Use wasabi instead of linode, with caching

misskey-service.nix

@@ -84,11 +84,19 @@ in {
   in {
     enable = true;
     recommendedProxySettings = true;
+    package = pkgs.openresty;
 
     upstreams."misskey".extraConfig = ''
       server unix:/var/run/misskey/misskey.sock;
     '';
 
+    proxyCachePath."egirls_media_cache" = {
+      enable = true;
+      maxSize = "1g";
+      inactive = "10m";
+      keysZoneName = "egirls_media_cache";
+    };
+
     virtualHosts."media.egirls.gay" = {
       inherit listen;
 
@@ -97,28 +105,42 @@ in {
 
       extraConfig = ''
         client_max_body_size 1m;
+        proxy_cache media_cache;
+        proxy_cache_valid 200 10m;
+        proxy_cache_lock on;
+
+        proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
+        proxy_hide_header X-Amz-ID-2;
+        proxy_hide_header X-Amz-Request-ID;
+        proxy_hide_header X-Wasabi-CM-Reference-ID;
+
+        proxy_hide_header      Set-Cookie;
+        proxy_ignore_headers   Set-Cookie;
       '';
 
       locations."/".extraConfig = ''
-        set $bucket rub-um5oh2ac4yi9c2mf.misskey.egirls.gay;
+        return 404;
-        set $region us-east-1;
-
-        proxy_pass https://storage.us-east-1.linodeobjects.com;
-        proxy_set_header Host $bucket.us-east-1.linodeobjects.com;
-        proxy_http_version 1.1;
-        proxy_redirect off;
-        proxy_intercept_errors on;
-        error_page 400 401 403 404 406 409 410 /404;
-
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto https;
-
-        proxy_cache off;
       '';
 
-      locations."/404".extraConfig = ''
+      locations."/misskey/".extraConfig = ''
-        return 404 "not found";
+        proxy_http_version 1.1;
+
+        include /etc/nixos-secrets/s3-access-nginx.conf;
+
+        set $s3_bucket 'egirls-gay-misskey';
+        set $path_full '/$s3_bucket$request_uri';
+
+        set_by_lua $now "return ngx.http_time(ngx.time())";
+        set $signature_string "GET\n\n\n\nx-amz-date:''${now}\n$path_full";
+        set_hmac_sha1 $s3_signature $s3_secret $signature_string;
+        set_encode_base64 $s3_signature_b64 $s3_signature;
+
+        proxy_set_header x-amz-date $now;
+        proxy_set_header Authorization "AWS $s3_access:$s3_signature_b64";
+
+        proxy_ssl_session_reuse on;
+        rewrite .* $path_full break;
+        proxy_pass https://s3.us-west-1.wasabisys.com;
       '';
     };