feat(users/grfn/web): Purge cloudflare cache on deploy

Change-Id: Iebaff500bc7bbb92ff4344f185a3b446f9ce9eb9
Reviewed-on: https://cl.tvl.fyi/c/depot/+/9975
Autosubmit: grfn <grfn@gws.fyi>
Reviewed-by: grfn <grfn@gws.fyi>
Tested-by: BuildkiteCI

users/grfn/web/Makefile

@@ -1,7 +1,13 @@
-.PHONY: deploy
+.PHONY: deploy purge_cf do_deploy renew backup open
+
+deploy: do_deploy purge_cf
+
+purge_cf:
+	@$(shell nix-build `git rev-parse --show-toplevel` -A 'users.grfn.web.purge-cf')/bin/purge-cf.sh
+
+do_deploy:
+	@$(shell nix-build `git rev-parse --show-toplevel` -A 'users.grfn.web')/bin/deploy.sh
 
-deploy:
-	@$(shell nix-build `git rev-parse --show-toplevel` -A 'users.grfn.web')
 
 renew:
 	@echo Renewing...

users/grfn/web/default.nix

@@ -28,10 +28,34 @@ let
       cp ${keys} $out/keys
     '';
 
+  purge-cf = writeShellApplication {
+    name = "purge-cf.sh";
+    runtimeInputs = [ httpie jq pass ];
+    text = ''
+      cfapi() {
+        http \
+          "https://api.cloudflare.com/client/v4/$1" \
+          X-Auth-Email:root@gws.fyi \
+          "X-Auth-Key: $(pass cloudflare-api-key)" \
+          "''${@:2}"
+      }
+
+      zone_id=$(
+        cfapi zones \
+          | jq -r '.result[] | select(.name == "gws.fyi") | .id'
+      )
+
+      cfapi "zones/$zone_id/purge_cache" purge_everything:=true
+    '';
+  };
 in
-(writeShellScript "deploy.sh" ''
+(writeShellApplication {
-  ${awscli2}/bin/aws --profile personal s3 sync ${website}/ ${bucket}
+  name = "deploy.sh";
-  echo "Deployed to http://gws.fyi"
+  runtimeInputs = [ awscli2 ];
-'') // {
+  text = ''
-  inherit website site;
+    aws --profile personal s3 sync ${website}/ ${bucket}
+    echo "Deployed to http://gws.fyi"
+  '';
+}).overrideAttrs {
+  passthru = { inherit website site purge-cf; };
 }

users/grfn/web/shell.nix

@@ -3,7 +3,7 @@ mkShell {
   buildInputs = [
     awscli
     gnumake
-    letsencrypt
     tarsnap
+    certbot
   ];
 }