Skip to content

Commit 930e980

Browse files
davlgddavlgd
committed
Update cache.md
1 parent db1dce6 commit 930e980

File tree

1 file changed

+139
-0
lines changed

1 file changed

+139
-0
lines changed

‎content/doc/administrate/cache.md‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,145 @@ To enable it, create a `varnish.vcl` file in the `/clevercloud` folder. You can
2929
The `vcl 4.1;` and backend section of the `varnish.vcl` configuration file are not necessary as they are already handled by Clever Cloud.
3030
If you have a PHP FTP application or if your `varnish.vcl` file is on an FS Bucket, make sure you redeploy the application for the changes to take effect.
3131

32+
## Varnish to restrict access to your application
33+
34+
### Block IP addresses
35+
36+
```bash {filename="clevercloud/varnish.vcl"}
37+
sub vcl_recv {
38+
# Local health check
39+
if (client.ip == "127.0.0.1" && !req.http.X-Forwarded-For) {
40+
return (synth(200, "OK"));
41+
}
42+
43+
# We don't rely on client.ip which send the load balancer IP address
44+
# We check if the IP to block is included in the Forwarded header instead
45+
if (req.http.Forwarded ~ "X.X.X.X") {
46+
return (synth(403, "Blocked"));
47+
}
48+
49+
# Use return (hash); to use the cache
50+
return (pass);
51+
}
52+
53+
sub vcl_synth {
54+
if (resp.status == 403) {
55+
set resp.http.Content-Type = "text/plain";
56+
synthetic("Access denied");
57+
return (deliver);
58+
}
59+
}
60+
```
61+
62+
Replace `X.X.X.X` with the IP address you want to block.
63+
64+
If you want to block multiple IP addresses, you can use a regular expression like this:
65+
66+
```bash
67+
if (req.http.Forwarded ~ "^(X.X.X.X|Y.Y.Y.Y|Z.Z.Z.Z)$") {
68+
return (synth(403, "Blocked"));
69+
}
70+
```
71+
72+
To be able to configure with an environment variable multiple IPs to block, CIDR, exceptions, etc. use the following example:
73+
74+
- [Varnish IP blocking with environment variable](https://github.com/CleverCloud/varnish-examples/blob/main/varnish-ip-blocking/varnish.vcl)
75+
76+
### Ask for a login/password (Basic authentication)
77+
78+
```bash {filename="clevercloud/varnish.vcl"}
79+
sub vcl_recv {
80+
# Local health check
81+
if (client.ip == "127.0.0.1" && !req.http.X-Forwarded-For) {
82+
return (synth(200, "OK"));
83+
}
84+
85+
if (!req.http.Authorization) {
86+
return (synth(401, "Authentication Required"));
87+
}
88+
89+
if (req.http.Authorization !~ "^Basic ") {
90+
return (synth(401, "Basic Authentication Required"));
91+
}
92+
93+
set req.http.X-Auth-Credentials = regsub(req.http.Authorization, "^Basic ", "");
94+
95+
if (req.http.X-Auth-Credentials != "CREDENTIALS") {
96+
return (synth(401, "Valid Basic Authentication Required"));
97+
}
98+
}
99+
100+
sub vcl_synth {
101+
if (resp.status == 200) {
102+
set resp.http.Content-Type = "text/plain";
103+
synthetic("OK");
104+
return (deliver);
105+
}
106+
107+
if (resp.status == 401) {
108+
set resp.http.Content-Type = "text/html; charset=utf-8";
109+
set resp.http.WWW-Authenticate = "Basic realm='Restricted Area'";
110+
synthetic("<html><body><h1>Authentication Required</h1></body></html>");
111+
112+
return (deliver);
113+
}
114+
115+
# Use return (hash); to use the cache
116+
return (pass);
117+
}
118+
```
119+
120+
The `CREDENTIALS` string should be replaced with the base64 encoded value of `username:password`. You can use the following command to generate it on UNIX-based systems:
121+
122+
```bash
123+
echo -n "username:password" | base64
124+
```
125+
126+
### Bearer token authentication
127+
128+
```bash {filename="clevercloud/varnish.vcl"}
129+
import env;
130+
131+
sub vcl_recv {
132+
# Local health check
133+
if (client.ip == "127.0.0.1" && !req.http.X-Forwarded-For) {
134+
return (synth(200, "OK"));
135+
}
136+
137+
if (!req.http.Authorization) {
138+
return (synth(401, "Authentication Required"));
139+
}
140+
141+
if (req.http.Authorization !~ "^Bearer ") {
142+
return (synth(401, "Bearer token Required"));
143+
}
144+
145+
set req.http.X-Token = regsub(req.http.Authorization, "^Bearer ", "");
146+
147+
if (req.http.X-Token != env.get("CC_VARNISH_BEARER_TOKEN")) {
148+
return (synth(401, "Valid Bearer token Required"));
149+
}
150+
151+
# Use return (hash); to use the cache
152+
return (pass);
153+
}
154+
155+
sub vcl_synth {
156+
if (resp.status == 200) {
157+
set resp.http.Content-Type = "text/plain";
158+
synthetic("OK");
159+
return (deliver);
160+
}
161+
162+
if (resp.status == 401) {
163+
set resp.http.Content-Type = "text/html; charset=utf-8";
164+
synthetic("<html><body><h1>Authentication Required</h1></body></html>");
165+
166+
return (deliver);
167+
}
168+
}
169+
```
170+
32171
## Listen on the right port
33172
34173
Once varnish is enabled, your application should no longer listen on port **8080**, but on port **8081**. Because it's Varnish that will listen on port **8080**, and it will have in its configuration your application as backend.

0 commit comments

Comments
 (0)