fix(cdn): declare the User-Agent cache vary instead of dropping it #156

Merged

pat-s merged 1 commit from fix/keep-cache-vary into main

2026-08-09 10:08:41 +00:00

pat-s commented

2026-08-09 10:06:56 +00:00

Owner

Problem

tofu plan after importing the middleware script shows:

  ~ resource "bunnynet_pullzone" "cran_rpkgs_com" {
      ~ cache_vary_headers = [
          - "User-Agent",
        ]

The zone carries cache_vary_headers = ["User-Agent"], set before this configuration existed. cdn.tf never declared it, so the first apply of the managed middleware would remove it — as a side effect of an unrelated change, with no decision recorded anywhere.

What this changes

Declares the attribute with its current value, so the pull zone is a no-op in that plan.

Why keep it rather than let it go

On paper the router makes it redundant. The only UA-dependent responses it produces are redirects, and those carry Cache-Control: no-store; their targets are concrete per-slot, per-minor URLs whose content depends only on the path. Dropping the vary would also be a genuine win, since otherwise every distinct R version string (R (4.5.3 x86_64-pc-linux-musl …)) keys its own copy of every tarball.

It stays anyway, for now:

it is the second line of defence against the one failure mode that would be quiet and confusing — an R 4.6 client served the 4.5 index
Bunny honouring no-store on an edge-script response has been confirmed for today's redirects (cdn-cache: BYPASS on max-age=0), but not for the new script in production
keeping it is the status quo, so it cannot regress anything

Removing it is worth doing on its own, once per-minor routing is confirmed live and the redirects can be observed bypassing cache — not as a side effect of enabling that routing.

Verification

tofu validate passes. Re-planning after this merges should leave bunnynet_pullzone.cran_rpkgs_com unchanged, reducing the plan to the script content update and the new UNION_SLOTS variable.

## Problem `tofu plan` after importing the middleware script shows: ``` ~ resource "bunnynet_pullzone" "cran_rpkgs_com" { ~ cache_vary_headers = [ - "User-Agent", ] ``` The zone carries `cache_vary_headers = ["User-Agent"]`, set before this configuration existed. `cdn.tf` never declared it, so the first apply of the managed middleware would remove it — as a side effect of an unrelated change, with no decision recorded anywhere. ## What this changes Declares the attribute with its current value, so the pull zone is a no-op in that plan. ## Why keep it rather than let it go On paper the router makes it redundant. The only UA-dependent responses it produces are redirects, and those carry `Cache-Control: no-store`; their targets are concrete per-slot, per-minor URLs whose content depends only on the path. Dropping the vary would also be a genuine win, since otherwise every distinct R version string (`R (4.5.3 x86_64-pc-linux-musl …)`) keys its own copy of every tarball. It stays anyway, for now: - it is the second line of defence against the one failure mode that would be quiet and confusing — an R 4.6 client served the 4.5 index - Bunny honouring `no-store` on an edge-script response has been confirmed for today's redirects (`cdn-cache: BYPASS` on `max-age=0`), but not for the new script in production - keeping it is the status quo, so it cannot regress anything Removing it is worth doing on its own, once per-minor routing is confirmed live and the redirects can be observed bypassing cache — not as a side effect of enabling that routing. ## Verification `tofu validate` passes. Re-planning after this merges should leave `bunnynet_pullzone.cran_rpkgs_com` unchanged, reducing the plan to the script `content` update and the new `UNION_SLOTS` variable.

pat-s added 1 commit

2026-08-09 10:06:56 +00:00

fix(cdn): declare the User-Agent cache vary instead of dropping it 4ea6c75fd9

The pull zone carries cache_vary_headers = ["User-Agent"], set before this
configuration existed. Because cdn.tf never declared it, the first apply of the
managed middleware would have removed it as a side effect.

Keep it for now: the router's only UA-dependent responses are redirects, which
are no-store, so it is redundant on paper, but it is also the second line of
defence against an R 4.6 client being served the 4.5 index. Removing it is
worth doing on its own once per-minor routing is confirmed live.

pat-s merged commit 0c86b2692d into main

2026-08-09 10:08:41 +00:00

pat-s deleted branch fix/keep-cache-vary

2026-08-09 10:08:41 +00:00

pat-s referenced this pull request from a commit

2026-08-09 10:08:43 +00:00

fix(cdn): declare the User-Agent cache vary instead of dropping it (#156)