<div dir="ltr">Hey guys,<div><br></div><div> I was actually able to get this to work. So I wanted to share my solution with you. </div><div><br></div><div> I had to change my probe definition to put the http headers into the request for the probe:</div><div><br></div><div><div>backend web1 {</div><div> .host = "10.10.10.25";</div><div> .port = "80";</div><div> .connect_timeout = 30s;</div><div> .first_byte_timeout = 30s;</div><div> .between_bytes_timeout = 30s;</div><div> .max_connections = 70;</div><div> .probe = {</div><div> .request =</div><div> "GET /healthcheck.php HTTP/1.1"</div><div> "Host: <a href="http://wiki.mydomain.com">wiki.mydomain.com</a>"</div><div> "Connection: close";</div><div> .interval = 10m;</div><div> .timeout = 60s;</div><div> .window = 3;</div><div> .threshold = 2;</div><div> }</div><div>}</div></div><div><br></div><div>And it still works with apache auth! In my googling, I found this old varnish ticket:</div><div><br></div><div><a href="https://www.varnish-cache.org/trac/ticket/1165">https://www.varnish-cache.org/trac/ticket/1165</a><br></div><div><br></div><div>That describes how to get apache auth working with varnish by passing the headers to .request. </div><div><br></div><div>And since I'm only using this for a mediawiki, I found a good example VCL on their site that they recommend for using with mediawiki. I've adapted it to my uses and it seems to be doing a good job of caching the site.</div><div><br></div><div>I'm really glad this works and I appreciate your input and feedback.</div><div><br></div><div>Thanks,</div><div>Tim</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jul 3, 2015 at 4:00 PM, Tim Dunphy <span dir="ltr"><<a href="mailto:bluethundr@gmail.com" target="_blank">bluethundr@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hey guys,<div><br></div><div> Thanks for your suggestions!! However, I'm still not having any luck. This is what I tried. I logged into one of my webservers and then altered the config so that it won't require authorization to access the healthcheck URL:</div><div><br></div><div><div><VirtualHost *:80></div><div> ServerName <a href="http://wiki.mydomain.com" target="_blank">wiki.mydomain.com</a></div><div> ServerAlias <a href="http://www.wiki.mydomain.com" target="_blank">www.wiki.mydomain.com</a></div><div> Options +Indexes +FollowSymlinks</div><div> LogLevel debug</div><div> ErrorLog logs/wiki-error.log</div><div> LogFormat "%h %l %u %t \"%r\" %>s %b" common</div><div> CustomLog logs/wiki-access_log common</div><div> DocumentRoot /var/www/jf/wiki</div><div> <b>SetEnvIf Request_URI ^/healthcheck.php/ noauth=1</b></div><div><br></div><div> <Directory /var/www/jf/wiki></div><div> Options Indexes</div><div> AuthType Basic</div><div> AuthName "JF Wiki Page"</div><div> AuthUserFile /etc/httpd/auth</div><div> Require valid-user</div><div> <b> Allow from env=noauth</b></div><div> </Directory></div><div><br></div><div> <Directory /var/www/jf/wiki/images></div><div> Options -Indexes</div><div> </Directory></div><div></VirtualHost></div></div><div><br></div><div>I've highlighted in bold what I changed in the config. Then copied the config over to the other web server and restarted apache on both. </div><div><br></div><div>Both of the web hosts are still turning up as 'sick' in the varnish log:</div><div><br></div><div><div> 0 Backend_health - web2 Went sick 4--X-R- 2 3 5 0.015589 0.000000 HTTP/1.1 401 Unauthorized</div><div> 0 Backend_health - web1 Went sick 4--X-R- 2 3 5 0.045081 0.000000 HTTP/1.1 404 Not Found</div></div><div><br></div><div>So then I tried Paul's suggestion to tell varnish to expect a 401 response for the probe. I'm not sure if I interpreted this request correctly, but this is what I tried: </div><div><br></div><div><div>if ( req.url ~ "^/healthcheck.php") {</div><div> error 401;</div><div> }</div></div><div><br></div><div>And there was no change in the result after restarting varnish. Both web servers are still turning up 'sick' in the varnish log.</div><div><br></div><div>Could I get some advice on where I'm going wrong here? And maybe if there is another approach I could try, I'd be up for trying anything that might work.</div><div><br></div><div>Thanks again for your help!!</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>Tim</div></font></span></div><div class="gmail_extra"><div><div class="h5"><br><div class="gmail_quote">On Mon, Jun 29, 2015 at 3:27 AM, Tobias Eichelbrönner <span dir="ltr"><<a href="mailto:tobias.eichelbroenner@lamp-solutions.de" target="_blank">tobias.eichelbroenner@lamp-solutions.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Tim,<br>
<span><br>
> Backend_health - web2 Still sick 4--X-R- 0 3 5 0.014946 0.000000<br>
> HTTP/1.1 401 Unauthorized<br>
<br>
</span>seems to me your healthcheck on<br>
.url = "/healthcheck.php";<br>
does not send any authorization to your backend, so the probing fails.<br>
The most simple solution is the disable authorization for<br>
healthcheck.php in you Webserver.<br>
<br>
Keep in mind that if more then one user access your restricted area they<br>
probably get the cached contend from the other user delivered. You could<br>
put authorization header into the hash in give every user a different<br>
password.<br>
<br>
Sincerely,<br>
<br>
Tobias<br>
<br>
--<br>
LAMP solutions GmbH<br>
Gostenhofer Hauptstrasse 35<br>
90443 Nuernberg<br>
<br>
Amtsgericht Nuernberg: HRB 22366<br>
Geschaeftsfuehrer: Heiko Schubert<br>
<br>
Es gelten unsere allgemeinen Geschaeftsbedingungen.<br>
<a href="http://www.lamp-solutions.de/agbs/" rel="noreferrer" target="_blank">http://www.lamp-solutions.de/agbs/</a><br>
<br>
Telefon : 0911 / 376 516 0<br>
Fax : 0911 / 376 516 11<br>
E-Mail : <a href="mailto:support@lamp-solutions.de" target="_blank">support@lamp-solutions.de</a><br>
Web : <a href="http://www.lamp-solutions.de" rel="noreferrer" target="_blank">www.lamp-solutions.de</a><br>
Facebook : <a href="http://www.facebook.com/LAMPsolutions" rel="noreferrer" target="_blank">http://www.facebook.com/LAMPsolutions</a><br>
Twitter : <a href="http://twitter.com/#!/lampsolutions" rel="noreferrer" target="_blank">http://twitter.com/#!/lampsolutions</a><br>
<br>
_______________________________________________<br>
varnish-misc mailing list<br>
<a href="mailto:varnish-misc@varnish-cache.org" target="_blank">varnish-misc@varnish-cache.org</a><br>
<a href="https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc" rel="noreferrer" target="_blank">https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc</a><br>
</blockquote></div><br><br clear="all"><div><br></div></div></div><span class="">-- <br><div>GPG me!!<br><br>gpg --keyserver <a href="http://pool.sks-keyservers.net" target="_blank">pool.sks-keyservers.net</a> --recv-keys F186197B<br><br></div>
</span></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">GPG me!!<br><br>gpg --keyserver <a href="http://pool.sks-keyservers.net" target="_blank">pool.sks-keyservers.net</a> --recv-keys F186197B<br><br></div>
</div>