Traefik Proxy, Frontend, Backend, Varnish container example
Contents
Traefik Proxy, Frontend, Backend, Varnish container example#
This example is a very simple setup with one backend and data being persisted in a Docker volume.
Traefik Proxy in this example is used as a reverse proxy.
Varnish is used for caching.
A purger component is also used. This solves the problem of invalidating the cache in multiple Varnish servers, which could be desirable in containerized deployment.
Create a project space#
Create an empty project directory named traefik-volto-plone-varnish
.
mkdir traefik-volto-plone-varnish
Change into your project directory.
cd traefik-volto-plone-varnish
Varnish configuration#
Create an empty directory named etc
.
mkdir etc
Add there a file varnish.vcl
that will be used by the Varnish image:
vcl 4.0;
import std;
import directors;
backend traefik_loadbalancer {
.host = "webserver";
.port = "80";
.connect_timeout = 2s;
.first_byte_timeout = 300s;
.between_bytes_timeout = 60s;
}
/* Only allow PURGE from localhost and API-Server */
acl purge {
"localhost";
"backend";
"127.0.0.1";
"172.16.0.0/12";
"10.0.0.0/8";
"192.168.0.0/16";
}
sub detect_protocol{
unset req.http.X-Forwarded-Proto;
set req.http.X-Forwarded-Proto = "http";
}
sub detect_debug{
# Requests with X-Varnish-Debug will display additional
# information about requests
unset req.http.x-vcl-debug;
# Should be changed after switch to live
if (req.http.x-varnish-debug) {
set req.http.x-vcl-debug = false;
}
}
sub detect_auth{
unset req.http.x-auth;
if (
(req.http.Cookie && (
req.http.Cookie ~ "__ac(_(name|password|persistent))?=" || req.http.Cookie ~ "_ZopeId" || req.http.Cookie ~ "auth_token")) ||
(req.http.Authenticate) ||
(req.http.Authorization)
) {
set req.http.x-auth = true;
}
}
sub detect_requesttype{
unset req.http.x-varnish-reqtype;
set req.http.x-varnish-reqtype = "Default";
if (req.http.x-auth){
set req.http.x-varnish-reqtype = "auth";
} elseif (req.url ~ "\/@@(images|download|)\/?(.*)?$"){
set req.http.x-varnish-reqtype = "blob";
} elseif (req.url ~ "\/\+\+api\+\+/?(.*)?$") {
set req.http.x-varnish-reqtype = "api";
} else {
set req.http.x-varnish-reqtype = "express";
}
}
sub process_redirects{
// Add manual redurect
if (req.url ~ "^/old-folder/(.*)") {
set req.http.x-redirect-to = regsub(req.url, "^/old-folder/(.*)", "^/new-folder/\1");
}
if (req.http.x-redirect-to) {
return (synth(301, req.http.x-redirect-to));
}
}
sub vcl_init {
new cluster_loadbalancer = directors.round_robin();
cluster_loadbalancer.add_backend(traefik_loadbalancer);
}
sub vcl_recv {
set req.backend_hint = cluster_loadbalancer.backend();
set req.http.X-Varnish-Routed = "1";
# Annotate request with x-forwarded-proto
# We always serve requests over https, but talk to Traefik
# and then to Volto and Plone using http.
call detect_protocol;
# Annotate request with x-vcl-debug
call detect_debug;
# Annotate request with x-auth indicating if request is authenticated or not
call detect_auth;
# Annotate request with x-varnish-reqtype with a classification for the request
call detect_requesttype;
# Process redirects
call process_redirects;
# Sanitize cookies so they do not needlessly destroy cacheability for anonymous pages
if (req.http.Cookie) {
set req.http.Cookie = ";" + req.http.Cookie;
set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
set req.http.Cookie = regsuball(req.http.Cookie, ";(sticky|I18N_LANGUAGE|statusmessages|__ac|_ZopeId|__cp|beaker\.session|authomatic|serverid|__rf|auth_token)=", "; \1=");
set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");
if (req.http.Cookie == "") {
unset req.http.Cookie;
}
}
if (req.http.x-auth) {
return(pass);
}
if (req.method == "PURGE") {
if (!client.ip ~ purge) {
return (synth(405, "Not allowed."));
} else {
ban("req.url == " + req.url);
return (synth(200, "Purged."));
}
} elseif (req.method == "BAN") {
# Same ACL check as above:
if (!client.ip ~ purge) {
return (synth(405, "Not allowed."));
}
ban("req.http.host == " + req.http.host + "&& req.url == " + req.url);
# Throw a synthetic page so the
# request won't go to the backend.
return (synth(200, "Ban added"));
} elseif (req.method != "GET" &&
req.method != "HEAD" &&
req.method != "PUT" &&
req.method != "POST" &&
req.method != "PATCH" &&
req.method != "TRACE" &&
req.method != "OPTIONS" &&
req.method != "DELETE") {
/* Non-RFC2616 or CONNECT which is weird. */
return (pipe);
} elseif (req.method != "GET" &&
req.method != "HEAD" &&
req.method != "OPTIONS") {
/* POST, PUT, PATCH will pass, always */
return(pass);
}
return(hash);
}
sub vcl_pipe {
/* This is not necessary if you do not do any request rewriting. */
set req.http.connection = "close";
}
sub vcl_purge {
return (synth(200, "PURGE: " + req.url + " - " + req.hash));
}
sub vcl_synth {
if (resp.status == 301) {
set resp.http.location = resp.reason;
set resp.reason = "Moved";
return (deliver);
}
}
sub vcl_hit {
if (obj.ttl >= 0s) {
// A pure unadulterated hit, deliver it
return (deliver);
} elsif (obj.ttl + obj.grace > 0s) {
// Object is in grace, deliver it
// Automatically triggers a background fetch
return (deliver);
} else {
return (restart);
}
}
sub vcl_backend_response {
# Don't allow static files to set cookies.
# (?i) denotes case insensitive in PCRE (perl compatible regular expressions).
# make sure you edit both and keep them equal.
if (bereq.url ~ "(?i)\.(pdf|asc|dat|txt|doc|xls|ppt|tgz|png|gif|jpeg|jpg|ico|swf|css|js)(\?.*)?$") {
unset beresp.http.set-cookie;
}
if (beresp.http.Set-Cookie) {
set beresp.http.x-varnish-action = "FETCH (pass - response sets cookie)";
set beresp.uncacheable = true;
set beresp.ttl = 120s;
return(deliver);
}
if (beresp.http.Cache-Control ~ "(private|no-cache|no-store)") {
set beresp.http.x-varnish-action = "FETCH (pass - cache control disallows)";
set beresp.uncacheable = true;
set beresp.ttl = 120s;
return(deliver);
}
# if (beresp.http.Authorization && !beresp.http.Cache-Control ~ "public") {
# Do NOT cache if there is an "Authorization" header
# beresp never has an Authorization header in beresp, right?
if (beresp.http.Authorization) {
set beresp.http.x-varnish-action = "FETCH (pass - authorized and no public cache control)";
set beresp.uncacheable = true;
set beresp.ttl = 120s;
return(deliver);
}
# Use this rule IF no cache-control (SSR content)
if ((bereq.http.x-varnish-reqtype ~ "express") && (!beresp.http.Cache-Control)) {
set beresp.http.x-varnish-action = "INSERT (30s caching / 60s grace)";
set beresp.uncacheable = false;
set beresp.ttl = 30s;
set beresp.grace = 60s;
return(deliver);
}
if (!beresp.http.Cache-Control) {
set beresp.http.x-varnish-action = "FETCH (override - backend not setting cache control)";
set beresp.uncacheable = true;
set beresp.ttl = 120s;
return (deliver);
}
if (beresp.http.X-Anonymous && !beresp.http.Cache-Control) {
set beresp.http.x-varnish-action = "FETCH (override - anonymous backend not setting cache control)";
set beresp.ttl = 600s;
return (deliver);
}
set beresp.http.x-varnish-action = "FETCH (insert)";
return (deliver);
}
sub vcl_deliver {
if (req.http.x-vcl-debug) {
set resp.http.x-varnish-ttl = obj.ttl;
set resp.http.x-varnish-grace = obj.grace;
set resp.http.x-hits = obj.hits;
set resp.http.x-varnish-reqtype = req.http.x-varnish-reqtype;
if (req.http.x-auth) {
set resp.http.x-auth = "Logged-in";
} else {
set resp.http.x-auth = "Anon";
}
if (obj.hits > 0) {
set resp.http.x-cache = "HIT";
} else {
set resp.http.x-cache = "MISS";
}
} else {
unset resp.http.x-varnish-action;
unset resp.http.x-cache-operation;
unset resp.http.x-cache-rule;
unset resp.http.x-powered-by;
}
}
Note
http://plone.localhost/
is the URL you will be using to access the website.
You can either use localhost
, or add it in your /etc/hosts
file or DNS to point to the Docker host IP.
Service configuration with Docker Compose#
Now let's create a docker-compose.yml
file:
version: "3"
services:
webserver:
image: traefik
ports:
- 80:80
labels:
- traefik.enable=true
- traefik.constraint-label=public
# GENERIC MIDDLEWARES
# - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
# - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true
- traefik.http.middlewares.gzip.compress=true
- traefik.http.middlewares.gzip.compress.excludedcontenttypes=image/png, image/jpeg, font/woff2
# GENERIC ROUTERS
# - traefik.http.routers.generic-https-redirect.entrypoints=http
# - traefik.http.routers.generic-https-redirect.rule=HostRegexp(`{host:.*}`)
# - traefik.http.routers.generic-https-redirect.priority=1
# - traefik.http.routers.generic-https-redirect.middlewares=https-redirect
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
command:
- --providers.docker
- --providers.docker.constraints=Label(`traefik.constraint-label`, `public`)
- --providers.docker.exposedbydefault=false
- --entrypoints.http.address=:80
# - --entrypoints.https.address=:443
- --accesslog
- --accesslog.format=json
- --accesslog.fields.headers.names.X-Varnish-Routed=keep
- --accesslog.fields.headers.names.RequestHost=keep
- --log
- --log.level=DEBUG
- --api
frontend:
image: plone/plone-frontend:latest
environment:
RAZZLE_INTERNAL_API_PATH: http://backend:8080/Plone
RAZZLE_API_PATH: http://plone.localhost
DEBUG: superagent
labels:
- traefik.enable=true
- traefik.constraint-label=public
# Service
- traefik.http.services.svc-frontend.loadbalancer.server.port=3000
# Router: Varnish Public
- traefik.http.routers.rt-frontend-public.rule=Host(`plone.localhost`)
- traefik.http.routers.rt-frontend-public.entrypoints=http
- traefik.http.routers.rt-frontend-public.service=svc-varnish
- traefik.http.routers.rt-frontend-public.middlewares=gzip
# Router: Internal
- traefik.http.routers.rt-frontend-internal.rule=Host(`plone.localhost`) && Headers(`X-Varnish-Routed`, `1`)
- traefik.http.routers.rt-frontend-internal.entrypoints=http
- traefik.http.routers.rt-frontend-internal.service=svc-frontend
depends_on:
- backend
ports:
- "3000:3000"
backend:
image: plone/plone-backend:6.0
environment:
SITE: Plone
PROFILES: "plone.app.caching:with-caching-proxy"
labels:
- traefik.enable=true
- traefik.constraint-label=public
# Service
- traefik.http.services.svc-backend.loadbalancer.server.port=8080
# Middleware
## Virtual Host Monster for /++api++/
- "traefik.http.middlewares.mw-backend-vhm-api.replacepathregex.regex=^/\\+\\+api\\+\\+($$|/.*)"
- "traefik.http.middlewares.mw-backend-vhm-api.replacepathregex.replacement=/VirtualHostBase/http/plone.localhost/Plone/++api++/VirtualHostRoot$$1"
## Virtual Host Monster for /ClassicUI/
- "traefik.http.middlewares.mw-backend-vhm-ui.replacepathregex.regex=^/ClassicUI($$|/.*)"
- "traefik.http.middlewares.mw-backend-vhm-ui.replacepathregex.replacement=/VirtualHostBase/http/plone.localhost/Plone/VirtualHostRoot/_vh_ClassicUI$$1"
# Router: Varnish Public
## /++api++/
- traefik.http.routers.rt-backend-api-public.rule=Host(`plone.localhost`) && PathPrefix(`/++api++`)
- traefik.http.routers.rt-backend-api-public.entrypoints=http
- traefik.http.routers.rt-backend-api-public.service=svc-varnish
- traefik.http.routers.rt-backend-api-public.middlewares=gzip
# Router: Internal
## /++api++/
- traefik.http.routers.rt-backend-api-internal.rule=Host(`plone.localhost`) && PathPrefix(`/++api++`) && Headers(`X-Varnish-Routed`, `1`)
- traefik.http.routers.rt-backend-api-internal.entrypoints=http
- traefik.http.routers.rt-backend-api-internal.service=svc-backend
- traefik.http.routers.rt-backend-api-internal.middlewares=gzip,mw-backend-vhm-api
## /ClassicUI/
- traefik.http.routers.rt-backend-ui-internal.rule=Host(`plone.localhost`) && PathPrefix(`/ClassicUI`) && Headers(`X-Varnish-Routed`, `1`)
- traefik.http.routers.rt-backend-ui-internal.entrypoints=http
- traefik.http.routers.rt-backend-ui-internal.service=svc-backend
- traefik.http.routers.rt-backend-ui-internal.middlewares=gzip,mw-backend-vhm-ui
ports:
- "8080:8080"
purger:
image: ghcr.io/kitconcept/cluster-purger:latest
platform: linux/amd64
environment:
PURGER_SERVICE_NAME: varnish
PURGER_SERVICE_PORT: 80
PURGER_MODE: "compose"
PURGER_PUBLIC_SITES: "['plone.localhost']"
varnish:
image: varnish
volumes:
- ./etc/varnish.vcl:/etc/varnish/default.vcl
labels:
- traefik.enable=true
- traefik.constraint-label=public
# SERVICE
- traefik.http.services.svc-varnish.loadbalancer.server.port=80
networks:
default:
aliases:
- plone.localhost
ports:
- "8000-8001:80"
depends_on:
- backend
Build the project#
Start the stack with docker compose
.
docker compose up -d
This pulls the needed images and starts Plone.
Access Plone via Browser#
After startup, go to http://plone.localhost/
and you should see the site.
Shutdown and cleanup#
The command docker compose down
removes the containers and default network, but preserves the Plone database.
The command docker compose down --volumes
removes the containers, default network, and the Plone database.