mirror of
https://github.com/digital-asset/daml.git
synced 2024-09-20 09:17:43 +03:00
d2e2c21684
New year, new copyright, new expected unknown issues with various files that won't be covered by the script and/or will be but shouldn't change. I'll do the details on Jan 1, but would appreciate this being preapproved so I can actually get it merged by then. CHANGELOG_BEGIN CHANGELOG_END
41 lines
1.3 KiB
HCL
41 lines
1.3 KiB
HCL
# Copyright (c) 2022 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
// Setup the Nix bucket + CDN
|
|
locals {
|
|
nix_cache_name = "daml-nix-cache"
|
|
|
|
// see main.tf for additional locals
|
|
}
|
|
|
|
module "nix_cache" {
|
|
source = "./modules/gcp_cdn_bucket"
|
|
|
|
labels = local.labels
|
|
name = local.nix_cache_name
|
|
project = local.project
|
|
region = local.region
|
|
ssl_certificate = "https://www.googleapis.com/compute/v1/projects/da-dev-gcp-daml-language/global/sslCertificates/nix-cache"
|
|
cache_retention_days = 360
|
|
}
|
|
|
|
// allow rw access for CI writer (see writer.tf)
|
|
resource "google_storage_bucket_iam_member" "nix_cache_writer_create" {
|
|
bucket = module.nix_cache.bucket_name
|
|
|
|
# https://cloud.google.com/storage/docs/access-control/iam-roles
|
|
role = "roles/storage.objectCreator"
|
|
member = "serviceAccount:${google_service_account.writer.email}"
|
|
}
|
|
resource "google_storage_bucket_iam_member" "nix_cache_writer_read" {
|
|
bucket = module.nix_cache.bucket_name
|
|
|
|
# https://cloud.google.com/storage/docs/access-control/iam-roles
|
|
role = "roles/storage.objectViewer"
|
|
member = "serviceAccount:${google_service_account.writer.email}"
|
|
}
|
|
|
|
output "nix_cache_ip" {
|
|
value = module.nix_cache.external_ip
|
|
}
|