<div dir="ltr">So, if I understood, that's Apache in front of Varnish, not the other way around. But let's not get lost on semantics<div><br></div><div>Varnish fanboy version: drop Apache, and use Hitch (<a href="http://hitch-tls.org/">http://hitch-tls.org/</a>) to handle SSL/TLS. That only works if Apache is only there for SSL termination and not for other tasks not performed by Varnish (if so, which ones?)</div><div>With it you can just test the server port used (std.port(server.ip) == 443) to determine you are using https.</div><div><br></div><div>Apache clean version: use the PROXY protocol. Not sure Apache is able to do it, haven't looked. That way, apache can behave like hitch and you don't lose the client.ip info.</div><div><br></div><div>Apache dirty version: used the x-forwarded-for header to tell varnish who sent the request, then use vmod_std to convert that string to an ip. Ugly, but works.</div><div><br></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>-- <br></div>Guillaume Quintard<br></div></div></div>
<br><div class="gmail_quote">On Tue, Aug 15, 2017 at 11:39 AM, Admin Beckspaced <span dir="ltr"><<a href="mailto:admin@beckspaced.com" target="_blank">admin@beckspaced.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<p><font face="Tahoma">Hello there ;)</font></p>
<p>I'm running varnish in front of my apache on port 80 without any
issues so far.<br>
<br>
Recently I decided to also use varnish for SSL connections<br>
<br>
To do so I first do a http to https redirect within varnish VCL<br>
<br>
if ( req.http.X-Forwarded-Proto !~ "(?i)https" ) {<br>
return (synth(750, ""));<br>
}<br>
<br>
then in vcl_synth()<br>
<br>
sub vcl_synth {<br>
<br>
if (resp.status == 750) {<br>
set resp.status = 301;<br>
set resp.http.Location = <a class="m_6179607148152279838moz-txt-link-rfc2396E">"https://"</a> +
req.http.host + req.url;<br>
return(deliver);<br>
}<br>
}<br>
<br>
This works fine and all http got redirected to https<br>
<br>
Then on port 443 I got apache listening as a reverse proxy with
the following config:<br>
<br>
<VirtualHost *:443><br>
<br>
ServerName <a href="http://somedomain.com" target="_blank">somedomain.com</a><br>
ServerAlias *.<a href="http://somedomain.org" target="_blank">somedomain.org</a><br>
<br>
SSLEngine on</p>
<p> ... ssl cert stuff here ...<br>
</p>
ProxyPreserveHost On<br>
ProxyPass / <a class="m_6179607148152279838moz-txt-link-freetext" href="http://127.0.0.1:80/" target="_blank">http://127.0.0.1:80/</a><br>
ProxyPassReverse / <a class="m_6179607148152279838moz-txt-link-freetext" href="http://127.0.0.1:80/" target="_blank">http://127.0.0.1:80/</a><br>
RequestHeader set X-Forwarded-Port "443"<br>
RequestHeader set X-Forwarded-Proto "https"<br>
<p></VirtualHost><br>
<br>
Also this works perfectly fine! Apache does the SSL termination
and then reverse proxies everything back to varnish on port 80<br>
<br>
If I have a look in the apache ssl log:<br>
<br>
[15/Aug/2017:02:03:41 +0200] 35.190.201.122 TLSv1.2
ECDHE-RSA-AES128-GCM-SHA256 "GET /feed/ HTTP/1.1" -
<a class="m_6179607148152279838moz-txt-link-rfc2396E" href="http://domain.org/feed/" target="_blank">"http://domain.org/feed/"</a> "Go-http-client/1.1"<br>
[15/Aug/2017:02:03:41 +0200] 35.190.201.122 TLSv1.2
ECDHE-RSA-AES128-GCM-SHA256 "GET /feed HTTP/1.1" 10513
<a class="m_6179607148152279838moz-txt-link-rfc2396E" href="https://domain.org/feed/" target="_blank">"https://domain.org/feed/"</a> "Go-http-client/1.1"<br>
<br>
If I look in the varnishlog I see the following:<br>
<br>
<a href="http://domain.org" target="_blank">domain.org</a> 35.190.201.122 - - [15/Aug/2017:02:03:41 +0200] "GET
<a class="m_6179607148152279838moz-txt-link-freetext" href="http://domain.org/feed/" target="_blank">http://domain.org/feed/</a> HTTP/1.1" 301 0 "-" "Go-http-client/1.1"<br>
<a href="http://domain.org" target="_blank">domain.org</a> 127.0.0.1 - - [15/Aug/2017:02:03:41 +0200] "GET
<a class="m_6179607148152279838moz-txt-link-freetext" href="http://domain.org/feed/" target="_blank">http://domain.org/feed/</a> HTTP/1.1" 301 0 <a class="m_6179607148152279838moz-txt-link-rfc2396E" href="http://domain.org/feed/" target="_blank">"http://domain.org/feed/"</a>
"Go-http-client/1.1"<br>
<a href="http://domain.org" target="_blank">domain.org</a> 127.0.0.1 - - [15/Aug/2017:02:03:41 +0200] "GET
<a class="m_6179607148152279838moz-txt-link-freetext" href="http://domain.org/feed" target="_blank">http://domain.org/feed</a> HTTP/1.1" 200 10513
<a class="m_6179607148152279838moz-txt-link-rfc2396E" href="https://domain.org/feed/" target="_blank">"https://domain.org/feed/"</a> "Go-http-client/1.1"<br>
<br>
But in the process of Varnish -> Redirect http to https ->
Apache Reverse Proxy -> Varnish I loose the client IP address
in varnishlog<br>
It jsut says 127.0.0.1<br>
<br>
How can I forward the client IP to varnishlog in this process?<br>
<br>
I need to have the client IP in varnishlog as I use those to
generate statistics about the website.<br>
<br>
any help, hints or insights would be awesome ;)<br>
<br>
Thanks & greetings<br>
Becki<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
</font></span></p><span class="HOEnZb"><font color="#888888">
<pre class="m_6179607148152279838moz-signature" cols="72">--
Beckspaced - Server Administration
------------------------------<wbr>------------------
Ralf Flederer
Marienplatz 9
97353 Wiesentheid
Tel.: 09383-9033825
Mobil: 01577-7258912
Internet: <a class="m_6179607148152279838moz-txt-link-abbreviated" href="http://www.beckspaced.com" target="_blank">www.beckspaced.com</a>
------------------------------<wbr>------------------</pre>
</font></span></div>
<br>______________________________<wbr>_________________<br>
varnish-misc mailing list<br>
<a href="mailto:varnish-misc@varnish-cache.org">varnish-misc@varnish-cache.org</a><br>
<a href="https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc" rel="noreferrer" target="_blank">https://www.varnish-cache.org/<wbr>lists/mailman/listinfo/<wbr>varnish-misc</a><br></blockquote></div><br></div>