From 9fab8046f6a62d6810312bd0efc773a72d02798a Mon Sep 17 00:00:00 2001
From: gru <gru@gitea.linuxiarz.pl>
Date: Wed, 25 Feb 2026 15:10:48 +0100
Subject: [PATCH] Update deploy/varnish/default.vcl.template

---
 deploy/varnish/default.vcl.template | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/deploy/varnish/default.vcl.template b/deploy/varnish/default.vcl.template
index 907d716..e797693 100644
--- a/deploy/varnish/default.vcl.template
+++ b/deploy/varnish/default.vcl.template
@@ -97,7 +97,7 @@ sub vcl_hash {
   if (req.http.X-Accept-Image) { hash_data(req.http.X-Accept-Image); }
 }
 
-# ===== BACKEND_RESPONSE (POPRAWIONE: TTL PRIORYTET) =====
+# ===== BACKEND_RESPONSE =====
 sub vcl_backend_response {
   # Zakaz cache – respektujemy
   if (beresp.http.Cache-Control ~ "(?i)no-store|private") {
@@ -131,7 +131,7 @@ sub vcl_backend_response {
     return (deliver);
   }
 
-  # Wymuś Content-Type dla static
+  # Wymuś Content-Type
   if (bereq.url ~ "\\.js(\\?.*)?$") {
     if (!beresp.http.Content-Type || beresp.http.Content-Type ~ "(?i)text/html") {
       set beresp.http.Content-Type = "application/javascript; charset=utf-8";
@@ -143,7 +143,7 @@ sub vcl_backend_response {
     }
   }
 
-  # ---- PARSONANIE TTL (PRZED STATIC! - NAJPRAWDOPODOBNIEJ) ----
+  # ---- PARSONANIE TTL (PRZED STATIC!) ----
   if (beresp.http.Cache-Control ~ "(?i)s-maxage=([0-9]+)") {
     set beresp.ttl = std.duration(regsub(beresp.http.Cache-Control, "(?i).*s-maxage=([0-9]+).*", "\\1") + "s", 0s);
   } else if (beresp.http.Cache-Control ~ "(?i)max-age=([0-9]+)") {
@@ -155,20 +155,23 @@ sub vcl_backend_response {
     if (beresp.ttl <= 0s) { set beresp.ttl = 60s; }
   }
 
-  # ---- STATYCZNE: TYLKO jeśli brak Cache-Control z backendu ----
+  # ---- STATYCZNE (ulepszone Vary) ----
   if (bereq.url ~ "^/static/" || bereq.url ~ "\\.(css|js|png|jpe?g|webp|svg|ico|woff2?)$") {
     unset beresp.http.Set-Cookie;
 
-    # Lepsze czyszczenie Vary (Cookie + Accept-Encoding)
+    # CZYSZCZENIE VARY: usuwa \1 Cookie, Accept-Encoding
     if (beresp.http.Vary) {
-      set beresp.http.Vary = regsuball(beresp.http.Vary, "(?i)(^|,)[[:space:]]*(Cookie|Accept-Encoding)[[:space:]]*(,|$)", "\\1");
+      set beresp.http.Vary = regsuball(beresp.http.Vary, "\\\\1[[:space:]]*(,|$)", ",");
+      set beresp.http.Vary = regsuball(beresp.http.Vary, "(?i)(^|,)[[:space:]]*(Cookie|Accept-Encoding)[[:space:]]*(,|$)", ",");
       set beresp.http.Vary = regsuball(beresp.http.Vary, ",[[:space:]]*,", ",");
       set beresp.http.Vary = regsub(beresp.http.Vary, "^[[:space:]]*,[[:space:]]*", "");
       set beresp.http.Vary = regsub(beresp.http.Vary, "[[:space:]]*,[[:space:]]*$", "");
-      if (beresp.http.Vary ~ "^[[:space:]]*$") { unset beresp.http.Vary; }
+      if (beresp.http.Vary ~ "^[[:space:]]*$|^$") { 
+        unset beresp.http.Vary; 
+      }
     }
 
-    # TTL TYLKO jeśli backend NIE podał s-maxage/max-age
+    # TTL TYLKO jeśli backend NIE ma s-maxage/max-age
     if (!(beresp.http.Cache-Control ~ "(?i)(s-maxage|max-age)")) {
       set beresp.ttl = 24h;
       set beresp.http.Cache-Control = "public, max-age=86400, immutable";