MAGECLOUD-3030: [Cloud Docker] Varnish does not work for port 443 (SS…

…L) (#22)
magento · Apr 2, 2019 · 7fceaf9 · 7fceaf9
1 parent 752fa19
commit 7fceaf9
Show file tree

Hide file tree

Showing 6 changed files with 118 additions and 13 deletions.
diff --git a/hitch/Dockerfile b/hitch/Dockerfile
diff --git a/tls/Dockerfile b/tls/Dockerfile
@@ -0,0 +1,9 @@
+FROM mnuessler/tls-termination-proxy
+
+EXPOSE 443
+
+COPY certs/magento2.docker.pem /certs/cert.pem
+
+ENV HTTPS_UPSTREAM_SERVER_ADDRESS   varnish
+ENV HTTPS_UPSTREAM_SERVER_PORT  80
+ENV CERT_PATH   /certs/cert.pem
diff --git a/tls/certs/magento2.docker.crt b/tls/certs/magento2.docker.crt
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDljCCAn4CCQDnRn3DzcK9LDANBgkqhkiG9w0BAQsFADCBjDELMAkGA1UEBhMC
+VVMxDjAMBgNVBAgMBVRleGFzMQ8wDQYDVQQHDAZBdXN0aW4xEDAOBgNVBAoMB01h
+Z2VudG8xDjAMBgNVBAsMBUNsb3VkMRgwFgYDVQQDDA9tYWdlbnRvMi5kb2NrZXIx
+IDAeBgkqhkiG9w0BCQEWEWNsb3VkQG1hZ2VudG8uY29tMB4XDTE5MDMyMTE2MDQz
+MloXDTIwMDMyMDE2MDQzMlowgYwxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhh
+czEPMA0GA1UEBwwGQXVzdGluMRAwDgYDVQQKDAdNYWdlbnRvMQ4wDAYDVQQLDAVD
+bG91ZDEYMBYGA1UEAwwPbWFnZW50bzIuZG9ja2VyMSAwHgYJKoZIhvcNAQkBFhFj
+bG91ZEBtYWdlbnRvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AMtRwjGlgJTxDc9uWIopXDYaFJBzzZ7sc1sM5Bcd/T9ES3964KpHemY+5fYjXGk7
+tWrE1GKcpfC2NOQrCi4T4EcIE81U0NNr3OUy2l769J9CXo4RG5BBAsO4Tr5H+vZv
+Voh38WfCSamJ7Rdnvxmd2x3x5R4mTS3tJRCytxEJujUg376CT5LMoPgHEp9tH1Vx
+1jf0pmYzbEz4JwOoQyvy0wBb/2f91Z0ak4gXFman06yW6fcJf5Hugv5mDnE4Bz+g
+xr0QP0csTQBw3EV6mC3wZP9YQf16r8dyo9wx+JCKWl1opvFJ4byDFW4L+JVwTBws
+nNjPCphdiaUWKHR9UfD5co0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEACXRJPY97
+93oNMYtKXnwa9r1+9eMvp2kITRiYI2kKejPQcvDAFN/V7NVkz8x6sZJgLpje6NTP
+n64cyTll1tbe2WYznoDn9VkRN7NNC9XgE5yH/ceOyrSVZBNv0strK1B375fWHjN6
+r5pvLg3yAgxU0xaWHqTMqwTYIFZLmBnBu3j7HfGtuI8Ic0gMJXWIY/S4eSE2Wzbu
+Icnf+ToRa4AKf+3otYqrrQ9zT6GZqrYDzQVmm173OLmvsQMqlo3+0G27Pxb6/KGW
+MEG3SslulnNqDwi7bgqa+ZZ/7L+T1ruh6gNUHXAUUAampUrsXJZenThAwhY7UiHk
+GjnO5Hagvij1hA==
+-----END CERTIFICATE-----
diff --git a/tls/certs/magento2.docker.key b/tls/certs/magento2.docker.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDLUcIxpYCU8Q3P
+bliKKVw2GhSQc82e7HNbDOQXHf0/REt/euCqR3pmPuX2I1xpO7VqxNRinKXwtjTk
+KwouE+BHCBPNVNDTa9zlMtpe+vSfQl6OERuQQQLDuE6+R/r2b1aId/Fnwkmpie0X
+Z78Zndsd8eUeJk0t7SUQsrcRCbo1IN++gk+SzKD4BxKfbR9VcdY39KZmM2xM+CcD
+qEMr8tMAW/9n/dWdGpOIFxZmp9Oslun3CX+R7oL+Zg5xOAc/oMa9ED9HLE0AcNxF
+epgt8GT/WEH9eq/HcqPcMfiQilpdaKbxSeG8gxVuC/iVcEwcLJzYzwqYXYmlFih0
+fVHw+XKNAgMBAAECggEBAKfaaqEECoBr9cPPTIdbmAYOR/XttM7EVIPRw6iWGJIX
+tuCauEm70wAAY2duUAeMxLxNnS2AN7rfIhFQuwnJXPonX/m/UNuKjAYokoGhWzzz
+1Q4ib4gLM9YTHecXk8fJqT3nD8RicN/nv3X4L5tdaB1zq3zVkBgfVN9RO7N0PWdH
+sNxlA9cE5UmfJoIFdL7EBoMGC+o6tJEB0DbS/Nu9FCuq7L1/GDSyM3cldc+3EegX
+RwiTW3+11xqct9grWmVy/lb2/DoIZQdg8JjuJDrhuDbx2g+bBOIFmxxhQpk4OkmD
+GloP5Hoc0GHtuFi2Pa/8gCODEqEFddQR6pMe3zUFr0ECgYEA5KsYFQ+jeFaH4Dr9
+8uULMEz14mn8qXANnwHt7uhQE+Ab0n6VgCPUK8FFO5dqhVNjgDW4lbOU4G3S+0qc
+C+WBbctkAeacPwfu1dPjR9FoCktx6Im/VL5zw6n6M75n54RHLu37Foy+2DPmYz+1
+qknJmhBITlMJuIOZcF+PcQoaiTECgYEA458GPZQGdfv+thRqJSMi0MCaSDnJiNdo
+Jdyz3NYw1c4yI8cjRhLUnG6r5zqfUlr0kqtiLu4HYzUQCFqeEgzYV5ruw6m4Br30
+ivJGqMjMy6t7aW7c23ozO/9hYzdiuC916JSJWnn+W+v+1xZJJ1hGNtDlOT/Qkvv3
+n10v63j8aB0CgYBu3FgvlcZeCC2V02PdB5hWEWnAHDxHdTDVXx0Yj36LNEKo2X/n
+gPdTQz8qde1JuDTsKp9TzJ2n9Patp+1hgyIttcbFeSVVFaZ/+lsdLXPwUcVmxKmD
+D1aWjOjlfzFmt+W+5deuhgvcS8UtZuzPIzjfPXegqXd0AjE4nsuvNQPKcQKBgCyM
+ANKoV6Nbj/vefu+JstSb/RXJiXGoho9yZBkCKkiNtC5gWLzsDoQW/LmiNXAOsPLL
+a8m3d+aoidy4r1rk/KoYfkX4vzVCk8tlowKBWeM6SkrWEY86mTBSyKJ8Qmu9jhvY
+hhEY8vjWdOdvSx3SHtu3gkT0AkPh4BJmUGyLHwrZAoGBAJeYwOhNuxZe8Bh4Rm6N
+6g3fOezBUqk3RE/XIQbdh1ONEQV2P3bGdsuCNgn/6qSP9jto4O7OV8UetJhc/Sou
+PmQFgN60IBztvSLWUk9JI2va0PSupbvnOOdxL3nsi5mwED6Ck8v91x83fS3LdVVR
+PHvwNIjbx7J6hjqswN8fF/7X
+-----END PRIVATE KEY-----
diff --git a/tls/certs/magento2.docker.pem b/tls/certs/magento2.docker.pem
@@ -0,0 +1,50 @@
+-----BEGIN CERTIFICATE-----
+MIIDljCCAn4CCQDnRn3DzcK9LDANBgkqhkiG9w0BAQsFADCBjDELMAkGA1UEBhMC
+VVMxDjAMBgNVBAgMBVRleGFzMQ8wDQYDVQQHDAZBdXN0aW4xEDAOBgNVBAoMB01h
+Z2VudG8xDjAMBgNVBAsMBUNsb3VkMRgwFgYDVQQDDA9tYWdlbnRvMi5kb2NrZXIx
+IDAeBgkqhkiG9w0BCQEWEWNsb3VkQG1hZ2VudG8uY29tMB4XDTE5MDMyMTE2MDQz
+MloXDTIwMDMyMDE2MDQzMlowgYwxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhh
+czEPMA0GA1UEBwwGQXVzdGluMRAwDgYDVQQKDAdNYWdlbnRvMQ4wDAYDVQQLDAVD
+bG91ZDEYMBYGA1UEAwwPbWFnZW50bzIuZG9ja2VyMSAwHgYJKoZIhvcNAQkBFhFj
+bG91ZEBtYWdlbnRvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AMtRwjGlgJTxDc9uWIopXDYaFJBzzZ7sc1sM5Bcd/T9ES3964KpHemY+5fYjXGk7
+tWrE1GKcpfC2NOQrCi4T4EcIE81U0NNr3OUy2l769J9CXo4RG5BBAsO4Tr5H+vZv
+Voh38WfCSamJ7Rdnvxmd2x3x5R4mTS3tJRCytxEJujUg376CT5LMoPgHEp9tH1Vx
+1jf0pmYzbEz4JwOoQyvy0wBb/2f91Z0ak4gXFman06yW6fcJf5Hugv5mDnE4Bz+g
+xr0QP0csTQBw3EV6mC3wZP9YQf16r8dyo9wx+JCKWl1opvFJ4byDFW4L+JVwTBws
+nNjPCphdiaUWKHR9UfD5co0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEACXRJPY97
+93oNMYtKXnwa9r1+9eMvp2kITRiYI2kKejPQcvDAFN/V7NVkz8x6sZJgLpje6NTP
+n64cyTll1tbe2WYznoDn9VkRN7NNC9XgE5yH/ceOyrSVZBNv0strK1B375fWHjN6
+r5pvLg3yAgxU0xaWHqTMqwTYIFZLmBnBu3j7HfGtuI8Ic0gMJXWIY/S4eSE2Wzbu
+Icnf+ToRa4AKf+3otYqrrQ9zT6GZqrYDzQVmm173OLmvsQMqlo3+0G27Pxb6/KGW
+MEG3SslulnNqDwi7bgqa+ZZ/7L+T1ruh6gNUHXAUUAampUrsXJZenThAwhY7UiHk
+GjnO5Hagvij1hA==
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDLUcIxpYCU8Q3P
+bliKKVw2GhSQc82e7HNbDOQXHf0/REt/euCqR3pmPuX2I1xpO7VqxNRinKXwtjTk
+KwouE+BHCBPNVNDTa9zlMtpe+vSfQl6OERuQQQLDuE6+R/r2b1aId/Fnwkmpie0X
+Z78Zndsd8eUeJk0t7SUQsrcRCbo1IN++gk+SzKD4BxKfbR9VcdY39KZmM2xM+CcD
+qEMr8tMAW/9n/dWdGpOIFxZmp9Oslun3CX+R7oL+Zg5xOAc/oMa9ED9HLE0AcNxF
+epgt8GT/WEH9eq/HcqPcMfiQilpdaKbxSeG8gxVuC/iVcEwcLJzYzwqYXYmlFih0
+fVHw+XKNAgMBAAECggEBAKfaaqEECoBr9cPPTIdbmAYOR/XttM7EVIPRw6iWGJIX
+tuCauEm70wAAY2duUAeMxLxNnS2AN7rfIhFQuwnJXPonX/m/UNuKjAYokoGhWzzz
+1Q4ib4gLM9YTHecXk8fJqT3nD8RicN/nv3X4L5tdaB1zq3zVkBgfVN9RO7N0PWdH
+sNxlA9cE5UmfJoIFdL7EBoMGC+o6tJEB0DbS/Nu9FCuq7L1/GDSyM3cldc+3EegX
+RwiTW3+11xqct9grWmVy/lb2/DoIZQdg8JjuJDrhuDbx2g+bBOIFmxxhQpk4OkmD
+GloP5Hoc0GHtuFi2Pa/8gCODEqEFddQR6pMe3zUFr0ECgYEA5KsYFQ+jeFaH4Dr9
+8uULMEz14mn8qXANnwHt7uhQE+Ab0n6VgCPUK8FFO5dqhVNjgDW4lbOU4G3S+0qc
+C+WBbctkAeacPwfu1dPjR9FoCktx6Im/VL5zw6n6M75n54RHLu37Foy+2DPmYz+1
+qknJmhBITlMJuIOZcF+PcQoaiTECgYEA458GPZQGdfv+thRqJSMi0MCaSDnJiNdo
+Jdyz3NYw1c4yI8cjRhLUnG6r5zqfUlr0kqtiLu4HYzUQCFqeEgzYV5ruw6m4Br30
+ivJGqMjMy6t7aW7c23ozO/9hYzdiuC916JSJWnn+W+v+1xZJJ1hGNtDlOT/Qkvv3
+n10v63j8aB0CgYBu3FgvlcZeCC2V02PdB5hWEWnAHDxHdTDVXx0Yj36LNEKo2X/n
+gPdTQz8qde1JuDTsKp9TzJ2n9Patp+1hgyIttcbFeSVVFaZ/+lsdLXPwUcVmxKmD
+D1aWjOjlfzFmt+W+5deuhgvcS8UtZuzPIzjfPXegqXd0AjE4nsuvNQPKcQKBgCyM
+ANKoV6Nbj/vefu+JstSb/RXJiXGoho9yZBkCKkiNtC5gWLzsDoQW/LmiNXAOsPLL
+a8m3d+aoidy4r1rk/KoYfkX4vzVCk8tlowKBWeM6SkrWEY86mTBSyKJ8Qmu9jhvY
+hhEY8vjWdOdvSx3SHtu3gkT0AkPh4BJmUGyLHwrZAoGBAJeYwOhNuxZe8Bh4Rm6N
+6g3fOezBUqk3RE/XIQbdh1ONEQV2P3bGdsuCNgn/6qSP9jto4O7OV8UetJhc/Sou
+PmQFgN60IBztvSLWUk9JI2va0PSupbvnOOdxL3nsi5mwED6Ck8v91x83fS3LdVVR
+PHvwNIjbx7J6hjqswN8fF/7X
+-----END PRIVATE KEY-----
diff --git a/varnish/etc/varnish.vcl b/varnish/etc/varnish.vcl
@@ -1,6 +1,7 @@
 vcl 4.0;
 
 import std;
+
 # The minimal Varnish version is 4.0
 # For SSL offloading, pass the following header in your proxy server or load balancer: 'SSL-OFFLOADED: https'
 
@@ -9,8 +10,8 @@ backend default {
     .port = "80";
 }
 
-sub vcl_recv {
 
+sub vcl_recv {
     # Ensure the true IP is sent onwards.
     # This was an issue getting xdebug working through varnish
     # whilst having a proxy infront of varnish (for local docker dev)
@@ -100,6 +101,10 @@ sub vcl_hash {
         hash_data(req.http.SSL-OFFLOADED);
     }
 
+    # Cache https seperately
+    if (req.http.X-Forwarded-Proto) {
+        hash_data(req.http.X-Forwarded-Proto);
+    }
 }
 
 sub vcl_backend_response {
@@ -150,14 +155,10 @@ sub vcl_backend_response {
 }
 
 sub vcl_deliver {
-    if (resp.http.X-Magento-Debug) {
-        if (resp.http.x-varnish ~ " ") {
-            set resp.http.X-Magento-Cache-Debug = "HIT";
-        } else {
-            set resp.http.X-Magento-Cache-Debug = "MISS";
-        }
+    if (resp.http.x-varnish ~ " ") {
+        set resp.http.X-Magento-Cache-Debug = "HIT";
     } else {
-        unset resp.http.Age;
+        set resp.http.X-Magento-Cache-Debug = "MISS";
     }
 
     unset resp.http.X-Magento-Debug;