Yuvipanda has uploaded a new change for review.
https://gerrit.wikimedia.org/r/87623
Change subject: [HEAVY WIP] Add varnish role
......................................................................
[HEAVY WIP] Add varnish role
First step towards making varnish + apache the default
serving setup. This makes catching potential HTTP cache
validation issues easier and more obvious.
You can bypass varnish and hit apache directly by just
hitting port 8081 instead of 8080. 8080 will hit varnish.
FIXME:
- Because of explicit wgServer, hitting port 8081 doesn't
actually work
- Yet to test to see if PURGE works as advertised
- varnish should be on by default. This makes cache
issues more obvious - and also makes the role easier to write.
role::varnish should disappear soon.
- Varnish logging should be setup properly
Change-Id: Icd74a682d999a8d366949dfce41d8b267f2511ae
---
M Vagrantfile
M puppet/manifests/roles.pp
M puppet/modules/apache/templates/ports.conf.erb
A puppet/modules/varnish/files/default.vcl
A puppet/modules/varnish/manifests/init.pp
5 files changed, 153 insertions(+), 6 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/vagrant
refs/changes/23/87623/1
diff --git a/Vagrantfile b/Vagrantfile
index 3e31518..d32cd8e 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -45,10 +45,15 @@
ip: '10.11.12.13'
# The port on the host that should be forwarded to the guest's HTTP server.
- FORWARDED_PORT = 8080
+ VARNISH_FORWARDED_PORT = 8080
+ APACHE_FORWARDED_PORT = 8081
+ FORWARDED_PORT = VARNISH_FORWARDED_PORT
config.vm.network :forwarded_port,
- guest: 80, host: FORWARDED_PORT, id: 'http'
+ guest: 6081, host: VARNISH_FORWARDED_PORT, id: 'http-varnish'
+
+ config.vm.network :forwarded_port,
+ guest: 8081, host: APACHE_FORWARDED_PORT, id: 'http-apache2'
config.vm.synced_folder '.', '/vagrant',
id: 'vagrant-root',
diff --git a/puppet/manifests/roles.pp b/puppet/manifests/roles.pp
index f30f6e7..9c38be5 100644
--- a/puppet/manifests/roles.pp
+++ b/puppet/manifests/roles.pp
@@ -547,3 +547,14 @@
require => Mediawiki::Extension['Interwiki'],
}
}
+
+class role::varnish {
+ class { '::varnish': }
+ mediawiki::settings { 'enable varnish':
+ values => {
+ 'wgUseSquid' => true,
+ 'wgUseSquidServers' => [ '127.0.0.1' ],
+ 'wgUsePrivateIPs' => true
+ }
+ }
+}
diff --git a/puppet/modules/apache/templates/ports.conf.erb
b/puppet/modules/apache/templates/ports.conf.erb
index 431b6b5..d105d94 100644
--- a/puppet/modules/apache/templates/ports.conf.erb
+++ b/puppet/modules/apache/templates/ports.conf.erb
@@ -1,6 +1,3 @@
# This file is managed by Puppet.
-Listen 80
-<% if @forwarded_port and @forwarded_port.to_s != "80" -%>
-Listen <%= @forwarded_port %>
-<%- end -%>
+Listen 8081
diff --git a/puppet/modules/varnish/files/default.vcl
b/puppet/modules/varnish/files/default.vcl
new file mode 100644
index 0000000..6046151
--- /dev/null
+++ b/puppet/modules/varnish/files/default.vcl
@@ -0,0 +1,116 @@
+# set default backend if no server cluster specified
+backend default {
+ .host = "127.0.0.1";
+ .port = "8081";
+ # .port = "80" led to issues with competing for the port with apache.
+}
+
+# access control list for "purge": open to only localhost and other local nodes
+acl purge {
+ "127.0.0.1";
+}
+
+# vcl_recv is called whenever a request is received
+sub vcl_recv {
+ # Serve objects up to 2 minutes past their expiry if the backend
+ # is slow to respond.
+ set req.grace = 120s;
+ set req.http.X-Forwarded-For = client.ip;
+ set req.backend = default;
+
+ # This uses the ACL action called "purge". Basically if a request to
+ # PURGE the cache comes from anywhere other than localhost, ignore it.
+ if (req.request == "PURGE")
+ {if (!client.ip ~ purge)
+ {error 405 "Not allowed.";}
+ return(lookup);}
+
+ # Pass any requests that Varnish does not understand straight to the
backend.
+ if (req.request != "GET" && req.request != "HEAD" &&
+ req.request != "PUT" && req.request != "POST" &&
+ req.request != "TRACE" && req.request != "OPTIONS" &&
+ req.request != "DELETE")
+ {return(pipe);} /* Non-RFC2616 or CONNECT which is weird. */
+
+ # Pass anything other than GET and HEAD directly.
+ if (req.request != "GET" && req.request != "HEAD")
+ {return(pass);} /* We only deal with GET and HEAD by default */
+
+ # Pass requests from logged-in users directly.
+ if (req.http.Authorization || req.http.Cookie)
+ {return(pass);} /* Not cacheable by default */
+
+ # Pass any requests with the "If-None-Match" header directly.
+ if (req.http.If-None-Match)
+ {return(pass);}
+
+ # Force lookup if the request is a no-cache request from the client.
+ if (req.http.Cache-Control ~ "no-cache")
+ {ban_url(req.url);}
+
+ # normalize Accept-Encoding to reduce vary
+ if (req.http.Accept-Encoding) {
+ if (req.http.User-Agent ~ "MSIE 6") {
+ unset req.http.Accept-Encoding;
+ } elsif (req.http.Accept-Encoding ~ "gzip") {
+ set req.http.Accept-Encoding = "gzip";
+ } elsif (req.http.Accept-Encoding ~ "deflate") {
+ set req.http.Accept-Encoding = "deflate";
+ } else {
+ unset req.http.Accept-Encoding;
+ }
+ }
+
+ return(lookup);
+}
+
+sub vcl_pipe {
+ # Note that only the first request to the backend will have
+ # X-Forwarded-For set. If you use X-Forwarded-For and want to
+ # have it set for all requests, make sure to have:
+ # set req.http.connection = "close";
+
+ # This is otherwise not necessary if you do not do any request
rewriting.
+
+ set req.http.connection = "close";
+}
+
+# Called if the cache has a copy of the page.
+sub vcl_hit {
+ if (req.request == "PURGE")
+ {ban_url(req.url);
+ error 200 "Purged";}
+
+ if (!obj.ttl > 0s)
+ {return(pass);}
+}
+
+# Called if the cache does not have a copy of the page.
+sub vcl_miss {
+ if (req.request == "PURGE")
+ {error 200 "Not in cache";}
+}
+
+# Called after a document has been successfully retrieved from the backend.
+sub vcl_fetch {
+
+ # set minimum timeouts to auto-discard stored objects
+# set beresp.prefetch = -30s;
+ set beresp.grace = 120s;
+
+ if (beresp.ttl < 48h) {
+ set beresp.ttl = 48h;}
+
+ if (!beresp.ttl > 0s)
+ {return(hit_for_pass);}
+
+ if (beresp.http.Set-Cookie)
+ {return(hit_for_pass);}
+
+# if (beresp.http.Cache-Control ~ "(private|no-cache|no-store)")
+# {return(hit_for_pass);}
+
+ if (req.http.Authorization && !beresp.http.Cache-Control ~ "public")
+ {return(hit_for_pass);}
+
+}
\ No newline at end of file
diff --git a/puppet/modules/varnish/manifests/init.pp
b/puppet/modules/varnish/manifests/init.pp
new file mode 100644
index 0000000..4a27d9d
--- /dev/null
+++ b/puppet/modules/varnish/manifests/init.pp
@@ -0,0 +1,18 @@
+class varnish {
+ package { 'varnish':
+ ensure => 'present'
+ }
+
+ service { 'varnish':
+ ensure => running,
+ provider => init,
+ require => [ Package['varnish'] ]
+ }
+
+ file { '/etc/varnish/default.vcl':
+ source => 'puppet:///modules/varnish/default.vcl',
+ mode => '0644',
+ require => Package['varnish'],
+ notify => Service['varnish']
+ }
+}
--
To view, visit https://gerrit.wikimedia.org/r/87623
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Icd74a682d999a8d366949dfce41d8b267f2511ae
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/vagrant
Gerrit-Branch: master
Gerrit-Owner: Yuvipanda <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
