varnish nginx wordpress ssl several domains

Question

I've got stuck in moment of enabling 2 domains in Wordpress MU installation. Main question: how to configure varnish properly to understand both of domains?

I have next config:

Nginx Frontend -> Varnish Cache -> Varnish backend

Network configured like this: All request to my real IP for ports :80 and :443 are translated to local IP 192.168.1.70 to Nginx. Nginx transfered all requests from 80 to 443. Then all request goes to Varnish. if there's no cache Varnish asks backend.

4 config files for nginx: frontend-domain1.com frontend-domain2.com

Configs of frontend is similar except "server_name" "proxy_set_header Host" options

server {
listen      192.168.1.70:80;
server_name domain1.com;
return 301 https://$server_name$request_uri;
}

server {
listen      192.168.1.70:443 ssl;
server_name domain1.com;

keepalive_timeout               60 60;

gzip                on;
gzip_comp_level     1;
gzip_min_length     512;
gzip_buffers        8 64k;
gzip_types text/plain;
gzip_proxied        any;

ssl on;
ssl_stapling on;
resolver 8.8.8.8 8.8.4.4;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;
ssl_certificate      /chain.crt;
ssl_certificate_key  /private.key;
ssl_dhparam /dhparams.pem;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:E$

add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';
location / {
    proxy_pass      http://127.0.0.1:6081/;
    proxy_set_header    Host              domain1.com;
    proxy_set_header    X-Real-IP         $remote_addr;
    proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto https;
    proxy_set_header    X-Forwarded-Port  443;
  }
}

backend-domain1.com backend-domain2.com Configs of backend is similar except server_name option

server {
listen 127.0.0.1:81;

root /web/sites/domain1;
index index.php;

gzip                on;
gzip_comp_level     1;
gzip_min_length     512;
gzip_buffers        8 64k;
gzip_types text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript image/svg+xml;
gzip_proxied        any;

server_name domain1.com;

location ~ /\. {
    deny all;
}

location / {
    try_files $uri $uri/ /index.php?$args;
}

rewrite /wp-admin$ $scheme://$host$uri/ permanent;

location ~ \.php$ {
    try_files $uri =404;

location ~* /(?:uploads|files)/.*\.php$ {
    deny all;
}

rewrite /wp-admin$ $scheme://$host$uri/ permanent;

location ~ \.php$ {
    try_files $uri =404;

    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass unix:/var/run/php7.0-fpm.sock;
}

}

Varnish Configs: default.vcl

vcl 4.0;

backend default {
    .host = "127.0.0.1";
    .port = "81";
}

acl purge {
    "localhost";
    "127.0.0.1";
    "192.168.1.70";
}

sub vcl_recv {

    if (req.method == "PURGE") {
            if (!client.ip ~ purge) {
                    return(synth(405, "This IP is not allowed to send PURGE 
 requests."));
            }
            return (purge);
    }
}

include "/etc/varnish/domain1.vcl";
include "/etc/varnish/domain2.vcl";

domain1.vcl and domain2.vcl differs with: "req.http.host"

sub vcl_recv {

    if (req.http.host == "domain1.com") {
            if (req.url !~ "^/wp-(login|admin)") {
            unset req.http.cookie;
            }
    }

    set req.http.host = regsub(req.http.host, "^www\.", "");
    set req.http.host = regsub(req.http.host, ":[0-9]+", "");
    set req.http.Cookie = regsuball(req.http.Cookie, "_ga=[^;]+(; )?", "");
    set req.http.Cookie = regsuball(req.http.Cookie, "_gat=[^;]+(; )?", "");

    if (req.http.Authorization || req.method == "POST") {
            return (pass);
    }

    if (req.url ~ "wp-(login|admin)" || req.url ~ "preview=true") {
            return (pass);
    }

    if (req.url ~ "sitemap" || req.url ~ "robots") {
            return (pass);
    }

    set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(_[_a-z]+|has_js)=[^;]*", "");
    set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");
    set req.http.Cookie = regsuball(req.http.Cookie, "__qc.=[^;]+(; )?", "");
    set req.http.Cookie = regsuball(req.http.Cookie, "wp-settings-1=[^;]+(; )?", "");
    set req.http.Cookie = regsuball(req.http.Cookie, "wp-settings-time-1=[^;]+(; )?", "");
    set req.http.Cookie = regsuball(req.http.Cookie, "wordpress_test_cookie=[^;]+(; )?", "");

#        if (req.http.cookie ~ "^ *$") {
#                    unset req.http.cookie;
#        }

    if (req.url ~ "\.(css|js|png|gif|jp(e)?g|swf|ico|woff|svg|htm|html)") {
            unset req.http.cookie;

    if (req.http.Cookie ~ "wordpress_" || req.http.Cookie ~ "comment_") {
            return (pass);
    }

    if (!req.http.cookie) {
            unset req.http.cookie;
    }

    if (req.http.Authorization || req.http.Cookie) {
            # Not cacheable by default
            return (pass);
    }

    return (hash);
}
sub vcl_pass {
    return (fetch);
}

sub vcl_hash {
    hash_data(req.url);

    return (lookup);
}

sub vcl_backend_response {

    unset beresp.http.Server;
    unset beresp.http.X-Powered-By;

    if (bereq.url ~ "sitemap" || bereq.url ~ "robots") {
            set beresp.uncacheable = true;
            set beresp.ttl = 30s;
            return (deliver);
    }
    if (bereq.url ~ "\.(css|js|png|gif|jp(e?)g)|swf|ico|woff|svg|htm|html") 
{
            unset beresp.http.cookie;
            set beresp.ttl = 7d;
            unset beresp.http.Cache-Control;
            set beresp.http.Cache-Control = "public, max-age=604800";
            set beresp.http.Expires = now + beresp.ttl;
    }

    if (bereq.url ~ "wp-(login|admin)" || bereq.url ~ "preview=true") {
            set beresp.uncacheable = true;
            set beresp.ttl = 30s;
            return (deliver);
    }

            if (!(bereq.url ~ "(wp-login|wp-admin|preview=true)")) {
            unset beresp.http.set-cookie;
    }

    if ( bereq.method == "POST" || bereq.http.Authorization ) {
            set beresp.uncacheable = true;
            set beresp.ttl = 120s;
            return (deliver);
    }

    if ( bereq.url ~ "\?s=" ){
            set beresp.uncacheable = true;
            set beresp.ttl = 120s;
            return (deliver);

    if ( beresp.status != 200 ) {
            set beresp.uncacheable = true;
            set beresp.ttl = 120s;
            return (deliver);
    }

    set beresp.ttl = 1d;
    set beresp.grace = 30s;

    return (deliver);
}

sub vcl_deliver {
    unset resp.http.X-Powered-By;
    unset resp.http.Server;
    unset resp.http.Via;
    unset resp.http.X-Varnish;

    return (deliver);
}

If i uncomment

#        if (req.http.cookie ~ "^ *$") {
#                    unset req.http.cookie;
#        }

it shows index for First opened domain. and ignored second domain. all other links works perfectly. If i restart varnish and ask second domain, - it will not show first domain homepage.

Main question: how to configure varnish properly to understand both of domains?

rus: как корректно заставвить варниш обрабатівать два\несколько домена\доменов?

Георгий Филипович · Accepted Answer · 2017-11-28 11:42:21Z

0

Versions of software: varnish-4.1.1 revision 66bb824 nginx version: nginx/1.10.3 PHP 7.0-fpm

OS: Ubuntu 16.04.3 LTS

answered Nov 28, 2017 at 11:42

Георгий Филипович

1

Sign up to request clarification or add additional context in comments.

Comments

Danila Vershinin · Accepted Answer · 2017-11-28 17:06:23Z

0

Varnish is a transparent HTTP proxy so it doesn't really care what and how many domains you pass through it. It will forward the same Host header that was sent by browser to your backend (nginx).

Thus, you only have to make sure that your nginx configuration (or whatever webserver congifuration) will listen on desired domain names.

So make sure that your listen directive in nginx is equal to the domain names that you access the websites with in your browser. As simple as that.

In the SSL termination server blocks, the following will help to avoid hardcoding of domain name:

proxy_set_header Host $host;

P.S. Ну ты и наваял :)

answered Nov 28, 2017 at 17:06

Danila Vershinin

10.1k2 gold badges34 silver badges40 bronze badges

2 Comments

Георгий Филипович Over a year ago

тяжело гуманитарием быть :) приходится из 10-ти мануалов собирать один. основная проблема, что при раскоментировании вот того маленького кусочка кода, выдает одну из двух главных страниц.

Георгий Филипович Over a year ago

установка директивы proxy_set_header Host $host; ситуации не помогла

Collectives™ on Stack Overflow

varnish nginx wordpress ssl several domains

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related