feat: add archive infrastructure for EOL distribution packages

ansible/files/Caddyfile

@@ -48,3 +48,35 @@ yum.{$DOMAIN_NAME} {
 		redir https://storage.googleapis.com/{$GCLOUD_BUCKET_PREFIX}-server-edition-yum-repo/versions/{$YUM_LATEST_VERSION}/public{uri}
 	}
 }
+
+apt-archive.{$DOMAIN_NAME} {
+	tls {
+		dns azure {
+			tenant_id {$AZURE_TENANT_ID}
+			subscription_id {$AZURE_SUBSCRIPTION_ID}
+			resource_group_name fullstaq-ruby-infra-maintainers
+			client_id {$AZURE_DNS_UPDATER_CLIENT_ID}
+			client_secret {$AZURE_DNS_UPDATER_CLIENT_SECRET}
+		}
+	}
+	encode gzip
+	handle {
+		redir https://storage.googleapis.com/{$GCLOUD_BUCKET_PREFIX}-server-edition-apt-repo-archive/versions/{$APT_ARCHIVE_LATEST_VERSION}/public{uri}
+	}
+}
+
+yum-archive.{$DOMAIN_NAME} {
+	tls {
+		dns azure {
+			tenant_id {$AZURE_TENANT_ID}
+			subscription_id {$AZURE_SUBSCRIPTION_ID}
+			resource_group_name fullstaq-ruby-infra-maintainers
+			client_id {$AZURE_DNS_UPDATER_CLIENT_ID}
+			client_secret {$AZURE_DNS_UPDATER_CLIENT_SECRET}
+		}
+	}
+	encode gzip
+	handle {
+		redir https://storage.googleapis.com/{$GCLOUD_BUCKET_PREFIX}-server-edition-yum-repo-archive/versions/{$YUM_ARCHIVE_LATEST_VERSION}/public{uri}
+	}
+}

ansible/files/query-latest-repo-versions.rb

@@ -6,12 +6,15 @@ def main
   open_io(ARGV[0]) do |io|
     query_repo_version('apt', io)
     query_repo_version('yum', io)
+    query_repo_version('apt-archive', io, suffix: '-archive')
+    query_repo_version('yum-archive', io, suffix: '-archive')
     io.puts "REPO_QUERY_TIME=#{Time.now.to_f}"
   end
 end
 
-def query_repo_version(type, output)
-  uri = URI("https://storage.googleapis.com/#{require_env(:GCLOUD_BUCKET_PREFIX)}-server-edition-#{type}-repo/versions/latest_version.txt")
+def query_repo_version(type, output, suffix: '')
+  bucket_type = type.gsub('-archive', '')
+  uri = URI("https://storage.googleapis.com/#{require_env(:GCLOUD_BUCKET_PREFIX)}-server-edition-#{bucket_type}-repo#{suffix}/versions/latest_version.txt")
 
   STDERR.puts "Querying #{uri}..."
   req = Net::HTTP::Get.new(uri)
@@ -22,11 +25,21 @@ def query_repo_version(type, output)
   end
 
   if resp.code.to_i / 100 != 2
+    # Archive bucket may legitimately not exist before the first migration runs.
+    # Only treat 404 as the "not yet populated" case; any other non-2xx
+    # (auth, 5xx, redirects) is a real failure and must surface — silently
+    # falling back to version 0 would point clients at /versions/0/... 404s.
+    if suffix != '' && resp.code.to_i == 404
+      STDERR.puts "Warning: #{type} repo not found (404), skipping"
+      output.puts "#{type.upcase.gsub('-', '_')}_LATEST_VERSION=0"
+      return
+    end
     abort("Failed to query #{uri}: #{resp.code} #{resp.body}")
   end
 
+  env_key = type.upcase.gsub('-', '_')
   STDERR.puts "#{type} latest version: #{resp.body}"
-  output.puts "#{type.upcase}_LATEST_VERSION=#{resp.body}"
+  output.puts "#{env_key}_LATEST_VERSION=#{resp.body}"
 end
 
 def open_io(path)

terraform/dns.tf

@@ -149,3 +149,75 @@ resource "azurerm_dns_aaaa_record" "yum" {
   records             = [var.backend_server_ipv6]
   ttl                 = 86400
 }
+
+
+resource "azurerm_dns_zone" "apt-archive" {
+  name                = "apt-archive.${var.dns_name}"
+  resource_group_name = "fullstaq-ruby-infra-maintainers"
+}
+
+resource "azurerm_role_assignment" "caddy-update-dns-apt-archive" {
+  scope                = azurerm_dns_zone.apt-archive.id
+  role_definition_name = "DNS Zone Contributor"
+  principal_id         = azuread_service_principal.caddy.object_id
+}
+
+resource "azurerm_dns_ns_record" "apt-archive" {
+  name                = "apt-archive"
+  zone_name           = azurerm_dns_zone.website.name
+  resource_group_name = azurerm_dns_zone.website.resource_group_name
+  ttl                 = 86400
+  records             = azurerm_dns_zone.apt-archive.name_servers
+}
+
+resource "azurerm_dns_a_record" "apt-archive" {
+  name                = "@"
+  zone_name           = azurerm_dns_zone.apt-archive.name
+  resource_group_name = azurerm_dns_zone.apt-archive.resource_group_name
+  records             = [var.backend_server_ipv4]
+  ttl                 = 86400
+}
+
+resource "azurerm_dns_aaaa_record" "apt-archive" {
+  name                = "@"
+  zone_name           = azurerm_dns_zone.apt-archive.name
+  resource_group_name = azurerm_dns_zone.apt-archive.resource_group_name
+  records             = [var.backend_server_ipv6]
+  ttl                 = 86400
+}
+
+
+resource "azurerm_dns_zone" "yum-archive" {
+  name                = "yum-archive.${var.dns_name}"
+  resource_group_name = "fullstaq-ruby-infra-maintainers"
+}
+
+resource "azurerm_role_assignment" "caddy-update-dns-yum-archive" {
+  scope                = azurerm_dns_zone.yum-archive.id
+  role_definition_name = "DNS Zone Contributor"
+  principal_id         = azuread_service_principal.caddy.object_id
+}
+
+resource "azurerm_dns_ns_record" "yum-archive" {
+  name                = "yum-archive"
+  zone_name           = azurerm_dns_zone.website.name
+  resource_group_name = azurerm_dns_zone.website.resource_group_name
+  ttl                 = 86400
+  records             = azurerm_dns_zone.yum-archive.name_servers
+}
+
+resource "azurerm_dns_a_record" "yum-archive" {
+  name                = "@"
+  zone_name           = azurerm_dns_zone.yum-archive.name
+  resource_group_name = azurerm_dns_zone.yum-archive.resource_group_name
+  records             = [var.backend_server_ipv4]
+  ttl                 = 86400
+}
+
+resource "azurerm_dns_aaaa_record" "yum-archive" {
+  name                = "@"
+  zone_name           = azurerm_dns_zone.yum-archive.name
+  resource_group_name = azurerm_dns_zone.yum-archive.resource_group_name
+  records             = [var.backend_server_ipv6]
+  ttl                 = 86400
+}

terraform/repo_buckets.tf

@@ -38,3 +38,32 @@ resource "google_storage_bucket_iam_binding" "server-edition-yum-repo-writable-b
   role    = "roles/storage.objectAdmin"
   members = ["principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github-ci-deploy.name}/attribute.repository/fullstaq-ruby/server-edition"]
 }
+
+resource "google_storage_bucket" "server-edition-apt-repo-archive" {
+  depends_on                  = [google_project_service.storage-api]
+  name                        = "${var.gcloud_bucket_prefix}-server-edition-apt-repo-archive"
+  force_destroy               = true
+  uniform_bucket_level_access = true
+  location                    = var.gcloud_storage_location
+}
+
+resource "google_storage_bucket_iam_binding" "server-edition-apt-repo-archive-public-viewable" {
+  bucket  = google_storage_bucket.server-edition-apt-repo-archive.self_link
+  role    = "roles/storage.objectViewer"
+  members = ["allUsers"]
+}
+
+
+resource "google_storage_bucket" "server-edition-yum-repo-archive" {
+  depends_on                  = [google_project_service.storage-api]
+  name                        = "${var.gcloud_bucket_prefix}-server-edition-yum-repo-archive"
+  force_destroy               = true
+  uniform_bucket_level_access = true
+  location                    = var.gcloud_storage_location
+}
+
+resource "google_storage_bucket_iam_binding" "server-edition-yum-repo-archive-public-viewable" {
+  bucket  = google_storage_bucket.server-edition-yum-repo-archive.self_link
+  role    = "roles/storage.objectViewer"
+  members = ["allUsers"]
+}