss"
362
- source = "true"
363
- }
364
-
365
- # Allow CORS GET requests.
366
- header {
367
- destination = "http.access-control-allow-origin"
368
- type = "response"
369
- action = "set"
370
- name = "CORS Allow"
371
- source = "\"*\""
372
- }
373
-
374
- response_object {
375
- name = "404-page"
376
- cache_condition = "is-404"
377
- content = "404"
378
- content_type = "text/plain"
379
- response = "Not Found"
380
- status = 404
381
- }
382
-
383
- # Authenticate Fastly<->S3 requests. See Fastly documentation:
384
- # https://docs.fastly.com/en/guides/amazon-s3#using-an-amazon-s3-private-bucket
385
- snippet {
386
- name = "Authenticate S3 requests"
387
- type = "miss"
388
- priority = 100
389
- content = templatefile("${path.module}/cache/s3-authn.vcl", {
390
- aws_region = aws_s3_bucket.cache.region
391
- backend_domain = aws_s3_bucket.cache.bucket_domain_name
392
- access_key = local.cache-iam.key
393
- secret_key = local.cache-iam.secret
394
- })
395
- }
396
-
397
- snippet {
398
- content = "set req.url = querystring.remove(req.url);"
399
- name = "Remove all query strings"
400
- priority = 50
401
- type = "recv"
402
- }
403
-
404
- # Work around the 2GB size limit for large files
405
- #
406
- # See https://docs.fastly.com/en/guides/segmented-caching
407
- snippet {
408
- content = <<-EOT
409
- if (req.url.path ~ "^/nar/") {
410
- set req.enable_segmented_caching = true;
411
- }
412
- EOT
413
- name = "Enable segment caching for NAR files"
414
- priority = 60
415
- type = "recv"
416
- }
417
-
418
- snippet {
419
- name = "cache-errors"
420
- content = <<-EOT
421
- if (beresp.status == 403) {
422
- set beresp.status = 404;
423
- }
424
- EOT
425
- priority = 100
426
- type = "fetch"
427
- }
428
-}
429
-
277
+# TODO: destroy and remove
278
resource "fastly_tls_subscription" "cache-staging" {
279
domains = ["cache-staging.nixos.org"]
280
configuration_id = local.fastly_tls12_sni_configuration_id
terraform/dns.tf
-5
@@ -106,11 +106,6 @@ locals {
106
type = "CNAME"
107
value = "dualstack.v2.shared.global.fastly.net"
108
},
109
- {
110
- hostname = "cache-staging.nixos.org"
111
- type = "CNAME"
112
- value = "dualstack.v2.shared.global.fastly.net"
113
- },
109
{
110
hostname = "channels.nixos.org"
111
type = "CNAME"