399 lines
9.6 KiB
Plaintext
399 lines
9.6 KiB
Plaintext
|
|
vcl 4.1;
|
|
|
|
import vsthrottle;
|
|
import std;
|
|
|
|
# ===== BACKEND =====
|
|
backend app {
|
|
.host = "app";
|
|
.port = "${APP_PORT}";
|
|
}
|
|
|
|
# ===== ACL =====
|
|
acl purge {
|
|
"127.0.0.1";
|
|
"::1";
|
|
}
|
|
|
|
# ===== RECV =====
|
|
sub vcl_recv {
|
|
# Wewnętrzne znaczniki - nie ufamy wartościom od klienta
|
|
unset req.http.X-Varnish-CS-Mode;
|
|
unset req.http.X-Varnish-CS-Entry;
|
|
|
|
# Rate limit: 200 / 10s, blokada 60s
|
|
if (vsthrottle.is_denied(client.identity, 200, 10s, 60s)) {
|
|
return (synth(429, "Too Many Requests"));
|
|
}
|
|
|
|
# PURGE tylko lokalnie
|
|
if (req.method == "PURGE") {
|
|
if (!client.ip ~ purge) {
|
|
return (synth(405, "Not allowed"));
|
|
}
|
|
return (purge);
|
|
}
|
|
|
|
if (!req.http.X-Forwarded-Proto) {
|
|
set req.http.X-Forwarded-Proto = "https";
|
|
}
|
|
|
|
# Healthcheck / internal
|
|
if (req.url == "/healthcheck" || req.http.X-Internal-Check) {
|
|
return (pass);
|
|
}
|
|
|
|
# WebSocket / socket.io
|
|
if (req.http.Upgrade ~ "(?i)websocket" ||
|
|
req.url ~ "^/socket.io/") {
|
|
return (pipe);
|
|
}
|
|
|
|
# Metody inne niż GET/HEAD
|
|
if (req.method != "GET" && req.method != "HEAD") {
|
|
return (pass);
|
|
}
|
|
|
|
# Authorization
|
|
if (req.http.Authorization) {
|
|
return (pass);
|
|
}
|
|
|
|
# Accept-Encoding
|
|
if (req.http.Accept-Encoding) {
|
|
if (req.http.Accept-Encoding ~ "zstd") {
|
|
set req.http.Accept-Encoding = "zstd";
|
|
} else if (req.http.Accept-Encoding ~ "br") {
|
|
set req.http.Accept-Encoding = "br";
|
|
} else if (req.http.Accept-Encoding ~ "gzip") {
|
|
set req.http.Accept-Encoding = "gzip";
|
|
} else {
|
|
set req.http.Accept-Encoding = "identity";
|
|
}
|
|
}
|
|
|
|
# Statyczne zasoby
|
|
if (req.url ~ "^/static/" ||
|
|
req.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)(\?.*)?$") {
|
|
unset req.http.Cookie;
|
|
return (hash);
|
|
}
|
|
|
|
return (hash);
|
|
}
|
|
|
|
# ===== PIPE =====
|
|
sub vcl_pipe {
|
|
if (req.http.Upgrade) {
|
|
set bereq.http.Upgrade = req.http.Upgrade;
|
|
set bereq.http.Connection = req.http.Connection;
|
|
}
|
|
}
|
|
|
|
# ===== HASH =====
|
|
sub vcl_hash {
|
|
hash_data(req.url);
|
|
|
|
if (req.http.host) {
|
|
hash_data(req.http.host);
|
|
} else {
|
|
hash_data(server.ip);
|
|
}
|
|
|
|
if (req.http.Cookie) {
|
|
hash_data(req.http.Cookie);
|
|
}
|
|
|
|
if (req.http.Accept-Encoding) {
|
|
hash_data(req.http.Accept-Encoding);
|
|
}
|
|
|
|
if (req.http.X-Accept-Image) {
|
|
hash_data(req.http.X-Accept-Image);
|
|
}
|
|
|
|
return (lookup);
|
|
}
|
|
|
|
# ===== CACHE STATUS: HIT =====
|
|
sub vcl_hit {
|
|
# Zawartość świeża lub serwowana z grace
|
|
if (obj.ttl >= 0s || obj.ttl + obj.grace > 0s) {
|
|
set req.http.X-Varnish-CS-Mode = "hit";
|
|
} else {
|
|
# Obiekt wygasł i wymaga pobrania
|
|
set req.http.X-Varnish-CS-Mode = "stale";
|
|
}
|
|
|
|
# Dalsze decyzje pozostawiamy builtin VCL
|
|
}
|
|
|
|
# ===== CACHE STATUS: MISS =====
|
|
sub vcl_miss {
|
|
if (req.http.X-Varnish-CS-Mode != "stale") {
|
|
set req.http.X-Varnish-CS-Mode = "miss";
|
|
}
|
|
}
|
|
|
|
# ===== CACHE STATUS: PASS =====
|
|
sub vcl_pass {
|
|
if (req.method != "GET" && req.method != "HEAD") {
|
|
set req.http.X-Varnish-CS-Mode = "method";
|
|
} else {
|
|
set req.http.X-Varnish-CS-Mode = "bypass";
|
|
}
|
|
}
|
|
|
|
# ===== BACKEND FETCH =====
|
|
sub vcl_backend_fetch {
|
|
# Nie przekazujemy znaczników do aplikacji
|
|
unset bereq.http.X-Varnish-CS-Mode;
|
|
unset bereq.http.X-Varnish-CS-Entry;
|
|
}
|
|
|
|
# ===== BACKEND RESPONSE =====
|
|
sub vcl_backend_response {
|
|
# Zabezpieczenie wewnętrznych nagłówków
|
|
unset beresp.http.X-Varnish-CS-Detail;
|
|
unset beresp.http.X-Varnish-Local-Error;
|
|
|
|
# Respektuj no-store / private
|
|
if (beresp.http.Cache-Control ~ "(?i)no-store|private") {
|
|
set beresp.uncacheable = true;
|
|
set beresp.ttl = 0s;
|
|
set beresp.http.X-Varnish-CS-Detail = "uncacheable";
|
|
return (deliver);
|
|
}
|
|
|
|
# Redirecty bez cache
|
|
if (beresp.status >= 300 && beresp.status < 400) {
|
|
set beresp.uncacheable = true;
|
|
set beresp.ttl = 0s;
|
|
set beresp.http.X-Varnish-CS-Detail = "redirect";
|
|
return (deliver);
|
|
}
|
|
|
|
# Statyczne: cache tylko HTTP 200
|
|
if (bereq.url ~ "^/static/" ||
|
|
bereq.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)(\?.*)?$") {
|
|
if (beresp.status != 200) {
|
|
set beresp.uncacheable = true;
|
|
set beresp.ttl = 0s;
|
|
set beresp.http.X-Varnish-CS-Detail = "invalid-static-status";
|
|
return (deliver);
|
|
}
|
|
}
|
|
|
|
# HTML zamiast JS/CSS - nie cache'uj
|
|
if (bereq.url ~ "\.(js|css)(\?.*)?$" &&
|
|
beresp.http.Content-Type ~ "(?i)text/html") {
|
|
set beresp.uncacheable = true;
|
|
set beresp.ttl = 0s;
|
|
set beresp.http.X-Varnish-CS-Detail = "html-instead-of-static";
|
|
return (deliver);
|
|
}
|
|
|
|
# Content-Type przy brakującym nagłówku
|
|
if (bereq.url ~ "\.js(\?.*)?$" &&
|
|
!beresp.http.Content-Type) {
|
|
set beresp.http.Content-Type =
|
|
"application/javascript; charset=utf-8";
|
|
}
|
|
|
|
if (bereq.url ~ "\.css(\?.*)?$" &&
|
|
!beresp.http.Content-Type) {
|
|
set beresp.http.Content-Type =
|
|
"text/css; charset=utf-8";
|
|
}
|
|
|
|
# ===== STATYCZNE =====
|
|
if (bereq.url ~ "^/static/" ||
|
|
bereq.url ~ "\.(css|js|png|jpe?g|webp|svg|ico|woff2?)(\?.*)?$") {
|
|
|
|
unset beresp.http.Set-Cookie;
|
|
|
|
# Usuń Vary: Cookie
|
|
if (beresp.http.Vary) {
|
|
set beresp.http.Vary = regsuball(
|
|
beresp.http.Vary,
|
|
"(?i)(^|,)[[:space:]]*Cookie[[:space:]]*(,|$)",
|
|
"\1"
|
|
);
|
|
|
|
set beresp.http.Vary = regsuball(
|
|
beresp.http.Vary, ",[[:space:]]*,", ","
|
|
);
|
|
|
|
set beresp.http.Vary = regsub(
|
|
beresp.http.Vary, "^[[:space:]]*,[[:space:]]*", ""
|
|
);
|
|
|
|
set beresp.http.Vary = regsub(
|
|
beresp.http.Vary, "[[:space:]]*,[[:space:]]*$", ""
|
|
);
|
|
|
|
if (beresp.http.Vary ~ "^[[:space:]]*$") {
|
|
unset beresp.http.Vary;
|
|
}
|
|
}
|
|
|
|
if (!(beresp.http.Cache-Control ~ "(?i)(s-maxage|max-age)")) {
|
|
set beresp.ttl = 24h;
|
|
set beresp.http.Cache-Control =
|
|
"public, max-age=86400, immutable";
|
|
}
|
|
|
|
set beresp.grace = 1h;
|
|
set beresp.keep = 24h;
|
|
}
|
|
|
|
# ===== TTL =====
|
|
if (beresp.http.Cache-Control ~ "(?i)s-maxage=([0-9]+)") {
|
|
set beresp.ttl = std.duration(
|
|
regsub(
|
|
beresp.http.Cache-Control,
|
|
"(?i).*s-maxage=([0-9]+).*",
|
|
"\1"
|
|
) + "s", 0s
|
|
);
|
|
} else if (beresp.http.Cache-Control ~ "(?i)max-age=([0-9]+)") {
|
|
set beresp.ttl = std.duration(
|
|
regsub(
|
|
beresp.http.Cache-Control,
|
|
"(?i).*max-age=([0-9]+).*",
|
|
"\1"
|
|
) + "s", 0s
|
|
);
|
|
} else if (beresp.http.Expires) {
|
|
set beresp.ttl = std.time(beresp.http.Expires, now) - now;
|
|
|
|
if (beresp.ttl < 0s) {
|
|
set beresp.ttl = 0s;
|
|
}
|
|
} else {
|
|
if (beresp.ttl <= 0s) {
|
|
set beresp.ttl = 60s;
|
|
}
|
|
}
|
|
|
|
if (beresp.http.Cache-Control ~ "(?i)immutable") {
|
|
set beresp.grace = 1h;
|
|
set beresp.keep = 24h;
|
|
}
|
|
|
|
# ===== GZIP =====
|
|
if (!beresp.http.Content-Encoding &&
|
|
bereq.http.Accept-Encoding ~ "gzip") {
|
|
|
|
if (beresp.http.Content-Type ~
|
|
"(?i)text/|application/(javascript|json|xml)") {
|
|
set beresp.do_gzip = true;
|
|
}
|
|
}
|
|
|
|
# ===== STREAMING =====
|
|
if (beresp.http.Content-Length &&
|
|
std.integer(beresp.http.Content-Length, 0) > 1048576) {
|
|
set beresp.do_stream = true;
|
|
}
|
|
}
|
|
|
|
# ===== BACKEND ERROR =====
|
|
sub vcl_backend_error {
|
|
# Odpowiedź wygenerowana lokalnie - bez Cache-Status
|
|
set beresp.http.X-Varnish-Local-Error = "1";
|
|
return (deliver);
|
|
}
|
|
|
|
# ===== DELIVER: RFC 9211 =====
|
|
sub vcl_deliver {
|
|
unset req.http.X-Varnish-CS-Entry;
|
|
|
|
# Nie oznaczamy lokalnych błędów jako odpowiedzi backendu
|
|
if (!resp.http.X-Varnish-Local-Error) {
|
|
|
|
# HIT - również stale/grace dostarczony z cache
|
|
if (req.http.X-Varnish-CS-Mode == "hit") {
|
|
set req.http.X-Varnish-CS-Entry = "varnish; hit";
|
|
|
|
# TTL jako integer, również ujemny
|
|
set req.http.X-Varnish-CS-Entry =
|
|
req.http.X-Varnish-CS-Entry +
|
|
"; ttl=" +
|
|
std.real2integer(std.real(obj.ttl, 0.0), 0);
|
|
|
|
# MISS / STALE - pobranie z backendu
|
|
} else if (req.http.X-Varnish-CS-Mode == "miss" ||
|
|
req.http.X-Varnish-CS-Mode == "stale") {
|
|
|
|
set req.http.X-Varnish-CS-Entry =
|
|
"varnish; fwd=" + req.http.X-Varnish-CS-Mode;
|
|
|
|
if (!obj.uncacheable && obj.ttl > 0s) {
|
|
set req.http.X-Varnish-CS-Entry =
|
|
req.http.X-Varnish-CS-Entry + "; stored";
|
|
|
|
set req.http.X-Varnish-CS-Entry =
|
|
req.http.X-Varnish-CS-Entry +
|
|
"; ttl=" +
|
|
std.real2integer(std.real(obj.ttl, 0.0), 0);
|
|
}
|
|
|
|
# PASS / metoda wymagająca forwardowania
|
|
} else if (req.http.X-Varnish-CS-Mode == "bypass" ||
|
|
req.http.X-Varnish-CS-Mode == "method") {
|
|
|
|
set req.http.X-Varnish-CS-Entry =
|
|
"varnish; fwd=" + req.http.X-Varnish-CS-Mode;
|
|
}
|
|
|
|
# Opcjonalny detail z backend_response
|
|
if (req.http.X-Varnish-CS-Entry &&
|
|
resp.http.X-Varnish-CS-Detail) {
|
|
set req.http.X-Varnish-CS-Entry =
|
|
req.http.X-Varnish-CS-Entry +
|
|
"; detail=" + resp.http.X-Varnish-CS-Detail;
|
|
}
|
|
|
|
# RFC 9211: zachowaj wpisy poprzednich cache
|
|
if (req.http.X-Varnish-CS-Entry) {
|
|
if (resp.http.Cache-Status) {
|
|
set resp.http.Cache-Status =
|
|
resp.http.Cache-Status + ", " +
|
|
req.http.X-Varnish-CS-Entry;
|
|
} else {
|
|
set resp.http.Cache-Status =
|
|
req.http.X-Varnish-CS-Entry;
|
|
}
|
|
}
|
|
}
|
|
|
|
# Czyszczenie wewnętrznych nagłówków
|
|
unset resp.http.X-Varnish-CS-Detail;
|
|
unset resp.http.X-Varnish-Local-Error;
|
|
unset resp.http.X-Pass-Reason;
|
|
unset resp.http.X-Cache;
|
|
|
|
# Age zachowujemy dla odpowiedzi z cache
|
|
if (obj.uncacheable || obj.hits == 0) {
|
|
unset resp.http.Age;
|
|
}
|
|
|
|
unset resp.http.Via;
|
|
unset resp.http.X-Varnish;
|
|
unset resp.http.Server;
|
|
}
|
|
|
|
# ===== SYNTH =====
|
|
sub vcl_synth {
|
|
# RFC 9211: bez Cache-Status dla lokalnych odpowiedzi
|
|
unset resp.http.Cache-Status;
|
|
unset resp.http.X-Cache;
|
|
}
|
|
|
|
# ===== PURGE =====
|
|
sub vcl_purge {
|
|
return (synth(200, "Purged"));
|
|
}
|