Merge pull request #53 from zazuko/purge-acl

Purge ACL

.changeset/olive-icons-guess.md

@@ -0,0 +1,10 @@
+---
+"varnish-post": minor
+---
+
+It is now possible to configure purge ACL, by setting the `PURGE_ACL` to a relevant hostname or IP CIDR.
+
+By default, the `PURGE_ACL` is set to `localhost`.
+This means that only requests coming from the same host as the Varnish container will be able to purge the cache.
+
+You can set the `PURGE_ACL` to `0.0.0.0/0` to allow all hosts to purge the cache for example, or a more specific IP CIDR.

.github/workflows/docker.yaml

@@ -53,6 +53,3 @@ jobs:
           platforms: |
             linux/amd64
             linux/arm64
-            linux/ppc64le
-            linux/s390x
-            linux/arm/v7

.gitignore

@@ -1 +1,2 @@
 node_modules/
+./package-lock.json

Dockerfile

@@ -25,6 +25,7 @@ ENV DISABLE_ERROR_CACHING_TTL="30s"
 ENV CONFIG_FILE="default.vcl"
 ENV ENABLE_LOGS="true"
 ENV ENABLE_PROMETHEUS_EXPORTER="false"
+ENV PURGE_ACL="localhost"
 
 # Install some dependencies
 RUN apt-get update \

README.md

@@ -20,6 +20,7 @@ You can use following environment variables for configuration:
 
 - `BACKEND_HOST`: host of the backend to cache (default: `localhost`)
 - `BACKEND_PORT`: port of the backend to cache (default: `3000`)
+- `VARNISH_SIZE`: size of the cache in the RAM (default: `100M`)
 - `BACKEND_FIRST_BYTE_TIMEOUT`: first byte timeout (default: `60s`)
 - `CACHE_TTL`: time to cache the request (default: `3600s`)
 - `BODY_SIZE`: maximum size for the body ; if it exceeds this value, it will not be cached (default: `2048KB`)
@@ -29,9 +30,15 @@ You can use following environment variables for configuration:
 - `ENABLE_LOGS`: enable logs (default: `true`)
 - `ENABLE_PROMETHEUS_EXPORTER`: enable the Prometheus exporter if set to `true` (default: `false`).
   If enabled, the exporter will be available on the 9131 port.
+- `PURGE_ACL`: custom ACL for the PURGE method (default: `localhost`) ; you can use `0.0.0.0/0` to allow all.
 
 ## Cache invalidation
 
 You can invalidate the cache entry by sending the same request with the `PURGE` method.
 
 If your backend is sending a `xkey` header, if you send a `PURGE` request with the same `xkey` header, it will invalidate all cache entries with the same tag.
+
+## License
+
+This project is licensed under the MIT License.
+See the [LICENSE](./LICENSE) file for details.

config/default.vcl

@@ -4,6 +4,10 @@ import std;
 import bodyaccess;
 import xkey;
 
+acl purge {
+  $PURGE_ACL;
+}
+
 # Backend server that should be cached
 backend default {
   .host = "$BACKEND_HOST";
@@ -38,6 +42,9 @@ sub vcl_recv {
 
   # Handle PURGE requests
   if (req.method == "PURGE") {
+    if (!client.ip ~ purge) {
+      return (synth(405, "Method Not Allowed"));
+    }
     if (req.http.xkey) {
       set req.http.n-gone = xkey.purge(req.http.xkey);
       return (synth(200, "Invalidated " + req.http.n-gone + " objects"));

entrypoint.sh

@@ -5,6 +5,22 @@ ENABLE_PROMETHEUS_EXPORTER="${ENABLE_PROMETHEUS_EXPORTER}"
 
 set -eu
 
+# Function to transform a host into a VCL-friendly format
+transform_host() {
+  input="$1"
+
+  # Check if input is in CIDR notation (e.g., 0.0.0.0/0)
+  if echo "$input" | grep -q "/"; then
+    ip_part=$(echo "$input" | cut -d'/' -f1)
+    cidr_part=$(echo "$input" | cut -d'/' -f2)
+    echo "\"$ip_part\"/$cidr_part"
+  else
+    # Otherwise, it's a regular hostname or IP
+    echo "\"$input\""
+  fi
+}
+PURGE_ACL=$(transform_host "${PURGE_ACL}")
+
 # Environment variables substitution
 for SRC_LOCATION in $(find /templates -type f); do
   DST_LOCATION=$(echo "${SRC_LOCATION}" | sed 's/^\/templates/\/etc\/varnish/')
@@ -26,6 +42,9 @@ if [ "${ENABLE_PROMETHEUS_EXPORTER}" = "true" ]; then
     -web.telemetry-path "/metrics") &
 fi
 
+# Display Varnish configuration
+cat "/etc/varnish/${CONFIG_FILE}"
+
 set -x
 
 # Run Varnish

test/docker-compose.yaml

@@ -12,3 +12,4 @@ services:
       - BACKEND_HOST=backend
       - BACKEND_PORT=8080
       - CACHE_TTL=2s
+      - PURGE_ACL=0.0.0.0/0