resource "google_storage_bucket" "website" {
  name     = "yourwebsite.tld"
  location = "EUROPE-WEST1"

  versioning {
    enabled = false
  }

  website {
    main_page_suffix = "index.html"
    not_found_page   = "404.html"
  }
}

resource "google_storage_bucket_iam_member" "website" {
  bucket = google_storage_bucket.website.name
  role   = "roles/storage.objectViewer"
  member = "allUsers"
}

gsutil -m setmeta -h "Cache-Control: public, max-age=300" "gs://yourwebsite.tld/**"

# ...

http_archive(
    name = "rules_nixpkgs",
    sha256 = "7aee35c95251c1751e765f7da09c3bb096d41e6d6dca3c72544781a5573be4aa",
    strip_prefix = "rules_nixpkgs-0.8.0",
    urls = ["https://github.com/tweag/rules_nixpkgs/archive/v0.8.0.tar.gz"],
)

load("@rules_nixpkgs//nixpkgs:repositories.bzl", "rules_nixpkgs_dependencies")

rules_nixpkgs_dependencies()

nixpkgs_local_repository(
    name = "nixpkgs",
    nix_file = "//:bazel-nixpkgs.nix",
    # ^ This might be the topic of another blog.
    nix_file_deps = [
        # ...
    ],
)

nixpkgs_package(
    name = "gcloud",
    attribute_path = "google-cloud-sdk",
    build_file = "//:BUILD.gcloud.bazel",
    repository = "@nixpkgs",
)

package(default_visibility = ["//visibility:public"])

# ...

alias(
    name = "gsutil",
    actual = "bin/gsutil",
)

def _cloud_storage_sync_impl(ctx):
    output_file = ctx.actions.declare_file(ctx.label.name)

    script_path = ctx.attr.script[DefaultInfo].files.to_list()[0].short_path
    gsutil_path = ctx.attr.gsutil[DefaultInfo].files.to_list()[0].short_path

    ctx.actions.write(
        output = output_file,
        is_executable = True,
        content = " ".join([
            script_path,
            gsutil_path,
            ctx.attr.bucket,
            ctx.label.package,
        ] + [
            target.short_path
            for group in ctx.attr.files
            for target in group[DefaultInfo].files.to_list()
        ]),
    )

    runfiles = ctx.runfiles(files = ctx.files.files + ctx.files.script + ctx.files.gsutil)

    return [DefaultInfo(executable = output_file, runfiles = runfiles)]

cloud_storage_sync = rule(
    _cloud_storage_sync_impl,
    attrs = dict(
        bucket = attr.string(),
        files = attr.label_list(
            allow_files = True,
        ),
        script = attr.label(
            default = Label("//bazel:cloud_storage_sync.sh"),
            allow_files = True,
        ),
        gsutil = attr.label(
            default = Label("@gcloud//:gsutil"),
            allow_files = True,
        ),
    ),
    executable = True,
)

#!/usr/bin/env bash

set -euo pipefail

prepare_directory() {
    local dir="$1"; shift
    local prefix="$1"; shift

    for path in "$@"; do
        stripped_path="$(sed -e "s@^${prefix}/@@" <<<"${path}")"
        subdir="$(dirname "${stripped_path}")"
        mkdir -p "${dir}/${subdir}"
        cp --dereference "${path}" "${dir}/${stripped_path}"
    done
}

# Only cache for 5 minutes on Google's edge servers. CloudFlare takes care of
# most of the caching, but we still need to be able to cache the files for a
# little while, otherwise CloudFlare is forced to hit Google on every request.
fix_cache_control() {
    local gsutil="$1"; shift
    local bucket="$1"; shift

    "${gsutil}" -m setmeta \
        -h "Cache-Control: public, max-age=300" \
        "gs://${bucket}/**"
}

upload() {
    local gsutil="$1"; shift
    local bucket="$1"; shift
    local prefix="$1"; shift

    dir="$(mktemp -d)"
    prepare_directory "${dir}" "${prefix}" "$@"

    "${gsutil}" -m rsync -d -r "${dir}" "gs://${bucket}/"

    fix_cache_control "${gsutil}" "${bucket}"

    rm -rf "${dir}"
}

upload "$@"

load("//bazel:gcloud.bzl", "cloud_storage_sync")

# ...

webpack(
    name = "frontend",
    outs = [
        "index.html",
        # ...
    ],
    # ...
)

cloud_storage_sync(
    name = "deploy",
    bucket = "yourwebsite.tld",
    files = [":frontend"],
)