deploy proxies with pulumi

Author: karelnagel

.gitignore

@@ -55,4 +55,5 @@ rlog
 qlog.zst
 rlog.zst
 build
-user-content/
+user-content/
+.env

bun.lock

@@ -0,0 +1,5 @@
+encryptionsalt: v1:J3UB8fjbyNQ=:v1:KyaeCMJV7KuyU3lR:CYhKg5G3uz4x0rjolHQX+Ay/A17X0A==
+config:
+  cloudflare:apiKey:
+    secure: v1:hA/5FY74pHl9BMx9:78l3m77aaDqLpy3kJFZWU2OuFyr80MLnJsDIhvFgyj80YlzFNHVQANP4JGlSuP/hG7VOwOo=
+  cloudflare:email: nagelkarel@gmail.com

infra/Pulumi.prod.yaml

@@ -0,0 +1,12 @@
+name: asius
+description: Asius
+backend:
+  url: s3://asius-pulumi?endpoint=558df022e422781a34f239d7de72c8ae.r2.cloudflarestorage.com
+runtime:
+  name: nodejs
+  options:
+    packagemanager: bun
+config:
+  pulumi:tags:
+    value:
+      pulumi:template: typescript

infra/Pulumi.yaml

@@ -0,0 +1,43 @@
+import * as cloudflare from '@pulumi/cloudflare'
+
+const ACCOUNT_ID = '558df022e422781a34f239d7de72c8ae'
+const ZONE_ID = '9dbe2445beeb3c44e991656fada0231c'
+
+const PROXIES = [
+  { original: 'api.konik.ai', proxy: 'konik-proxy.new-connect.dev' },
+  { original: 'athena.comma.ai', proxy: 'athena-proxy.new-connect.dev' },
+  { original: 'billing.comma.ai', proxy: 'billing-proxy.new-connect.dev' },
+]
+
+for (const { original, proxy } of PROXIES) {
+  const name = proxy.replaceAll('.new-connect.dev', '')
+  const konikProxy = new cloudflare.WorkersScript(name, {
+    accountId: ACCOUNT_ID,
+    scriptName: name,
+    mainModule: 'index.js',
+    content: `
+export default {
+  fetch: async (request) => {
+    if (request.method === 'OPTIONS') return new Response(null, { status: 204, headers: HEADERS })
+
+    const url = new URL(request.url)
+    const response = await fetch(new Request('https://${original}' + url.pathname + url.search, request))
+    const res = new Response(response.body, response)
+    res.headers.set('Access-Control-Allow-Origin', '*')
+    res.headers.set('Access-Control-Allow-Methods', '*')
+    res.headers.set('Access-Control-Allow-Headers', 'Content-Type, User-Agent, Authorization')
+    res.headers.set('Access-Control-Max-Age', '86400')
+    return res
+  },
+}`,
+  })
+
+  new cloudflare.WorkersCustomDomain(`${name}-domain`, {
+    accountId: ACCOUNT_ID,
+    hostname: proxy,
+    service: konikProxy.scriptName,
+    zoneId: ZONE_ID,
+  })
+}
+
+export const projects = {}

infra/index.ts

@@ -49,6 +49,9 @@
     "@ffmpeg/ffmpeg": "^0.12.15",
     "@ffmpeg/util": "^0.12.2",
     "@mapbox/polyline": "^1.2.1",
+    "@pulumi/cloudflare": "^6.12.0",
+    "@pulumi/hcloud": "^1.29.0",
+    "@pulumi/pulumi": "^3.213.0",
     "@remotion/cli": "4.0.373",
     "@remotion/player": "4.0.373",
     "@remotion/tailwind": "4.0.373",

package.json

@@ -3,10 +3,10 @@ import { z } from 'zod'
 const zString = (def?: string) => (def ? z.string().default(def) : z.string())
 
 export const Environment = z.object({
-  ATHENA_URL: zString('https://athena.new-connect.dev'), // Needed cause athena.comma.ai restricts CORS
+  ATHENA_URL: zString('https://athena-proxy.new-connect.dev'), // Needed cause athena.comma.ai restricts CORS
   API_URL: zString('https://api.comma.ai'),
   AUTH_URL: zString('https://api.comma.ai'),
-  BILLING_URL: zString('https://billing.new-connect.dev'), // Needed cause billing.comma.ai restricts CORS
+  BILLING_URL: zString('https://billing-proxy.new-connect.dev'), // Needed cause billing.comma.ai restricts CORS
   USERADMIN_URL: zString('https://useradmin.comma.ai'),
   RENDERER_URL: zString('https://renderer.new-connect.dev'),
   TEMPLATES_URL: zString('https://templates.new-connect.dev'),