Skip to content

Commit e79e73f

Browse files
adriendupuismnocon
adriendupuis
and
mnocon
authored
Reverse proxy in DDEV cluster (#2999)
* clustering_with_ddev.md: Install reverse proxy * clustering_with_ddev.md: web's proxy config * clustering_with_ddev.md: invalidators; ddev varnishlog * clustering_with_ddev.md: TRUSTED_PROXIES * clustering_with_ddev.md: Fastly --------- Co-authored-by: Marek Nocoń <mnocon@users.noreply.github.com>
1 parent 73546ea commit e79e73f

1 file changed

Lines changed: 123 additions & 0 deletions

File tree

‎docs/infrastructure_and_maintenance/clustering/clustering_with_ddev.md‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,129 @@ The `ddev config --php-version` option should set the same PHP version as the pr
2727

2828
To run an [[= product_name_cloud =]] project locally, you may refer to [DDEV and Ibexa Cloud](ddev_and_ibexa_cloud.md) instead.
2929

30+
## Install reverse proxy
31+
32+
A reverse proxy can be added to the cluster to enable [HTTP caching](http_cache.md).
33+
34+
### Varnish
35+
36+
The following sequence of commands:
37+
38+
1. Sets a variable with the desired Varnish version, here Varnish 7.1
39+
2. Copies and customizes `parameters.vcl` file in `.ddev/varnish/` (which is mounted as `/etc/varnish/` into the container):
40+
- sets `web` container as the backend host and an invalidator (so back office can purge cache)
41+
- adds "all IPs" CIDR notation to `debuggers` list to allow debugging from any IP
42+
- on Varnish 7, enable logging of access control list matching for both `invalidators` and `debuggers` lists
43+
(new Varnish 7 syntax, it was enabled by default on previous versions)
44+
3. Sets main `varnish*.vcl` file to use and "path to VCL directory" argument name depending on Varnish version
45+
4. Copies the main VCL file to `.ddev/varnish/`
46+
5. Sets the Varnish version to use and its demon starting parameters to use the files
47+
6. Adds the Varnish container
48+
7. Sets Varnish as the HTTP cache server
49+
8. Restarts the DDEV cluster and clear the [[= product_name =]] cache
50+
51+
```bash
52+
VARNISH_VERSION=7.1
53+
mkdir -p .ddev/varnish
54+
sed 's/.host = "127.0.0.1";/.host = "web";/' vendor/ibexa/http-cache/docs/varnish/vcl/parameters.vcl > .ddev/varnish/parameters.vcl
55+
sed -i '/^acl invalidators {$/a \\ "web";' .ddev/varnish/parameters.vcl
56+
sed -i '/^acl debuggers {$/a \\ "0.0.0.0"/0; \/\/ debug from any IP' .ddev/varnish/parameters.vcl
57+
if [[ $VARNISH_VERSION == 7.* ]]; then
58+
sed -i 's/acl invalidators {/acl invalidators +log {/' .ddev/varnish/parameters.vcl
59+
sed -i 's/acl debuggers {/acl debuggers +log {/' .ddev/varnish/parameters.vcl
60+
vcl_path=vcl_path
61+
vcl_file=varnish7.vcl
62+
elif [[ $VARNISH_VERSION == 6.* ]]
63+
vcl_path=vcl_dir
64+
vcl_file=varnish6.vcl
65+
fi
66+
cp vendor/ibexa/http-cache/docs/varnish/vcl/$vcl_file .ddev/varnish/
67+
ddev dotenv set .ddev/.env.varnish --varnish-docker-image=varnish:$VARNISH_VERSION --varnish-varnishd-params " -p $vcl_path=/etc/varnish -f /etc/varnish/$vcl_file"
68+
69+
ddev get ddev/ddev-varnish
70+
71+
ddev config --web-environment-add HTTPCACHE_PURGE_SERVER=http://varnish
72+
ddev config --web-environment-add HTTPCACHE_PURGE_TYPE=varnish
73+
ddev config --web-environment-add TRUSTED_PROXIES=varnish
74+
75+
ddev restart
76+
ddev php bin/console cache:clear
77+
```
78+
79+
To use Varnish 6.0LTS, set the following variable instead:
80+
81+
```bash
82+
VARNISH_VERSION=6.0
83+
```
84+
85+
If you're using [Apache as web server](install_with_ddev.md#switch-to-apache-and-its-virtual-host),
86+
you must set `varnish` as a trusted proxy in `.ddev/apache/apache-site.conf` before restarting DDEV:
87+
88+
```bash
89+
sed -i 's/#SetEnv TRUSTED_PROXIES ""/SetEnv TRUSTED_PROXIES "varnish"/' .ddev/apache/apache-site.conf
90+
91+
ddev restart
92+
```
93+
94+
The Varnish server acts as the application’s primary entry point.
95+
If you run `ddev describe`, you can see that Varnish is now the one responding to DDEV domain `.ddev.site`
96+
while the web server still replies to `127.0.0.1` with its own ports.
97+
98+
You can see Varnish headers in HTTP responses, for example:
99+
100+
```console
101+
% curl -s -c cookies.txt -b cookies.txt -I https://<your-project>.ddev.site:<https-port>/
102+
HTTP/2 200
103+
server: Apache/2.4.65 (Debian)
104+
vary: Origin,X-Editorial-Mode
105+
via: 1.1 varnish (Varnish/7.1)
106+
x-cache: HIT
107+
x-cache-debug: 1
108+
x-cache-hits: 5
109+
x-cache-ttl: 87654.321
110+
x-debug-token: 012345
111+
x-debug-token-link: https://<your-project>.ddev.site:<https-port>//_profiler/012345
112+
x-powered-by: Ibexa Commerce v5
113+
x-robots-tag: noindex
114+
x-varnish: 12345 67890
115+
xkey: ez-all c52 ct42 l2 pl1 p1 p2
116+
content-length: 45678
117+
```
118+
119+
You can see how the `web` server is responding to `varnish`:
120+
121+
```console
122+
% curl -s -H "Surrogate-Capability: abc=ESI/1.0" http://127.0.0.1:<http-web-port>/product-catalog | grep 'esi:include'
123+
<esi:include src="/_fragment?_hash=…
124+
```
125+
126+
To explore more the communication between the web server and Varnish, you can find other examples of requests done directly to the web server while impersonating Varnish in [Fetching user context hash](content_aware_cache.md#fetching-user-context-hash) and [Fetching HTML response](content_aware_cache.md#fetching-html-response).
127+
128+
You can use `ddev varnishlog` command to monitor Varnish logs in real time.
129+
Due to how parameters are passed to the container, you may have to wrap some parameters in quotes twice, for example, the purge request monitoring:
130+
131+
```bash
132+
ddev varnishlog -q "'ReqMethod ~ PURGE.*'";
133+
```
134+
135+
For more information on topics such as available configurations, command lines, or monitoring, see [ddev/ddev-varnish README](https://github.com/ddev/ddev-varnish).
136+
137+
### Fastly
138+
139+
For Fastly (as for [[[= product_name_connect =]]](https://doc.ibexa.co/projects/connect/en/latest/)), the instance must be visible from Internet.
140+
141+
To use [ngrok](https://ngrok.com/) alongside [`ddev share`](https://docs.ddev.com/en/stable/users/topics/sharing/#using-ddev-share-easiest) is probably the easiest way to achieve this.
142+
143+
Be careful when making a local development instance visible from the internet.
144+
For example:
145+
146+
- close ngrok tunnels when not needed anymore
147+
- keep your ngrok URL private and share it only with trusted recipients
148+
- don't use it for live demo where the URL could be seen
149+
- don't store it on a Fastly or [[= product_name_connect =]] accounts used by external people
150+
151+
See [Configure and customize Fastly](fastly.md) for the Fastly side.
152+
30153
## Install search engine
31154

32155
A [search engine](search_engines.md) can be added to the cluster.

0 commit comments

Comments
 (0)