fix: NixCache | remove insecure ingress and use secure one

cache-infrastructure/nix/index.ts

@@ -0,0 +1,131 @@
+import * as fs from "fs";
+import * as path from "path";
+import { Construct } from "constructs";
+import { ConfigMapV1 } from "@cdktf/provider-kubernetes/lib/config-map-v1";
+import { DeploymentV1 } from "@cdktf/provider-kubernetes/lib/deployment-v1";
+import { KubernetesProvider } from "@cdktf/provider-kubernetes/lib/provider";
+import { ServiceV1 } from "@cdktf/provider-kubernetes/lib/service-v1";
+
+import { PublicIngressRoute, LonghornPvc } from "../../utils";
+
+export class NixCache extends Construct {
+  constructor(scope: Construct, id: string, provider: KubernetesProvider) {
+    super(scope, id);
+
+    const pvc = new LonghornPvc(this, "pvc", {
+      provider,
+      name: "nix-cache",
+      namespace: "homelab",
+      accessModes: ["ReadWriteMany"],
+      size: "64Gi",
+    });
+
+    const nginxConfig = fs.readFileSync(
+      path.join(__dirname, "./nginx.conf"),
+      "utf-8",
+    );
+
+    const configMap = new ConfigMapV1(this, "config-map", {
+      provider,
+      metadata: {
+        name: "nix-cache",
+        namespace: "homelab",
+      },
+      data: {
+        "nix-cache.conf": nginxConfig,
+      },
+    });
+
+    new ServiceV1(this, "service", {
+      provider,
+      metadata: {
+        name: "nix-cache",
+        namespace: "homelab",
+      },
+      spec: {
+        selector: {
+          app: "nix-cache",
+        },
+        port: [
+          {
+            name: "http",
+            port: 80,
+            targetPort: "80",
+          },
+        ],
+        type: "ClusterIP",
+      },
+    });
+
+    new DeploymentV1(this, "deployment", {
+      provider,
+      metadata: {
+        name: "nix-cache",
+        namespace: "homelab",
+      },
+      spec: {
+        replicas: "3",
+        selector: {
+          matchLabels: {
+            app: "nix-cache",
+          },
+        },
+        template: {
+          metadata: {
+            labels: {
+              app: "nix-cache",
+            },
+          },
+          spec: {
+            container: [
+              {
+                name: "nginx",
+                image: "nginx:latest",
+                volumeMount: [
+                  {
+                    name: "cache",
+                    mountPath: "/var/cache/nginx/nix",
+                  },
+                  {
+                    name: "nginx-config",
+                    mountPath: "/etc/nginx/conf.d/nix-cache.conf",
+                    subPath: "nix-cache.conf",
+                  },
+                ],
+              },
+            ],
+            volume: [
+              {
+                name: "cache",
+                persistentVolumeClaim: {
+                  claimName: pvc.name,
+                },
+              },
+              {
+                name: "nginx-config",
+                configMap: {
+                  name: configMap.metadata.name,
+                  items: [
+                    {
+                      key: "nix-cache.conf",
+                      path: "nix-cache.conf",
+                    },
+                  ],
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+
+    new PublicIngressRoute(this, "ingress-route", {
+      provider,
+      name: "nix-cache",
+      namespace: "homelab",
+      host: "nix.dogar.dev",
+      serviceName: "nix-cache",
+      servicePort: 80,
+    });
+  }
+}

cache-infrastructure/nix/nginx.conf

@@ -0,0 +1,32 @@
+proxy_cache_path /var/cache/nginx/nix levels=1:2 keys_zone=nix_cache:32m max_size=60g inactive=365d use_temp_path=off;
+
+map $status $cache_header {
+  200     "public";
+  302     "public";
+  default "no-cache";
+}
+
+server {
+  listen 80;
+  server_name nix.dogar.dev;
+
+  location / {
+    proxy_pass https://cache.nixos.org;
+    proxy_http_version 1.1;
+
+    proxy_set_header Host cache.nixos.org;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    proxy_ssl_server_name on;
+
+    proxy_cache nix_cache;
+    proxy_cache_valid 200 302 365d;
+    proxy_cache_valid any 1m;
+    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+
+    add_header X-Cache-Status $upstream_cache_status always;
+    add_header Cache-Control $cache_header always;
+  }
+}