Split a functional modification and a cosmetic one from the commit:

"Introduce the best practices from erp5 public web sites experience."
1ed2b682

This commit only includes functional modification.

slapos/recipe/generic_varnish/template/default.vcl.in

@@ -27,6 +27,10 @@ backend default {
 #
 
 sub vcl_recv {
+  # Force lookup if the request is a no-cache request from the client
+  if (req.http.cache-control ~ "no-cache") {
+      ban_url(req.url);
+  }
   if (req.request != "GET" &&
     req.request != "HEAD" &&
     req.request != "PUT" &&
@@ -42,7 +46,31 @@ sub vcl_recv {
       /* We only deal with GET and HEAD by default */
       return(pass);
   }
-  remove req.http.Cookie;
+  if (req.http.Authorization) {
+      /* Not cacheable by default */
+      return (pass);
+  }
+
+  # no need to have cookies for the resources
+  if (req.url ~ "\.(css|js|ico)$") {
+      unset req.http.cookie;
+  }
+  # remove bogus cookies
+  if (req.http.Cookie) {
+      set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__utm.=[^;]+;? *", "\1");
+      set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__ac_name=\x22\x22;? *", "\1");
+      set req.http.Cookie = regsuball(req.http.Cookie, "(^|; ) *__ac=\x22Og.3D.3D\x22;? *", "\1");
+  }
+  if (req.http.Cookie == "") {
+      remove req.http.Cookie;
+  }
+  if (req.http.Cookie && req.http.Cookie ~ "(^|; ) *__ac=") {
+      /* Not cacheable for authorised users,
+         but KM images are cacheable */
+      if (!(req.url ~ "/km_img/.*\.(png|gif)$")) {
+          return (pass);
+      }
+  }
   remove req.http.Set-Cookie;
   if (req.http.Accept-Encoding) {
     if (req.http.Accept-Encoding ~ "gzip") {
@@ -54,8 +82,6 @@ sub vcl_recv {
       remove req.http.Accept-Encoding;
     }
   }
-  # Force deflate
-  remove req.http.Accept-Encoding;
   # We do not care about Accept-Language, this is url controlled
   remove req.http.Accept-Language;
   #if (req.request == "PURGE") {
@@ -66,7 +92,17 @@ sub vcl_recv {
   #  error 200 "HASHPURGED";
   #  unset req.http.x;
   #}
-  set req.grace = 30d;
+
+  ## XXX login form can defer based on __ac_name cookie value
+  if (req.url ~ "/(login_form|WebSite_viewLoginDialog)($|\?)") {
+      return (pass);
+  }
+
+  if (req.backend.healthy) {
+      set req.grace = 1h;
+  } else {
+      set req.grace = 1w;
+  }
   return(lookup);
 }
 
@@ -98,17 +134,64 @@ sub vcl_miss {
 }
 
 sub vcl_fetch {
+    # we only cache 200 (OK) and 304 (Not Modified) responses.
+    if (beresp.status != 200 && beresp.status != 304) {
+        set beresp.ttl = 0s;
+    }
+
+    if (beresp.http.cache-control ~ "no-cache") {
+        set beresp.ttl = 0s;
+    }
+
+    if (beresp.ttl == 0s) {
+        unset beresp.http.expires;
+        set beresp.http.cache-control = "no-cache";
+        return(hit_for_pass);
+    }
+
+    # we don't care haproxy's cookie.
+    if (beresp.http.Set-Cookie && beresp.http.Set-Cookie !~ "^SERVERID=[^;]+; path=/$") {
+        return(hit_for_pass);
+    }
+
+    if (req.url ~ "\.(css|js|ico)$") {
+        unset beresp.http.set-cookie;
+        set beresp.http.cache-control = regsub(beresp.http.cache-control, "^", "public,");
+        set beresp.http.cache-control = regsub(beresp.http.cache-control, ",$", "");
+    }
+
+    # remove some headers added by caching policy manager to avoid
+    # '304 Not Modified' in case of login <-> logout switching.
+    if (beresp.http.content-type ~ "^text/html") {
+       unset beresp.http.last-modified;
+    }
+
+    set beresp.grace = 1w;
     /* Never send request to backend even if client ask refreshed content */
     if (beresp.ttl > 0s) {
        /* Setup grace period for 30days for all cacheable contents */
       #set req.grace = 30d;
       set beresp.grace = 30d;
+      /* Remove Expires from backend, it's not long enough */
+      unset beresp.http.expires;
+      # /* Set the clients TTL on this object */
+      # set beresp.http.cache-control = "max-age = 300";
+      /* Set how long Varnish will keep it */
+      set beresp.ttl = 1w;
+      /* marker for vcl_deliver to reset Age: */
+      set beresp.http.magicmarker = "1";
       }
    return(deliver);
    }
 
 
 sub vcl_deliver {
+   if (resp.http.magicmarker) {
+     /* Remove the magic marker */
+     unset resp.http.magicmarker;
+     /* By definition we have a fresh object */
+     set resp.http.age = "0";
+   }
    if (obj.hits > 0) {
      set resp.http.X-Cache = obj.hits;
    } else {