From b395ddf4bd47e3827da69be425dde263468eee40 Mon Sep 17 00:00:00 2001
From: pat-s <patrick.schratz@gmail.com>
Date: Thu, 13 Aug 2026 14:11:16 +0000
Subject: [PATCH] fix(cdn): manage Alliance hostname

---
 .crow/weekly-rebuild-reindex.yaml |  4 ++--
 cdn.tf                            |  7 ++++++
 scripts/purge_cdn_zone.sh         | 40 +++++++++++++++++++++++++++----
 3 files changed, 45 insertions(+), 6 deletions(-)

diff --git a/.crow/weekly-rebuild-reindex.yaml b/.crow/weekly-rebuild-reindex.yaml
index bb00332..250b225 100644
--- a/.crow/weekly-rebuild-reindex.yaml
+++ b/.crow/weekly-rebuild-reindex.yaml
@@ -175,9 +175,9 @@ steps:
         from_secret: BUNNYNET_API_KEY
       # cran.rpkgs.com and cran.allianceswisspass.devxy.io are on separate
       # Bunny pull zones, so both must be purged after the shared origin changes.
-      BUNNY_PULLZONES: '3857050 3265648'
+      BUNNY_PULLZONES: '3857050 cran.allianceswisspass.devxy.io'
     commands:
-      - apk add --no-cache -q bash curl
+      - apk add --no-cache -q bash curl jq
       # Crow carries the checkout from the re-index step into this step.
       - bash scripts/purge_cdn_zone.sh "$BUNNYNET_API_KEY" $BUNNY_PULLZONES
     # Runs on every row rather than on one designated slot: a cron fires only
diff --git a/cdn.tf b/cdn.tf
index 01191a5..96877b2 100644
--- a/cdn.tf
+++ b/cdn.tf
@@ -199,6 +199,13 @@ resource "bunnynet_pullzone" "cran_allianceswisspass" {
   block_root_path = true
 }
 
+resource "bunnynet_pullzone_hostname" "cran_allianceswisspass" {
+  pullzone    = bunnynet_pullzone.cran_allianceswisspass.id
+  name        = "cran.allianceswisspass.devxy.io"
+  force_ssl   = true
+  tls_enabled = true
+}
+
 # resource "bunnynet_storage_zone" "devxy-r-binaries" {
 #   name      = "devxy-r-binaries-storage"
 #   region    = "DE"
diff --git a/scripts/purge_cdn_zone.sh b/scripts/purge_cdn_zone.sh
index 4853245..648dfc3 100755
--- a/scripts/purge_cdn_zone.sh
+++ b/scripts/purge_cdn_zone.sh
@@ -19,22 +19,54 @@
 # why this is not used by the daily update path.
 #
 # The public hostnames currently use separate pull zones, so callers must pass
-# every zone that serves the repository.
+# every zone that serves the repository. A zone can be identified by its
+# numeric ID or by one of its hostnames; hostname lookup avoids persisting IDs
+# that change when a zone is recreated.
 #
 # Usage:
-#   purge_cdn_zone.sh <BUNNYNET_API_KEY> <pull_zone_id> [<pull_zone_id>...]
+#   purge_cdn_zone.sh <BUNNYNET_API_KEY> <pull_zone> [<pull_zone>...]
 #
 set -euo pipefail
 
 if (($# < 2)); then
-  echo "usage: $0 <api_key> <pull_zone_id> [<pull_zone_id>...]" >&2
+  echo "usage: $0 <api_key> <pull_zone> [<pull_zone>...]" >&2
   exit 2
 fi
 
 api_key="$1"
 shift
 
-for zone_id in "$@"; do
+resolve_zone_id() {
+  local zone="$1"
+  local response_file
+  local zone_id
+
+  if [[ "${zone}" =~ ^[0-9]+$ ]]; then
+    echo "${zone}"
+    return
+  fi
+
+  response_file=$(mktemp)
+  curl -sS -o "${response_file}" \
+    -H "AccessKey: ${api_key}" \
+    "https://api.bunny.net/pullzone"
+  zone_id=$(
+    jq -r --arg hostname "${zone}" \
+      '(.Items // .)[] | select(any(.Hostnames[]?; .Value == $hostname)) | .Id' \
+      "${response_file}"
+  )
+  rm -f "${response_file}"
+
+  if [[ -z "${zone_id}" ]]; then
+    echo "Could not find BunnyCDN pull zone for hostname ${zone}" >&2
+    exit 1
+  fi
+
+  echo "${zone_id}"
+}
+
+for zone in "$@"; do
+  zone_id=$(resolve_zone_id "${zone}")
   echo "Purging BunnyCDN pull zone ${zone_id}"
 
   response_file="/tmp/purge_zone_response_${zone_id}.txt"
-- 
2.54.0