fix(cdn): align repository routing across pull zones

cdn.tf

@@ -32,7 +32,7 @@
 #   cache_stale           = ["offline", "updating"]
 #   use_background_update = true
 
-  # block_ips = var.cdn_block_ips
+# block_ips = var.cdn_block_ips
 
 #   # 50 TB
 #   limit_bandwidth = 50000000000000
@@ -82,7 +82,7 @@ resource "bunnynet_pullzone" "cran_rpkgs_com" {
 
   cache_expiration_time = 31919000
   websockets_enabled    = false
-  errorpage_whitelabel = true
+  errorpage_whitelabel  = true
 
   origin {
     type              = "OriginUrl"
@@ -147,6 +147,58 @@ resource "bunnynet_pullzone_hostname" "cran_rpkgs_com" {
   tls_enabled = true
 }
 
+# Alliance SwissPass historically used a separate, manually configured pull
+# zone. Adopt it so both public repositories use the same B2 origin, middleware
+# release and cache behavior.
+import {
+  to = bunnynet_pullzone.cran_allianceswisspass
+  id = "3265648"
+}
+
+resource "bunnynet_pullzone" "cran_allianceswisspass" {
+  name = "cran-allianceswisspass"
+
+  cache_errors          = false
+  cache_expiration_time = 31919000
+  websockets_enabled    = false
+  errorpage_whitelabel  = true
+
+  origin {
+    type              = "OriginUrl"
+    url               = "https://devxy-rpkgs-binaries.s3.eu-central-003.backblazeb2.com"
+    middleware_script = bunnynet_compute_script.rpkgs_router.id
+  }
+
+  routing {
+    filters = [
+      "scripting",
+    ]
+  }
+
+  s3_auth_enabled = true
+  s3_auth_key     = var.B2_S3_ACCESS_KEY
+  s3_auth_secret  = var.B2_S3_SECRET_KEY
+  s3_auth_region  = "eu-central-003"
+
+  cache_enabled              = true
+  request_coalescing_enabled = true
+  block_post_requests        = true
+  cache_vary_headers         = ["User-Agent"]
+
+  limit_requests    = 5000
+  limit_connections = 1000
+
+  safehop_enabled      = true
+  add_canonical_header = true
+  cache_stale          = ["offline", "updating"]
+  block_ips            = var.cdn_block_ips
+
+  # 50 TB
+  limit_bandwidth = 50000000000000
+
+  block_root_path = true
+}
+
 # resource "bunnynet_storage_zone" "devxy-r-binaries" {
 #   name      = "devxy-r-binaries-storage"
 #   region    = "DE"