Hướng dẫn sử dụng Varnish làm Reverse Proxy

Yêu cầu:

1. Đã có 1 webserver dùng Apache hoặc Nginx.
2. 1 Server cài sẵn Centos 6.5 64 bit để cài đặt varnish.

Tiến hành.

Chú ý: Sẽ không có bất kì chỉnh sửa nào trên web server, mình chỉ cài đặt varnish lên server mới rồi trỏ IP về web server thôi.

Hướng dẫn cài đặt Varnish

Thao tác 100% trên Server Varnish nhé.

Update centos

yum update

Cài đặt varnish

yum install epel-release
rpm --nosignature -i https://repo.varnish-cache.org/redhat/varnish-4.0.el6.rpm
yum install varnish

Khởi chạy varnish

service varnish start

Cho varnish khởi động cùng centos

chkconfig varnish on

Set port mặc định cho varnish là 80

nano /etc/sysconfig/varnish

tìm

VARNISH_LISTEN_PORT=6085

đổi thành

VARNISH_LISTEN_PORT=80

Cấu hình cho VCL

Tạo file dự phòng

cp /etc/varnish/default.vcl /etc/varnish/default.vcl.bak

Edit file này

nano /etc/varnish/default.vcl

Thay đổi toàn bộ nội dung bằng nội dung bên dưới.

#
# This is an example VCL file for Varnish.
#
# It does not do anything by default, delegating control to the
# builtin VCL. The builtin VCL is called when there is no explicit
# return statement.
#
# See the VCL chapters in the Users Guide at https://www.varnish-cache.org/docs/
# and https://varnish-cache.org/trac/wiki/VCLExamples for more examples.

# Marker to tell the VCL compiler that this VCL has been adapted to the
# new 4.0 format.
vcl 4.0;

# Default backend definition. Set this to point to your content server.
backend default {
 .host = "IP của Web server";
 .port = "80";
}

acl purge {
 "127.0.0.1";
}

sub vcl_recv {
 if (req.method == "PURGE") {
 if (!client.ip ~ purge) {
 return(synth(405,"Not allowed."));
 }

if (req.http.X-Purge-Method == "regex") {
 ban("req.url ~ " + req.url + " && req.http.host ~ " + req.http.host);
 return (synth(200, "Banned."));
 } else {
 return (purge);
 }
 }

### Do not Authorized requests.
 if (req.http.Authorization) {
 return(pass); // DO NOT CACHE
 }

### Pass any requests with the "If-None-Match" header directly.
 if (req.http.If-None-Match) {
 return(pass); // DO NOT CACHE
 }

### Do not cache AJAX requests.
 if (req.http.X-Requested-With == "XMLHttpRequest") {
 return(pass); // DO NOT CACHE
 }

### Only cache GET or HEAD requests. This makes sure the POST (and OPTIONS) requests are always passed.
 if (req.method != "GET" && req.method != "HEAD") {
 return (pass); // DO NOT CACHE
 }

### Static files: Do not cache PDF, XML, ... files (=static & huge and no use caching them - in all Vary: variations!)
 if (req.url ~ "\.(doc|mp3|pdf|tif|tiff|xml)(\?.*|)$") {
 return(pass); // DO NOT CACHE
 }

# Unset the header for static files
 if (req.url ~ "\.(gif|jpg|jpeg|swf|ttf|css|js|flv|mp3|mp4|pdf|ico|png)(\?.*|)$") {
 unset req.http.cookie;
 set req.url = regsub(req.url, "\?.*$", "");
 }

if (req.url ~ "\?(utm_(campaign|medium|source|term)|adParams|client|cx|eid|fbid|feed|ref(id|src)?|v(er|iew))=") {
 set req.url = regsub(req.url, "\?.*$", "");
 }

if (req.url ~ "wp-(login|admin)" || req.url ~ "preview=true" || req.url ~ "xmlrpc.php") {
 return (pass);
 }

if (req.http.cookie) {
 # Google Analytics
 set req.http.Cookie = regsuball( req.http.Cookie, "(^|;\s*)(__utm[a-z]+)=([^;]*)", "");
 set req.http.Cookie = regsuball( req.http.Cookie, "(^|;\s*)(_ga)=([^;]*)", "");

# Quant Capital
 set req.http.Cookie = regsuball( req.http.Cookie, "(^|;\s*)(__qc[a-z]+)=([^;]*)", "");

# __gad __gads
 set req.http.Cookie = regsuball( req.http.Cookie, "(^|;\s*)(__gad[a-z]+)=([^;]*)", "");

# Google Cookie consent (client javascript cookie)
 set req.http.Cookie = regsuball( req.http.Cookie, "(^|;\s*)(displayCookieConsent)=([^;]*)", "");

# Other known Cookies: remove them (if found).
 set req.http.Cookie = regsuball( req.http.Cookie, "(^|;\s*)(__CT_Data)=([^;]*)", "");
 set req.http.Cookie = regsuball( req.http.Cookie, "(^|;\s*)(WRIgnore|WRUID)=([^;]*)", "");


 # PostAction: Remove (once and if found) a ";" prefix followed by 0..n whitespaces.
 # INFO \s* = 0..n whitespace characters
 set req.http.Cookie = regsub( req.http.Cookie, "^;\s*", "" );

# PostAction: Unset the header if it is empty or 0..n whitespaces.
 if ( req.http.cookie ~ "^\s*$" ) {
 unset req.http.Cookie;
 }
 }
}

sub vcl_backend_response {
 if ( (!(bereq.url ~ "(wp-(login|admin)|login)")) || (bereq.method == "GET") ) {
 //unset beresp.http.set-cookie;
 set beresp.ttl = 1h;
 }
 # Remove some headers we never want to see
 unset beresp.http.Server;
 unset beresp.http.X-Powered-By;

if (bereq.url ~ "\.(gif|jpg|jpeg|swf|ttf|css|js|flv|mp3|mp4|pdf|ico|png)(\?.*|)$") {
 unset beresp.http.cookie;
 set beresp.ttl = 365d;
 }

set beresp.ttl = 10s;
 set beresp.grace = 1h;
}

sub vcl_deliver {
 if (obj.hits > 0) {
 set resp.http.X-Cache = "HIT";
 } else {
 set resp.http.X-Cache = "MISS";
 }
}

Khởi động lại varnish

service varnish restart

Kiểm tra thử varnish đã sử dụng cổng 80 hay chưa.

[root@vps ~]# netstat -ntlup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 15219/varnishd
tcp 0 0 127.0.0.1:6082 0.0.0.0:* LISTEN 15217/varnishd
tcp 0 0 0.0.0.0:6085 0.0.0.0:* LISTEN 15490/varnish-agent
tcp 0 0 :::80 :::* LISTEN 15219/varnishd

Bây giờ trỏ domain về server varnish là xong.

Rất đơn giản phải không.

Hướng dẫn cài đặt Varnish Agent

Tất nhiên trước hết bạn cần cài varnish như trên trước đã.

Xong chạy lệnh dưới để cài varnish agent

yum install varnish-agent

Khởi chạy varnish agent

service varnish-agent start

Cho varnish agent chạy khi reboot server.

chkconfig varnish-agent on

Vào trang quản lý của Varnish agent

IP-của-server-varnish:6085/html/

Khi được hỏi pass thì gõ lệnh này để cat user + pass

cat /etc/varnish/agent_secret

 

Tham khảo: https://hocvps.com