| terraform { |
| required_version = ">= 1.5" |
| required_providers { |
| aws = { source = "hashicorp/aws", version = "~> 6.0" } |
| } |
| } |
|
|
| resource "aws_security_group" "endpoint" { |
| name_prefix = "xet-privatelink-" |
| description = "Xet upload endpoints" |
| vpc_id = var.vpc_id |
|
|
| ingress { |
| from_port = 443 |
| to_port = 443 |
| protocol = "tcp" |
| cidr_blocks = var.client_cidr_blocks |
| } |
|
|
| egress { |
| from_port = 0 |
| to_port = 0 |
| protocol = "-1" |
| cidr_blocks = ["0.0.0.0/0"] |
| } |
|
|
| tags = var.tags |
| } |
|
|
| # --- hf CLI upload path ----------------------------------------------------- |
|
|
| # Created in pendingAcceptance. We accept by hand, so this blocks until we do. |
| resource "aws_vpc_endpoint" "cas" { |
| count = var.cas_service_name == null ? 0 : 1 |
|
|
| vpc_id = var.vpc_id |
| service_name = var.cas_service_name |
| service_region = var.service_region |
| vpc_endpoint_type = "Interface" |
| subnet_ids = var.subnet_ids |
| security_group_ids = [aws_security_group.endpoint.id] |
| private_dns_enabled = false |
|
|
| timeouts { |
| create = "30m" |
| } |
|
|
| tags = var.tags |
| } |
|
|
| resource "aws_route53_zone" "xethub" { |
| count = var.cas_service_name == null ? 0 : 1 |
|
|
| name = "xethub.hf.co" |
|
|
| vpc { |
| vpc_id = var.vpc_id |
| } |
|
|
| tags = var.tags |
| } |
|
|
| resource "aws_route53_record" "cas_server" { |
| count = var.cas_service_name == null ? 0 : 1 |
|
|
| zone_id = aws_route53_zone.xethub[0].zone_id |
| name = "cas-server.xethub.hf.co" |
| type = "CNAME" |
| ttl = 60 |
| records = [aws_vpc_endpoint.cas[0].dns_entry[0].dns_name] |
| } |
|
|
| # --- S3 API path ------------------------------------------------------------ |
|
|
| resource "aws_vpc_endpoint" "s3_gateway" { |
| count = var.s3_service_name == null ? 0 : 1 |
|
|
| vpc_id = var.vpc_id |
| service_name = var.s3_service_name |
| service_region = var.service_region |
| vpc_endpoint_type = "Interface" |
| subnet_ids = coalesce(var.s3_subnet_ids, var.subnet_ids) |
| security_group_ids = [aws_security_group.endpoint.id] |
| private_dns_enabled = false |
|
|
| timeouts { |
| create = "30m" |
| } |
|
|
| tags = var.tags |
| } |
|
|
| resource "aws_route53_zone" "s3" { |
| count = var.s3_service_name == null ? 0 : 1 |
|
|
| name = "s3.hf.co" |
|
|
| vpc { |
| vpc_id = var.vpc_id |
| } |
|
|
| tags = var.tags |
| } |
|
|
| # s3.hf.co is the zone apex, where a CNAME is not allowed. Alias instead. |
| resource "aws_route53_record" "s3" { |
| count = var.s3_service_name == null ? 0 : 1 |
|
|
| zone_id = aws_route53_zone.s3[0].zone_id |
| name = "s3.hf.co" |
| type = "A" |
|
|
| alias { |
| name = aws_vpc_endpoint.s3_gateway[0].dns_entry[0].dns_name |
| zone_id = aws_vpc_endpoint.s3_gateway[0].dns_entry[0].hosted_zone_id |
| evaluate_target_health = false |
| } |
| } |
|
|
