redirect_by_ip.sh

#!/bin/bash

set -eu -o pipefail

MASTER="archive.ubuntu.com"

TMPDIR=$(mktemp -d -t redirect_by_ip)

GPG_SIG="ubuntu-archive-keyring.gpg.sig"
GPG_SIG_PATH="ubuntu/project/$GPG_SIG"
curl -Ss "http://$MASTER/$GPG_SIG_PATH" -o "$TMPDIR/$GPG_SIG"

# see https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html
IP_RANGES="ip-ranges.json"
curl -sS https://ip-ranges.amazonaws.com/ip-ranges.json -o "$TMPDIR/$IP_RANGES"

for region in $(jq --raw-output '.prefixes | map(select(.service=="EC2").region) | unique | sort[]' < "$TMPDIR/$IP_RANGES"); do
  export region # so jq can read it

  # check for a file on a regional server rather than trusting DNS, alone
  target="$region.ec2.archive.ubuntu.com"
  if ( \
      curl -sS "http://$target/$GPG_SIG_PATH" -o "$TMPDIR/$GPG_SIG-$region" && \
      diff "$TMPDIR/$GPG_SIG" "$TMPDIR/$GPG_SIG-$region" > /dev/null \
  ); then
    echo "# Rewrite for $target"
    echo "RewriteEngine on"
    for ip in $(jq --raw-output '.prefixes[] | select(.region==env.region) .ip_prefix' < "$TMPDIR/$IP_RANGES"); do
      echo "RewriteCond expr \"-R '${ip}'\""
    done
    echo "RewriteRule ^/(.*) \"http://$target/\$1\" [R,L]"
    echo
  fi
done