126 lines
3.5 KiB
Terraform
126 lines
3.5 KiB
Terraform
|
locals {
|
||
|
|
code_host = "http.host eq \"${var.forge_code_hostname}\""
|
||
|
|
code_path = <<-EOT
|
||
|
|
(${local.code_host})
|
||
|
|
and not ends_with(http.request.uri.path, "/info/refs")
|
||
|
|
and not ends_with(http.request.uri.path, "/git-upload-pack")
|
||
|
|
and not ends_with(http.request.uri.path, "/git-receive-pack")
|
||
|
|
and not ends_with(http.request.uri.path, "/HEAD")
|
||
|
|
and not http.request.uri.path contains "/objects/"
|
||
|
|
EOT
|
||
|
|
# Forgejo parses multipart GET bodies, including HTTP/2 bodies without Content-Length.
|
||
|
|
code_read = <<-EOT
|
||
|
|
(${local.code_path})
|
||
|
|
and http.request.method in {"GET" "HEAD"}
|
||
|
|
and not any(lower(http.request.headers.names[*])[*] in {"content-type" "content-length" "transfer-encoding"})
|
||
|
|
EOT
|
||
|
|
code_response = <<-EOT
|
||
|
|
(${local.code_read})
|
||
|
|
and http.response.code in {200 206 304}
|
||
|
|
and not any(http.response.headers["cache-control"][*] contains "no-store")
|
||
|
|
EOT
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "cloudflare_ruleset" "code_requests" {
|
||
|
|
provider = cloudflare.cache
|
||
|
|
|
||
|
|
zone_id = var.zone_id
|
||
|
|
name = "forge-code-requests"
|
||
|
|
kind = "zone"
|
||
|
|
phase = "http_request_cache_settings"
|
||
|
|
rules = [
|
||
|
|
{
|
||
|
|
ref = "code_bypass"
|
||
|
|
expression = local.code_host
|
||
|
|
action = "set_cache_settings"
|
||
|
|
action_parameters = {
|
||
|
|
cache = false
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
# Include Cloudflare's internal PURGE method so URL purges use the same cache settings.
|
||
|
|
ref = "code_reads"
|
||
|
|
expression = "((${local.code_path}) and http.request.method eq \"PURGE\") or ((${local.code_read}) and not http.request.headers.truncated)"
|
||
|
|
action = "set_cache_settings"
|
||
|
|
action_parameters = {
|
||
|
|
cache = true
|
||
|
|
edge_ttl = {
|
||
|
|
mode = "respect_origin"
|
||
|
|
}
|
||
|
|
browser_ttl = {
|
||
|
|
mode = "respect_origin"
|
||
|
|
}
|
||
|
|
vary = {
|
||
|
|
default = {
|
||
|
|
action = "bypass"
|
||
|
|
}
|
||
|
|
headers = {
|
||
|
|
accept = {
|
||
|
|
action = "passthrough"
|
||
|
|
}
|
||
|
|
accept-language = {
|
||
|
|
action = "passthrough"
|
||
|
|
}
|
||
|
|
accept-encoding = {
|
||
|
|
action = "normalize"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
]
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "cloudflare_ruleset" "code_responses" {
|
||
|
|
provider = cloudflare.cache
|
||
|
|
|
||
|
|
zone_id = var.zone_id
|
||
|
|
name = "forge-code-responses"
|
||
|
|
kind = "zone"
|
||
|
|
phase = "http_response_cache_settings"
|
||
|
|
rules = [
|
||
|
|
{
|
||
|
|
ref = "code_errors"
|
||
|
|
expression = "(${local.code_host}) and not http.response.code in {200 206 304}"
|
||
|
|
action = "set_cache_control"
|
||
|
|
action_parameters = {
|
||
|
|
no_store = {
|
||
|
|
operation = "set"
|
||
|
|
cloudflare_only = true
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
ref = "code_public"
|
||
|
|
expression = local.code_response
|
||
|
|
action = "set_cache_control"
|
||
|
|
action_parameters = {
|
||
|
|
private = {
|
||
|
|
operation = "remove"
|
||
|
|
cloudflare_only = true
|
||
|
|
}
|
||
|
|
public = {
|
||
|
|
operation = "set"
|
||
|
|
cloudflare_only = true
|
||
|
|
}
|
||
|
|
s_maxage = {
|
||
|
|
operation = "set"
|
||
|
|
value = 300
|
||
|
|
cloudflare_only = true
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
ref = "code_assets"
|
||
|
|
expression = "(${local.code_response}) and starts_with(http.request.uri.path, \"/assets/\")"
|
||
|
|
action = "set_cache_control"
|
||
|
|
action_parameters = {
|
||
|
|
s_maxage = {
|
||
|
|
operation = "set"
|
||
|
|
value = 21600
|
||
|
|
cloudflare_only = true
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
]
|
||
|
|
}
|