# configuration file for andromeda
 
backend default {
     set backend.host = "208.68.209.225";
     set backend.port = "80";       
}
 
#
# Block unwanted clients
#
acl blacklisted {
     "192.168.100.100";
}
 
#
# handling of request that are received from clients.
# decide whether or not to lookup data in the cache first.
#
sub vcl_recv {
     # reject malicious requests
     call vcl_recv_sentry;
 
     if (req.request != "GET" && req.request != "HEAD" && req.request != "PUT" && req.request != "POST" && req.request != "TRACE" && req.request != "OPTIONS" && req.request != "DELETE") {
         # Non-RFC2616 or CONNECT which is weird.
         pipe;
     }
     if (req.http.Expect) {
         # Expect is just too hard at present. 
         pipe;
     }
     if (req.request != "GET" && req.request != "HEAD") {
          # we only deal with GET and HEAD
          # note that we need to use "pipe" instead of "pass" here. Pass isn't supported for
          # POST requests
          pipe;
     }
     if (req.http.Authorization) {
         # don't cache pages that are protected by basic authentication
         pass;
     }
     if (req.http.Accept-Encoding) {
         # Handle compression correctly. Varnish treats headers literally, not
         # semantically. So it is very well possible that there are cache misses
         # because the headers sent by different browsers aren't the same.
         # For more info: http:// varnish.projects.linpro.no/wiki/FAQ/Compression
         if (req.http.Accept-Encoding ~ "gzip") {
              # if the browser supports it, we'll use gzip
              set req.http.Accept-Encoding = "gzip";
         } elsif (req.http.Accept-Encoding ~ "deflate") {
              # next, try deflate if it is supported
              set req.http.Accept-Encoding = "deflate";
         } else {
              # unknown algorithm. Probably junk, remove it
              remove req.http.Accept-Encoding;
         }
     }
     if (req.url ~ "\.(jpg|jpeg|gif|png|css|js)$") {
         # allow caching of all images and css/javascript files
         lookup;
     }
     if (req.url ~ "^/files") {
         # anything in drupals files directory is static and may be cached 
         lookup;
     }
     if (req.http.Cookie) {
         # Not cacheable by default
         # TODO: do we even need this? Can't we simply make sure dynamic
         # content never exists in the cache?
         pass;
     }
 
     # every thing else we try to look up in the cache first
     lookup;
}
 
#
# Called when entering pipe mode
#
#sub vcl_pipe {
#     pipe;
#}
 
#
# Called when entering pass mode
#
#sub vcl_pass {
#     pass;
#}
 
#
# Called when entering an object into the cache
#
#sub vcl_hash {
#     set req.hash += req.url;
#     if (req.http.host) {
#          set req.hash += req.http.host;
#     } else {
#          set req.hash += req.http.host;
#     }
#     hash;
#}
 
#
# Called when the requested object was found in the cache
#
sub vcl_hit {
     if (!obj.cacheable) {
         # A response is considered cacheable if all of the following are true:
         # - it is valid
         # - HTTP status code is 200, 203, 300, 301, 302, 404 or 410
         # - it has a non-zero time-to-live when Expires and Cache-Control headers are taken into account.
         pass;
     }
     deliver;
}
 
#
# Called when the requested object was not found in the cache
#
#sub vcl_miss {
#     fetch;
#}
 
#
# Called when the requested object has been retrieved from the
# backend, or the request to the backend has failed
#
sub vcl_fetch {
     if (!obj.valid) {
         # don't cache invalid responses.
         error;
     }
     if (!obj.cacheable) {
         # A response is considered cacheable if all of the following are true:
         # - it is valid
         # - HTTP status code is 200, 203, 300, 301, 302, 404 or 410
         # - it has a non-zero time-to-live when Expires and Cache-Control headers are taken into account.
         #
         # If a response is not cachable, simply pass it along to the client.
         pass;
     }
     if (obj.http.Set-Cookie) {
         # don't cache content that sets cookies (eg dynamic PHP pages).
         pass;
     }
     if (obj.http.Pragma ~ "no-cache" || obj.http.Cache-Control ~ "no-cache" || obj.http.Cache-Control ~ "private") {
         # varnish by default ignores Pragma and Cache-Control headers. It
         # only looks at the "max-age=" value in the Cache-Control header to
         # determine the TTL. So we need this rule so that the cache respects
         # the wishes of the backend application.
         pass;
     }
     if (obj.ttl < 180s) {
         # force minimum ttl of 180 seconds for all cached objects.
         set obj.ttl = 180s;
     }
     insert;
}
 
#
# Called before a cached object is delivered to the client
#
#sub vcl_deliver {
#     deliver;
#}
 
#
# Called when an object nears its expiry time
#
#sub vcl_timeout {
#     discard;
#}
 
#
# Called when an object is about to be discarded
#
#sub vcl_discard {
#     discard;
#}
 
#
# Custom routine to detect malicious requests and reject them (called by vcl_recv).
#
sub vcl_recv_sentry {
     if (client.ip ~ blacklisted) {
          error 503 "Your IP has been blocked.";
     }
}