Skip to content

Commit 7da69c1

Browse files
davlgddavlgd
committed
Update cache.md
1 parent 707d5fa commit 7da69c1

File tree

1 file changed

+139
-0
lines changed

1 file changed

+139
-0
lines changed

‎content/doc/administrate/cache.md‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,145 @@ To enable it, create a `varnish.vcl` file in the `/clevercloud` folder. You can
2727
The `vcl 4.1;` and backend section of the `varnish.vcl` configuration file are not necessary as they are already handled by Clever Cloud.
2828
If you have a PHP FTP application or if your `varnish.vcl` file is on an FS Bucket, make sure you redeploy the application for the changes to take effect.
2929

30+
## Varnish to restrict access to your application
31+
32+
### Block IP addresses
33+
34+
```bash {filename="clevercloud/varnish.vcl"}
35+
sub vcl_recv {
36+
# Local health check
37+
if (client.ip == "127.0.0.1" && !req.http.X-Forwarded-For) {
38+
return (synth(200, "OK"));
39+
}
40+
41+
# We don't rely on client.ip which send the load balancer IP address
42+
# We check if the IP to block is included in the Forwarded header instead
43+
if (req.http.Forwarded ~ "X.X.X.X") {
44+
return (synth(403, "Blocked"));
45+
}
46+
47+
# Use return (hash); to use the cache
48+
return (pass);
49+
}
50+
51+
sub vcl_synth {
52+
if (resp.status == 403) {
53+
set resp.http.Content-Type = "text/plain";
54+
synthetic("Access denied");
55+
return (deliver);
56+
}
57+
}
58+
```
59+
60+
Replace `X.X.X.X` with the IP address you want to block.
61+
62+
If you want to block multiple IP addresses, you can use a regular expression like this:
63+
64+
```bash
65+
if (req.http.Forwarded ~ "^(X.X.X.X|Y.Y.Y.Y|Z.Z.Z.Z)$") {
66+
return (synth(403, "Blocked"));
67+
}
68+
```
69+
70+
To be able to configure with an environment variable multiple IPs to block, CIDR, exceptions, etc. use the following example:
71+
72+
- [Varnish IP blocking with environment variable](https://github.com/CleverCloud/varnish-examples/blob/main/varnish-ip-blocking/varnish.vcl)
73+
74+
### Ask for a login/password (Basic authentication)
75+
76+
```bash {filename="clevercloud/varnish.vcl"}
77+
sub vcl_recv {
78+
# Local health check
79+
if (client.ip == "127.0.0.1" && !req.http.X-Forwarded-For) {
80+
return (synth(200, "OK"));
81+
}
82+
83+
if (!req.http.Authorization) {
84+
return (synth(401, "Authentication Required"));
85+
}
86+
87+
if (req.http.Authorization !~ "^Basic ") {
88+
return (synth(401, "Basic Authentication Required"));
89+
}
90+
91+
set req.http.X-Auth-Credentials = regsub(req.http.Authorization, "^Basic ", "");
92+
93+
if (req.http.X-Auth-Credentials != "CREDENTIALS") {
94+
return (synth(401, "Valid Basic Authentication Required"));
95+
}
96+
}
97+
98+
sub vcl_synth {
99+
if (resp.status == 200) {
100+
set resp.http.Content-Type = "text/plain";
101+
synthetic("OK");
102+
return (deliver);
103+
}
104+
105+
if (resp.status == 401) {
106+
set resp.http.Content-Type = "text/html; charset=utf-8";
107+
set resp.http.WWW-Authenticate = "Basic realm='Restricted Area'";
108+
synthetic("<html><body><h1>Authentication Required</h1></body></html>");
109+
110+
return (deliver);
111+
}
112+
113+
# Use return (hash); to use the cache
114+
return (pass);
115+
}
116+
```
117+
118+
The `CREDENTIALS` string should be replaced with the base64 encoded value of `username:password`. You can use the following command to generate it on UNIX-based systems:
119+
120+
```bash
121+
echo -n "username:password" | base64
122+
```
123+
124+
### Bearer token authentication
125+
126+
```bash {filename="clevercloud/varnish.vcl"}
127+
import env;
128+
129+
sub vcl_recv {
130+
# Local health check
131+
if (client.ip == "127.0.0.1" && !req.http.X-Forwarded-For) {
132+
return (synth(200, "OK"));
133+
}
134+
135+
if (!req.http.Authorization) {
136+
return (synth(401, "Authentication Required"));
137+
}
138+
139+
if (req.http.Authorization !~ "^Bearer ") {
140+
return (synth(401, "Bearer token Required"));
141+
}
142+
143+
set req.http.X-Token = regsub(req.http.Authorization, "^Bearer ", "");
144+
145+
if (req.http.X-Token != env.get("CC_VARNISH_BEARER_TOKEN")) {
146+
return (synth(401, "Valid Bearer token Required"));
147+
}
148+
149+
# Use return (hash); to use the cache
150+
return (pass);
151+
}
152+
153+
sub vcl_synth {
154+
if (resp.status == 200) {
155+
set resp.http.Content-Type = "text/plain";
156+
synthetic("OK");
157+
return (deliver);
158+
}
159+
160+
if (resp.status == 401) {
161+
set resp.http.Content-Type = "text/html; charset=utf-8";
162+
synthetic("<html><body><h1>Authentication Required</h1></body></html>");
163+
164+
return (deliver);
165+
}
166+
}
167+
```
168+
30169
## Listen on the right port
31170
32171
Once varnish is enabled, your application should no longer listen on port **8080**, but on port **8081**. Because it's Varnish that will listen on port **8080**, and it will have in its configuration your application as backend.

0 commit comments

Comments
 (0)