website
git clone https://git.pyrossh.dev/website
木 Personal website of pyrossh. Built with astrojs, shiki, vite.
5a9aa2d
— pyrossh
2026-08-05T10:41:47+05:30
update infra
- infra/main.tf +30 -2
infra/main.tf
CHANGED
|
@@ -22,6 +22,18 @@ resource "cloudflare_r2_custom_domain" "website" {
|
|
|
22
22
|
enabled = true
|
|
23
23
|
}
|
|
24
24
|
|
|
25
|
+
# Runs the Eleventy build on every `terraform apply`, before the sync below,
|
|
26
|
+
# so `terraform apply` alone is enough — no separate `npm run build` step
|
|
27
|
+
# needed first. Same "always re-run" trigger pattern as sync_website.
|
|
28
|
+
resource "terraform_data" "build_website" {
|
|
29
|
+
triggers_replace = [timestamp()]
|
|
30
|
+
|
|
31
|
+
provisioner "local-exec" {
|
|
32
|
+
working_dir = "${path.module}/.."
|
|
33
|
+
command = "npm run build"
|
|
34
|
+
}
|
|
35
|
+
}
|
|
36
|
+
|
|
25
37
|
# Syncs ../dist into the bucket on every `terraform apply` — `terraform_data`
|
|
26
38
|
# has no real infra state of its own, so `triggers_replace` on a timestamp is
|
|
27
39
|
# the standard way to force its provisioner to re-run every time rather than
|
|
@@ -33,12 +45,28 @@ resource "cloudflare_r2_custom_domain" "website" {
|
|
|
33
45
|
# named "website" configured for R2 (`rclone config`) — an S3-compatible
|
|
34
46
|
# access key/secret scoped to this bucket, not the Cloudflare API token used
|
|
35
47
|
# above.
|
|
48
|
+
#
|
|
49
|
+
# The custom domain sits behind Cloudflare's edge cache, and by default only
|
|
50
|
+
# static-asset extensions (css/js/images/fonts) are cached there — not HTML.
|
|
51
|
+
# Since the sync reuses the same URLs on every deploy (no content-hashed
|
|
52
|
+
# filenames), an updated asset at an unchanged path would keep serving the
|
|
53
|
+
# stale cached copy at the edge until it expires on its own. Purging right
|
|
54
|
+
# after the sync avoids that gap. Requires the CLOUDFLARE_API_TOKEN already
|
|
55
|
+
# used above to also carry the "Zone > Cache Purge > Purge" permission for
|
|
56
|
+
# this zone — it isn't included in the R2-only scope from the setup steps
|
|
57
|
+
# earlier, so add it to the token if the purge call starts failing with 403.
|
|
36
58
|
resource "terraform_data" "sync_website" {
|
|
37
59
|
triggers_replace = [timestamp()]
|
|
38
60
|
|
|
39
|
-
depends_on = [cloudflare_r2_bucket.website]
|
|
61
|
+
depends_on = [cloudflare_r2_bucket.website, terraform_data.build_website]
|
|
40
62
|
|
|
41
63
|
provisioner "local-exec" {
|
|
64
|
+
command = <<-EOT
|
|
42
|
-
|
|
65
|
+
rclone sync ${path.module}/../dist website:${cloudflare_r2_bucket.website.name} --checksum --fast-list
|
|
66
|
+
curl -sf -X POST "https://api.cloudflare.com/client/v4/zones/${var.cloudflare_zone_id}/purge_cache" \
|
|
67
|
+
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
|
|
68
|
+
-H "Content-Type: application/json" \
|
|
69
|
+
--data '{"purge_everything": true}'
|
|
70
|
+
EOT
|
|
43
71
|
}
|
|
44
72
|
}
|