pat-s
72440f9cf5
Adds visibility into how cran.rpkgs.com is actually used, from the Bunny access logs, without sending anything to a third party. ## What it does - `.crow/download-stats.yaml` runs hourly: `stats/collect.ts` reads the last 70 hours of cran-rpkgs logs (Bunny keeps three days) into a new `download_stats` schema in the build metadata database, then `stats/publish.ts` writes aggregated counts to `stats/downloads.json` in the binaries bucket and purges the CDN copy. - `stats/classify.ts` labels each request (download, index, redirect reason, renv/pak probe, scanner noise) by mirroring `edge/rpkgs-router.ts`, and splits cloud/CI networks (by ASN) from everything else. - Downloads are de-duplicated per client, package version and UTC day; clients are a salted HMAC of the anonymized /24 prefix, ASN and R platform, so no IP is stored or published. - Our own CI runners (`STATS_OWN_NETWORKS`) are excluded; collection windows are recorded so the dashboard can show gaps. - `cdn.tf` declares the zone's existing logging settings and adds `json` to the CORS extensions so rpkgs.com can read the file. - `stats/README.md` documents every rule. The rpkgs.com `/stats` page that renders this is in rpkgs/website. ## Before merging - Add Crow secrets `STATS_CLIENT_SALT` and `STATS_OWN_NETWORKS` (values in OpenBao at `development/agent-dev/rpkgs-download-stats`). - `tofu apply` for the CORS change. - After merge, register the `download-stats` cron (`0 * * * *`). ## Verification - `bun test stats`: 15 tests pass. - Ran `collect.ts` locally against the live API and database: 14,273 events inserted, a second run inserted 0. - `publish.ts --out` produced the JSON the website was previewed with; the upload and purge path has only run in CI so far (B2 credentials are CI-only). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #251
355 lines
11 KiB
HCL
355 lines
11 KiB
HCL
# https://registry.terraform.io/providers/BunnyWay/bunnynet/latest/docs/resources/pullzone
|
|
# terraform import bunnynet_pullzone.devxy-r-binaries cran
|
|
# resource "bunnynet_pullzone" "devxy-r-binaries" {
|
|
# name = "cran"
|
|
|
|
# origin {
|
|
# type = "OriginUrl"
|
|
# url = "https://devxy-rpkgs-binaries.s3.eu-central-003.backblazeb2.com"
|
|
# }
|
|
|
|
# routing {
|
|
# tier = "Standard"
|
|
# }
|
|
|
|
# s3_auth_enabled = true
|
|
# s3_auth_key = var.B2_S3_ACCESS_KEY
|
|
# s3_auth_secret = var.B2_S3_SECRET_KEY
|
|
# s3_auth_region = "eu-central-003"
|
|
|
|
# cache_enabled = true
|
|
# cache_errors = true
|
|
# request_coalescing_enabled = true
|
|
# block_post_requests = true
|
|
|
|
# limit_requests = 500
|
|
# limit_connections = 50
|
|
|
|
# safehop_enabled = true
|
|
|
|
# add_canonical_header = true
|
|
|
|
# cache_stale = ["offline", "updating"]
|
|
# use_background_update = true
|
|
|
|
# block_ips = var.cdn_block_ips
|
|
|
|
# # 50 TB
|
|
# limit_bandwidth = 50000000000000
|
|
|
|
# permacache_storagezone = bunnynet_storage_zone.devxy-r-binaries.id
|
|
|
|
# # rec from docs: https://www.backblaze.com/docs/cloud-storage-integrate-bunnynet-with-backblaze-b2
|
|
# block_root_path = true
|
|
# }
|
|
|
|
# resource "bunnynet_pullzone_hostname" "devxy-r-binaries" {
|
|
# pullzone = bunnynet_pullzone.devxy-r-binaries.id
|
|
# name = "cran.devxy.io"
|
|
# force_ssl = true
|
|
# tls_enabled = true
|
|
# }
|
|
|
|
### cran.rpkgs.com
|
|
|
|
locals {
|
|
rpkgs_slots = [
|
|
for pair in setproduct(
|
|
["amd64", "arm64"],
|
|
["resolute", "noble", "jammy", "rhel8", "rhel9", "rhel10", "alpine323", "alpine324"]
|
|
) : "${pair[0]}/${pair[1]}"
|
|
]
|
|
|
|
# The supported R minors: the current one plus the two previous, which is
|
|
# exactly what build-env-images installs as R_VERSION_LATEST / PREV1 / PREV2.
|
|
# These must stay in step. A minor listed here without a published index
|
|
# sends those clients to a 404; a published minor missing from this list
|
|
# sends them to CRAN for sources instead of serving the binaries we built.
|
|
rpkgs_supported_minors = ["4.4", "4.5", "4.6"]
|
|
|
|
# bunny.net serves every pull zone on <name>.b-cdn.net, so staging needs no
|
|
# DNS record and is never advertised.
|
|
rpkgs_test_hostname = "cran-rpkgs-test.b-cdn.net"
|
|
}
|
|
|
|
# The edge middleware that resolves the bare cran.rpkgs.com form to an
|
|
# <arch>/<os> slot and routes PACKAGES* to the per-R-minor slot. The source of
|
|
# truth is edge/rpkgs-router.ts; `tofu apply` publishes a new release.
|
|
#
|
|
# The script pre-dates this configuration, so it is adopted rather than created:
|
|
# tofu import bunnynet_compute_script.rpkgs_router 29277
|
|
resource "bunnynet_compute_script" "rpkgs_router" {
|
|
type = "middleware"
|
|
name = "rpkgs-router"
|
|
content = file("${path.module}/edge/rpkgs-router.ts")
|
|
}
|
|
|
|
# Slots ("<arch>/<os>", comma separated) whose per-minor index bincraft has
|
|
# already republished as a union of the per-minor and flat slots. Routing to a
|
|
# slot that is not listed here would hide every package the per-minor index does
|
|
# not carry, so this stays empty until a slot has been backfilled.
|
|
resource "bunnynet_compute_script_variable" "rpkgs_router_union_slots" {
|
|
script = bunnynet_compute_script.rpkgs_router.id
|
|
name = "UNION_SLOTS"
|
|
# Enabled. Until this was set, every client resolved against the generic
|
|
# index and never reached a per-minor binary: an R 4.6.1 client on resolute
|
|
# downloaded the 4.5-built rlang (2079570 bytes) while the correct 4.6 build
|
|
# (2075106 bytes) sat unused one directory away, and died at load with
|
|
# `undefined symbol: SETLENGTH`.
|
|
#
|
|
# Verified before enabling, against the staging zone with the same script and
|
|
# the same origin: all 16 slots report zero regressions against the generic
|
|
# slot, an excluded R minor is sent to CRAN, a client without an R minor
|
|
# still gets the generic index, and tarball requests are never rewritten.
|
|
default_value = join(",", local.rpkgs_slots)
|
|
required = false
|
|
}
|
|
|
|
resource "bunnynet_compute_script_variable" "rpkgs_router_known_minors" {
|
|
script = bunnynet_compute_script.rpkgs_router.id
|
|
name = "KNOWN_MINORS"
|
|
default_value = join(",", local.rpkgs_supported_minors)
|
|
required = false
|
|
}
|
|
|
|
resource "bunnynet_pullzone" "cran_rpkgs_com" {
|
|
name = "cran-rpkgs"
|
|
|
|
cache_errors = false
|
|
|
|
cache_expiration_time = 31919000
|
|
websockets_enabled = false
|
|
errorpage_whitelabel = true
|
|
|
|
origin {
|
|
type = "OriginUrl"
|
|
url = "https://devxy-rpkgs-binaries.s3.eu-central-003.backblazeb2.com"
|
|
middleware_script = bunnynet_compute_script.rpkgs_router.id
|
|
}
|
|
|
|
routing {
|
|
filters = [
|
|
"scripting",
|
|
]
|
|
}
|
|
|
|
s3_auth_enabled = true
|
|
s3_auth_key = var.B2_S3_ACCESS_KEY
|
|
s3_auth_secret = var.B2_S3_SECRET_KEY
|
|
s3_auth_region = "eu-central-003"
|
|
|
|
cache_enabled = true
|
|
request_coalescing_enabled = true
|
|
block_post_requests = true
|
|
|
|
# Set on the zone since before this configuration existed; declared here so
|
|
# `tofu apply` stops silently removing it.
|
|
#
|
|
# The router makes it redundant on paper: the only UA-dependent responses it
|
|
# produces are redirects, and those carry `Cache-Control: no-store`, while
|
|
# their targets are concrete per-slot, per-minor URLs whose content depends
|
|
# only on the path. Dropping it would also be a real win, because otherwise
|
|
# every distinct R version string keys its own copy of every tarball.
|
|
#
|
|
# It stays for now anyway: it is the second line of defence against the one
|
|
# failure that would be quiet and confusing (an R 4.6 client served the 4.5
|
|
# index), and removing it is worth doing on its own once per-minor routing is
|
|
# confirmed live, not as a side effect of enabling that routing.
|
|
cache_vary_headers = ["User-Agent"]
|
|
|
|
limit_requests = 5000
|
|
limit_connections = 1000
|
|
|
|
safehop_enabled = true
|
|
|
|
add_canonical_header = true
|
|
|
|
# Access logs feed the public download statistics (`stats/`, published to
|
|
# `/stats/downloads.json`). Both settings were already on; declaring them
|
|
# keeps an apply from quietly switching off the only source of that data.
|
|
# Bunny keeps the logs for three days, which is why `download-stats` runs on
|
|
# a schedule. IPs stay anonymized to /24 (/64 for IPv6) at the edge.
|
|
log_enabled = true
|
|
log_anonymized = true
|
|
log_anonymized_style = "OneDigit"
|
|
|
|
# The rpkgs.com website reads `/stats/downloads.json` from the browser, so
|
|
# JSON needs the CORS header too. The rest is the zone's existing list.
|
|
cors_enabled = true
|
|
cors_extensions = [
|
|
"css", "eot", "gif", "jpeg", "jpg", "js", "json", "mp3", "mp4", "mpeg", "png", "svg", "ttf", "webm", "webp",
|
|
"woff", "woff2",
|
|
]
|
|
|
|
cache_stale = ["offline", "updating"]
|
|
|
|
block_ips = var.cdn_block_ips
|
|
|
|
# 50 TB
|
|
limit_bandwidth = 50000000000000
|
|
|
|
# permacache_storagezone = bunnynet_storage_zone.devxy-r-binaries.id
|
|
|
|
# rec from docs: https://www.backblaze.com/docs/cloud-storage-integrate-bunnynet-with-backblaze-b2
|
|
block_root_path = true
|
|
}
|
|
|
|
resource "bunnynet_pullzone_hostname" "cran_rpkgs_com" {
|
|
pullzone = bunnynet_pullzone.cran_rpkgs_com.id
|
|
name = "cran.rpkgs.com"
|
|
force_ssl = true
|
|
tls_enabled = true
|
|
}
|
|
|
|
### Staging zone for edge-router changes
|
|
|
|
# Every published <arch>/<os> slot. The staging zone enables per-minor routing
|
|
# for all of them at once; production adopts the same list only after
|
|
# `scripts/verify-r-minor-routing.sh --live` passes against staging.
|
|
|
|
# A second copy of the same router, bound to the same B2 origin, so UNION_SLOTS
|
|
# can be exercised end to end before production is touched.
|
|
resource "bunnynet_compute_script" "rpkgs_router_test" {
|
|
type = "middleware"
|
|
name = "rpkgs-router-test"
|
|
content = file("${path.module}/edge/rpkgs-router.ts")
|
|
}
|
|
|
|
resource "bunnynet_compute_script_variable" "rpkgs_router_test_union_slots" {
|
|
script = bunnynet_compute_script.rpkgs_router_test.id
|
|
name = "UNION_SLOTS"
|
|
default_value = join(",", local.rpkgs_slots)
|
|
required = false
|
|
}
|
|
|
|
# Without this the staging zone rewrites to PUBLIC_CDN_ORIGIN, so its redirects
|
|
# land on production and the test silently measures the wrong system.
|
|
resource "bunnynet_compute_script_variable" "rpkgs_router_test_extra_hosts" {
|
|
script = bunnynet_compute_script.rpkgs_router_test.id
|
|
name = "EXTRA_PUBLIC_HOSTS"
|
|
default_value = local.rpkgs_test_hostname
|
|
required = false
|
|
}
|
|
|
|
resource "bunnynet_compute_script_variable" "rpkgs_router_test_known_minors" {
|
|
script = bunnynet_compute_script.rpkgs_router_test.id
|
|
name = "KNOWN_MINORS"
|
|
default_value = join(",", local.rpkgs_supported_minors)
|
|
required = false
|
|
}
|
|
|
|
resource "bunnynet_pullzone" "cran_rpkgs_test" {
|
|
name = "cran-rpkgs-test"
|
|
|
|
cache_errors = false
|
|
|
|
cache_expiration_time = 31919000
|
|
websockets_enabled = false
|
|
errorpage_whitelabel = true
|
|
|
|
origin {
|
|
type = "OriginUrl"
|
|
url = "https://devxy-rpkgs-binaries.s3.eu-central-003.backblazeb2.com"
|
|
middleware_script = bunnynet_compute_script.rpkgs_router_test.id
|
|
}
|
|
|
|
routing {
|
|
filters = [
|
|
"scripting",
|
|
]
|
|
}
|
|
|
|
s3_auth_enabled = true
|
|
s3_auth_key = var.B2_S3_ACCESS_KEY
|
|
s3_auth_secret = var.B2_S3_SECRET_KEY
|
|
s3_auth_region = "eu-central-003"
|
|
|
|
cache_enabled = true
|
|
request_coalescing_enabled = true
|
|
block_post_requests = true
|
|
|
|
cache_vary_headers = ["User-Agent"]
|
|
|
|
# Staging carries only synthetic verification traffic, so the production
|
|
# ceilings would be pure headroom.
|
|
limit_requests = 500
|
|
limit_connections = 100
|
|
|
|
safehop_enabled = true
|
|
add_canonical_header = true
|
|
cache_stale = ["offline", "updating"]
|
|
block_ips = var.cdn_block_ips
|
|
|
|
# 1 TB
|
|
limit_bandwidth = 1000000000000
|
|
|
|
block_root_path = true
|
|
}
|
|
|
|
|
|
# Alliance SwissPass historically used a separate, manually configured pull
|
|
# zone. Adopt it so both public repositories use the same B2 origin, middleware
|
|
# release and cache behavior.
|
|
import {
|
|
to = bunnynet_pullzone.cran_allianceswisspass
|
|
id = "3265648"
|
|
}
|
|
|
|
resource "bunnynet_pullzone" "cran_allianceswisspass" {
|
|
name = "cran-allianceswisspass"
|
|
|
|
cache_errors = false
|
|
cache_expiration_time = 31919000
|
|
websockets_enabled = false
|
|
errorpage_whitelabel = true
|
|
|
|
origin {
|
|
type = "OriginUrl"
|
|
url = "https://devxy-rpkgs-binaries.s3.eu-central-003.backblazeb2.com"
|
|
middleware_script = bunnynet_compute_script.rpkgs_router.id
|
|
}
|
|
|
|
routing {
|
|
filters = [
|
|
"scripting",
|
|
]
|
|
}
|
|
|
|
s3_auth_enabled = true
|
|
s3_auth_key = var.B2_S3_ACCESS_KEY
|
|
s3_auth_secret = var.B2_S3_SECRET_KEY
|
|
s3_auth_region = "eu-central-003"
|
|
|
|
cache_enabled = true
|
|
request_coalescing_enabled = true
|
|
block_post_requests = true
|
|
cache_vary_headers = ["User-Agent"]
|
|
|
|
limit_requests = 5000
|
|
limit_connections = 1000
|
|
|
|
safehop_enabled = true
|
|
add_canonical_header = true
|
|
cache_stale = ["offline", "updating"]
|
|
block_ips = var.cdn_block_ips
|
|
|
|
# 50 TB
|
|
limit_bandwidth = 50000000000000
|
|
|
|
block_root_path = true
|
|
}
|
|
|
|
resource "bunnynet_pullzone_hostname" "cran_allianceswisspass" {
|
|
pullzone = bunnynet_pullzone.cran_allianceswisspass.id
|
|
name = "cran.allianceswisspass.devxy.io"
|
|
force_ssl = true
|
|
tls_enabled = true
|
|
}
|
|
|
|
# resource "bunnynet_storage_zone" "devxy-r-binaries" {
|
|
# name = "devxy-r-binaries-storage"
|
|
# region = "DE"
|
|
# zone_tier = "Standard"
|
|
# # Los Angeles and Singapore
|
|
# replication_regions = ["LA", "SG"]
|
|
# }
|