Varnish

# This is the vcl.conf file for andromeda.motd.be 
 
backend default {
     .host = "208.68.209.225";
     .port = "80";
}
 
#
# handling of request that are received from clients.
# decide whether or not to lookup data in the cache first.
# if we have multiple backends, we could specify them here but for now there is just the default
#
sub vcl_recv {
     # If the client sent an X-Forwarded-For header, remove it. It cannot be trusted.
     unset req.http.X-Forwarded-For;
     # Note that we don't need to add the client ip to the X-Forwarded-For header, varnish will do that for us
 
     if (req.http.Accept-Encoding) {
          # Handle compression correctly. Varnish treats headers literally, not
          # semantically. So it is very well possible that there are cache misses
          # because the headers sent by different browsers aren't the same.
          # @see: http:// varnish.projects.linpro.no/wiki/FAQ/Compression
          if (req.http.Accept-Encoding ~ "gzip") {
               # if the browser supports it, we'll use gzip
               set req.http.Accept-Encoding = "gzip";
          } elsif (req.http.Accept-Encoding ~ "deflate") {
               # next, try deflate if it is supported
               set req.http.Accept-Encoding = "deflate";
          } else {
               # unknown algorithm. Probably junk, remove it
               unset req.http.Accept-Encoding;
          }
     }
 
     # If we get a request for a page that has just been requested by another thread and
     # is still being fetched from the backend, allow serving a cached page so long as it hasn't
     # expired more than 30 seconds ago (prevents thread pileup on cache refreshes).
     # Note that this only works if obj.grace is also set:
     #     "If no in-ttl object was found AND we have a graced object AND it is also
     #      graced by req.grace AND it is being fetched: serve the graced object."
     set req.grace = 30s;
 
     # the default vcl_recv will only look up objects in the cache if there is no cookie
     # present in the request. Therefor, we remove the cookie header from all requests for
     # files which we know to be static.
     #
     # These are drupal-specific:
     # - everything in most of the standard drupal directories.
     # - txt and ico files (most important: robots.txt and favicon.ico)
     if (req.url ~ "^/(files|misc|sites|themes|modules)/" || req.url ~ "\.(txt|ico)$") {
         unset req.http.Cookie; 
     }
 
     # No final action. Continues in the default vcl_recv which will only look up
     # items from the cache for GET and HEAD requests without cookies.
}
 
#
# Called when entering pipe mode
#
sub vcl_pipe {
     # If we don't set the Connection: close header, any following
     # requests from the client will also be piped through and
     # left untouched by varnish. We don't want that.
     set req.http.connection = "close";
 
     # Note: no "pipe" action here - we'll fall back to the default
     # pipe method so that when any changes are made there, we
     # still inherit them.
}
 
#
# Called when the requested object has been retrieved from the
# backend, or the request to the backend has failed
#
sub vcl_fetch {
     if (obj.http.Pragma ~ "no-cache" || obj.http.Cache-Control ~ "(no-cache|no-store|private)") {
          # varnish by default ignores Pragma and Cache-Control headers. It
          # only looks at the "max-age=" value in the Cache-Control header to
          # determine the TTL. So we need this rule so that the cache respects
          # the wishes of the backend application.
          pass;
     }
 
     if (obj.ttl < 180s) {
          # force minimum ttl of 3 minutes for all cached objects.
          set obj.ttl = 180s;
     }
 
     # set the grace period for this object to a maximum of 30s. This is how
     # long after its expire time, it is still allowed to be served from cache if
     # directed to do so by vcl_recv. 
     set obj.grace = 30s;
 
     if (req.http.Authorization && !obj.http.Cache-Control ~ "public") {
          # don't allow caching pages that are protected by basic authentication
          # unless when they explicitly set the cache-control to public.
          pass;
     }
 
     # Note: no final action - continue in the default vcl_fetch
}

# configuration file for andromeda
 
backend default {
     set backend.host = "208.68.209.225";
     set backend.port = "80";       
}
 
#
# Block unwanted clients
#
acl blacklisted {
     "192.168.100.100";
}
 
#
# handling of request that are received from clients.
# decide whether or not to lookup data in the cache first.
#
sub vcl_recv {
     # reject malicious requests
     call vcl_recv_sentry;
 
     if (req.request != "GET" && req.request != "HEAD" && req.request != "PUT" && req.request != "POST" && req.request != "TRACE" && req.request != "OPTIONS" && req.request != "DELETE") {
         # Non-RFC2616 or CONNECT which is weird.
         pipe;
     }
     if (req.http.Expect) {
         # Expect is just too hard at present. 
         pipe;
     }
     if (req.request != "GET" && req.request != "HEAD") {
          # we only deal with GET and HEAD
          # note that we need to use "pipe" instead of "pass" here. Pass isn't supported for
          # POST requests
          pipe;
     }
     if (req.http.Authorization) {
         # don't cache pages that are protected by basic authentication
         pass;
     }
     if (req.http.Accept-Encoding) {
         # Handle compression correctly. Varnish treats headers literally, not
         # semantically. So it is very well possible that there are cache misses
         # because the headers sent by different browsers aren't the same.
         # For more info: http:// varnish.projects.linpro.no/wiki/FAQ/Compression
         if (req.http.Accept-Encoding ~ "gzip") {
              # if the browser supports it, we'll use gzip
              set req.http.Accept-Encoding = "gzip";
         } elsif (req.http.Accept-Encoding ~ "deflate") {
              # next, try deflate if it is supported
              set req.http.Accept-Encoding = "deflate";
         } else {
              # unknown algorithm. Probably junk, remove it
              remove req.http.Accept-Encoding;
         }
     }
     if (req.url ~ "\.(jpg|jpeg|gif|png|css|js)$") {
         # allow caching of all images and css/javascript files
         lookup;
     }
     if (req.url ~ "^/files") {
         # anything in drupals files directory is static and may be cached 
         lookup;
     }
     if (req.http.Cookie) {
         # Not cacheable by default
         # TODO: do we even need this? Can't we simply make sure dynamic
         # content never exists in the cache?
         pass;
     }
 
     # every thing else we try to look up in the cache first
     lookup;
}
 
#
# Called when entering pipe mode
#
#sub vcl_pipe {
#     pipe;
#}
 
#
# Called when entering pass mode
#
#sub vcl_pass {
#     pass;
#}
 
#
# Called when entering an object into the cache
#
#sub vcl_hash {
#     set req.hash += req.url;
#     if (req.http.host) {
#          set req.hash += req.http.host;
#     } else {
#          set req.hash += req.http.host;
#     }
#     hash;
#}
 
#
# Called when the requested object was found in the cache
#
sub vcl_hit {
     if (!obj.cacheable) {
         # A response is considered cacheable if all of the following are true:
         # - it is valid
         # - HTTP status code is 200, 203, 300, 301, 302, 404 or 410
         # - it has a non-zero time-to-live when Expires and Cache-Control headers are taken into account.
         pass;
     }
     deliver;
}
 
#
# Called when the requested object was not found in the cache
#
#sub vcl_miss {
#     fetch;
#}
 
#
# Called when the requested object has been retrieved from the
# backend, or the request to the backend has failed
#
sub vcl_fetch {
     if (!obj.valid) {
         # don't cache invalid responses.
         error;
     }
     if (!obj.cacheable) {
         # A response is considered cacheable if all of the following are true:
         # - it is valid
         # - HTTP status code is 200, 203, 300, 301, 302, 404 or 410
         # - it has a non-zero time-to-live when Expires and Cache-Control headers are taken into account.
         #
         # If a response is not cachable, simply pass it along to the client.
         pass;
     }
     if (obj.http.Set-Cookie) {
         # don't cache content that sets cookies (eg dynamic PHP pages).
         pass;
     }
     if (obj.http.Pragma ~ "no-cache" || obj.http.Cache-Control ~ "no-cache" || obj.http.Cache-Control ~ "private") {
         # varnish by default ignores Pragma and Cache-Control headers. It
         # only looks at the "max-age=" value in the Cache-Control header to
         # determine the TTL. So we need this rule so that the cache respects
         # the wishes of the backend application.
         pass;
     }
     if (obj.ttl < 180s) {
         # force minimum ttl of 180 seconds for all cached objects.
         set obj.ttl = 180s;
     }
     insert;
}
 
#
# Called before a cached object is delivered to the client
#
#sub vcl_deliver {
#     deliver;
#}
 
#
# Called when an object nears its expiry time
#
#sub vcl_timeout {
#     discard;
#}
 
#
# Called when an object is about to be discarded
#
#sub vcl_discard {
#     discard;
#}
 
#
# Custom routine to detect malicious requests and reject them (called by vcl_recv).
#
sub vcl_recv_sentry {
     if (client.ip ~ blacklisted) {
          error 503 "Your IP has been blocked.";
     }
}