feat: Create a tiny binary artifact cache

[Bownairo]

No description provided.

[Bownairo]

An "equivalent" nginx config:

proxy_cache_path /var/upgrade-cache levels=1:2 keys_zone=artifacts:10m
                 max_size=10g inactive=365d use_temp_path=off;

map $request_uri $artifact_hash {
    "~^/(?<h>[0-9a-f]{64})/https?://."    $h;
    default                               "";
}
map $request_uri $artifact_url {
    "~^/[0-9a-f]{64}/(?<u>https?://.+)$"  $u;
    default                               "";
}

server {
    listen [::]:19300 ipv6only=off;

    location / {
        if ($artifact_url != "") { rewrite ^ /_fetch last; }
        default_type text/plain;
        return 400 "usage: GET /hash/URL\n";
    }

    location = /_fetch {
        internal;
        resolver 1.1.1.1 [2606:4700:4700::1111] valid=300s;

        proxy_pass $artifact_url;

        proxy_cache              artifacts;
        proxy_cache_key          $artifact_hash;
        proxy_cache_valid        200 365d;
        proxy_cache_lock         on;
        proxy_cache_lock_timeout 1h;
        proxy_cache_use_stale    error timeout updating http_500 http_502 http_503 http_504;

        proxy_http_version 1.1;
        proxy_set_header   Accept-Encoding "";
        proxy_force_ranges on;

        proxy_ssl_server_name         on;
        proxy_ssl_verify              on;
        proxy_ssl_verify_depth        3;
        proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

        proxy_connect_timeout 15s;
        proxy_read_timeout   300s;
        proxy_send_timeout   300s;

        proxy_hide_header Content-Type;
        add_header Content-Type "application/octet-stream" always;
        add_header X-Cache-Status $upstream_cache_status always;
    }
}