Serving Static Sites with Fastly, S3, and Middleman

In November we announced our partnership with Fastly to power the new HashiCorp releases service. Since then, we have expanded our use of Fastly to front all of our static sites. You may have noticed subtle frontend and backend changes to our various websites - this post details the steps we took to migrate our static sites to Fastly.

Seth Vargo

Jan 26, 2016

Seth Vargo

Update: This article is no out of date. Please refer to this tutorial which remains up to date.

s3cmd \
  --quiet \
  --delete-removed \
  --guess-mime-type \
  --no-mime-magic \
  --acl-public \
  --recursive \
  --add-header="Cache-Control: max-age=31536000" \
  --add-header="x-amz-meta-surrogate-key: site-$PROJECT" \
  sync "$DIR/build/" "s3://&lt;bucket&gt;/$PROJECT/latest/"

curl \
  --fail \
  --silent \
  --output /dev/null \
  --request "POST" \
  --header "Accept: application/json" \
  --header "Fastly-Key: $FASTLY_API_KEY" \
  --header "Fastly-Soft-Purge: 1" \
  "https://api.fastly.com/service/$FASTLY_SERVICE_ID/purge/site-$PROJECT"

wget \
  --recursive \
  --delete-after \
  --level 0 \
  --quiet \
  "https://$PROJECT_URL/"

<bucket>
  \_ <project>
    \_ <version>

<bucket>
  \_ terraform
    \_ latest

if (req.http.host ~ "terraform.io") {
  set req.http.host = "<bucket>.s3-website-us-east-1.amazonaws.com";
  set req.url = "/terraform/latest" req.url;
  return(lookup);
}

terraform.io/(.*) => <bucket>.s3-website-us-east-1.amazonaws.com/terraform/latest/$1

if (beresp.status == 301 || beresp.status == 302) {
  set beresp.http.location = regsub(beresp.http.location, "^/(.+)/latest/", "/");
}

unset beresp.http.x-amz-id-2;
unset beresp.http.x-amz-request-id;
unset beresp.http.x-amz-meta-s3cmd-attrs;
unset beresp.http.server;

if (req.http.host !~ "^www\..+") {
  set req.http.host = "www." req.http.host;
  set req.http.x-varnish-redirect = "https://" req.http.host req.url;
  error 750 req.http.x-varnish-redirect;
}

if (obj.status == 750) {
  set obj.http.location = obj.response;
  set obj.http.Strict-Transport-Security = "max-age=31536000; includeSubdomains; preload";
  set obj.status = 301;
  return (deliver);
}

if (!req.http.Fastly-SSL) {
  error 801 "Force SSL";
}

sub vcl_fetch {
  # ...
  set beresp.http.Strict-Transport-Security = "max-age=31536000; includeSubdomains; preload";
}

set beresp.http.X-XSS-Protection = "1; mode=block";
set beresp.http.X-Content-Type-Options = "nosniff";
set beresp.http.X-Frame-Options = "sameorigin";