website

terraform {
  required_providers {
    cloudflare = {
      source  = "cloudflare/cloudflare"
      version = "~> 5.0"
    }
  }
}

provider "cloudflare" {}

resource "cloudflare_r2_bucket" "website" {
  account_id = var.cloudflare_account_id
  name       = "website"
}

resource "cloudflare_r2_custom_domain" "website" {
  account_id  = var.cloudflare_account_id
  bucket_name = cloudflare_r2_bucket.website.name
  domain      = "pyrossh.dev"
  zone_id     = var.cloudflare_zone_id
  enabled     = true
}


resource "cloudflare_r2_bucket" "git" {
  account_id = var.cloudflare_account_id
  name       = "git"
}

resource "cloudflare_r2_custom_domain" "git" {
  account_id  = var.cloudflare_account_id
  bucket_name = cloudflare_r2_bucket.git.name
  domain      = "git.pyrossh.dev"
  zone_id     = var.cloudflare_zone_id
  enabled     = true
}

resource "cloudflare_r2_bucket" "apps" {
  account_id = var.cloudflare_account_id
  name       = "apps"
}

# Runs the Eleventy build on every `terraform apply`, before the sync below,
# so `terraform apply` alone is enough — no separate `npm run build` step
# needed first. Same "always re-run" trigger pattern as sync_website.
resource "terraform_data" "build_website" {
  triggers_replace = [timestamp()]

  provisioner "local-exec" {
    working_dir = "${path.module}/.."
    command     = "npm run build"
  }
}

# Syncs ../dist into the bucket on every `terraform apply` — `terraform_data`
# has no real infra state of its own, so `triggers_replace` on a timestamp is
# the standard way to force its provisioner to re-run every time rather than
# only on the first apply. `rclone sync` (not `copy`) both uploads changed
# files and deletes remote objects no longer present locally, so the bucket
# always matches the latest build exactly.
#
# Requires `rclone` on the machine running `terraform apply`, with a remote
# named "website" configured for R2 (`rclone config`) — an S3-compatible
# access key/secret scoped to this bucket, not the Cloudflare API token used
# above.
#
resource "terraform_data" "sync_website" {
  triggers_replace = [timestamp()]

  depends_on = [cloudflare_r2_bucket.website, terraform_data.build_website]

  provisioner "local-exec" {
    command = "rclone sync ${path.module}/../dist website:${cloudflare_r2_bucket.website.name} --checksum --fast-list --multi-thread-streams=32 -P "
  }
}

# The custom domain sits behind Cloudflare's edge cache, and by default only
# static-asset extensions (css/js/images/fonts) are cached there — not HTML.
# Since the sync reuses the same URLs on every deploy (no content-hashed
# filenames), an updated asset at an unchanged path would keep serving the
# stale cached copy at the edge until it expires on its own. Purging right
# after the sync avoids that gap. Requires the CLOUDFLARE_API_TOKEN already
# used above to also carry the "Zone > Cache Purge > Purge" permission for
# this zone — it isn't included in the R2-only scope from the setup steps
# earlier, so add it to the token if the purge call starts failing with 403.
#
# Kept as its own resource (not tacked onto sync_website's command) so a
# flaky purge call fails independently of the sync — you can tell from the
# apply output which of the two actually broke, rather than one opaque
# multi-line script's exit code.
resource "terraform_data" "purge_cache" {
  triggers_replace = [timestamp()]

  depends_on = [terraform_data.sync_website]

  provisioner "local-exec" {
    command = <<-EOT
      curl -sf --retry 3 -X POST "https://api.cloudflare.com/client/v4/zones/${var.cloudflare_zone_id}/purge_cache" \
        -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
        -H "Content-Type: application/json" \
        --data '{"purge_everything": true}'
    EOT
  }
}