Fix vcl indenting
Prevent PURGE requests when X-Real-IP is present

All requests coming into Varnish have a client.ip of localhost as they
come from Nginx on the same machine. This change checks for the
X-Real-IP header that is set by Nginx and prevents PURGE requests if it
is present.

This is really nasty. Unfortunately Varnish doesn't let you check
arbitrary headers against an acl.
Allow PURGE requests on www domain

We have logic that switches between the backdrop read and write APIs
based on the verb. This catches PURGE requests and allows them to be
passed on to get handled by the PURGE section below.
Move PURGE http verb filtering into nginx

Rather than preventing external PURGE requests in Varnish handle it in
the externally facing Nginx vhost.

Checking that a request came through Nginx by checking for the presence
of a header that it sets is horribly opaque.
Upgrade puppet-nginx to allow verb filtering

Upgrade puppet-nginx to allow filtering by HTTP verb. This is used by
the stagecraft vhost to prevent PURGE requests from outside.
Use a hiera lookup instead of a non-existant global to restrict access

- Should restrict access to the outside world (not in Aviation house)
- We were never setting `::pp_only_vhost` in the global namespace
- hiera lookup should work on a per-environment basis
- Tested in VM, #TODO write a test around this!
fix logic, as is a boolean
Merge pull request #307 from alphagov/gds_only

Use a hiera lookup instead of a non-existant global to restrict access
Merge pull request #296 from alphagov/allow-purge-on-www

Improve PURGE request handling in Varnish
Use the same set of dnsmasq cnames everywhere

Before we had a different set of cnames used on the jumpbox. It was
unclear why and caused pp-smokey to fail.
Merge pull request #308 from alphagov/use-same-cnames-everywhere

Use the same set of dnsmasq cnames everywhere
Set password when creating dev postgres role

When creating the stagecraft postgres role in development we need to
also provide the password.
Use correct varnish version in default.vcl link
Allow Varnish to cache authorised requests

By default Varnish will not cache any requests with a Cookie or an
Authorization header. This change tells Varnish to lookup GET or HEAD
requests if the Authorization header is set.

This obviously raises the risk of sending a cached response to an
unauthorised client. This is mitigated by the backend app sending a Vary
header set to 'Authorized'.
Merge pull request #309 from alphagov/fix-dev-stagecraft-psql-pass

Set password when creating dev postgres role
Do not set stagecraft hostname in dev vcl

The nginx vhost for stagecraft has a server_name of
stagecraft.perfplat.dev which is the same host name that should be
coming into Varnish. So, let's just leave it be.
Merge pull request #310 from alphagov/varnish-caching

Varnish caching
Switch from smarchive/archive on Forge to GitHub

It's disappeared from the Forge and installing dependencies fails.

Fixes #311.
Merge pull request #312 from alphagov/smarchive-archive-fix

Switch from smarchive/archive on Forge to GitHub
Make PostgreSQL backups readable with chmod

So that our deploy user can fish them off the box and copy them to the
backups box.