MediaWiki mit Varnish Cache und NGINX Proxy

=== MediaWiki / Varnish Cache aktivieren ===
LocalSettings.php
# Enable Varnish Cache Purge
$wgUseCdn = true;
$wgCdnServers = [ '127.0.0.1', '192.168.1.4:6081' ];
$wgCdnServersNoPurge = [ '192.168.1.4' ];
Die IP 192.168.1.4 entspricht in diesem Beispiel der Adresse des Varnish Servers.
Da Varnish standardmäßig auf Port 6081 läuft, muss dieser in der Konfiguration von MediaWiki mit angegeben werden.
Aufgrund eines Bugs muss die IP gleichzeitig bei $wgCdNServersNoPurge angegeben werden sobald man einen Port definiert.https://www.mediawiki.org/wiki/Manual:$wgCdnServers#Details
=== NGINX Proxy einrichten ===
sudo vi /etc/nginx/proxy_params
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# Nur bei HTTPS
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port 443;
proxy_set_header HTTPS "on";
HTTP *:80 (Ohne Umleitung auf HTTPS) :
Nicht empfehlenswert
server {
 listen 80;
 server_name my.domain.de;
 
		location / {
 include /etc/nginx/proxy_params;
 proxy_pass http://127.0.0.1:6081;
 }
}
HTTP *:80 (Mit Umleitung auf HTTPS):
server {
 listen 80;
 server_name my.domain.de;
 return 301 https://$host$request_uri;
}
HTTPS *:443
server {
 listen 443 ssl;
 server_name my.domain.de;
 add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
 location / {
 include /etc/nginx/proxy_params;
 proxy_pass http://127.0.0.1:6081;
 }
 client_max_body_size 0;
		# Certbot auto-configuration
 ssl_certificate /etc/letsencrypt/live/my.domain.de/fullchain.pem; # managed by Certbot
 ssl_certificate_key /etc/letsencrypt/live/my.domain.de/privkey.pem; # managed by Certbot
 include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
 ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
=== Varnish Server einrichten ===
/etc/varnish/default.vcl
vcl 4.0;
# set default backend if no server cluster specified
backend default {
 .host = "192.168.2.5";
 .port = "80";
}
# access control list for "purge": open to only localhost and other local nodes
acl purge {
 "127.0.0.1";
 "192.168.2.5";
}
# vcl_recv is called whenever a request is received
sub vcl_recv {
 # Serve objects up to 2 minutes past their expiry if the backend
 # is slow to respond.
 # set req.grace = 120s;
 set req.http.X-Forwarded-For = req.http.X-Forwarded-For + ", " + client.ip;
 set req.backend_hint= default;
 # This uses the ACL action called "purge". Basically if a request to
 # PURGE the cache comes from anywhere other than localhost, ignore it.
 if (req.method == "PURGE") {
 if (!client.ip ~ purge) {
 return (synth(405, "Not allowed."));
 } else {
 return (purge);
 }
 }
 # Pass requests from logged-in users directly.
 # Only detect cookies with "session" and "Token" in file name, otherwise nothing get cached.
 if (req.http.Authorization || req.http.Cookie ~ "session" || req.http.Cookie ~ "Token") {
 return (pass);
 } /* Not cacheable by default */
 # normalize Accept-Encoding to reduce vary
 if (req.http.Accept-Encoding) {
 if (req.http.User-Agent ~ "MSIE 6") {
 unset req.http.Accept-Encoding;
 } elsif (req.http.Accept-Encoding ~ "gzip") {
 set req.http.Accept-Encoding = "gzip";
 } elsif (req.http.Accept-Encoding ~ "deflate") {
 set req.http.Accept-Encoding = "deflate";
 } else {
 unset req.http.Accept-Encoding;
 }
 }
 return (hash);
}
sub vcl_pipe {
 # Note that only the first request to the backend will have
 # X-Forwarded-For set. If you use X-Forwarded-For and want to
 # have it set for all requests, make sure to have:
 # set req.http.connection = "close";
 # This is otherwise not necessary if you do not do any request rewriting.
 set req.http.connection = "close";
}
# Called if the cache has a copy of the page.
sub vcl_hit {
 if (!obj.ttl > 0s) {
 return (pass);
 }
 # Force lookup if the request is a no-cache request from the client.
 if (req.http.Cache-Control ~ "no-cache") {
 return (miss);
 }
}
# Called after a document has been successfully retrieved from the backend.
sub vcl_backend_response {
 # Don't cache 50x responses
 if (beresp.status == 500 || beresp.status == 502 || beresp.status == 503 || beresp.status == 504) {
 set beresp.uncacheable = true;
 return (deliver);
 }
 if (beresp.ttl < 48h) {
 set beresp.ttl = 48h;
 }
 if (!beresp.ttl > 0s) {
 set beresp.uncacheable = true;
 return (deliver);
 }
 if (beresp.http.Set-Cookie) {
 set beresp.uncacheable = true;
 return (deliver);
 }
# if (beresp.http.Cache-Control ~ "(private|no-cache|no-store)") {
# set beresp.uncacheable = true;
# return (deliver);
# }
 if (beresp.http.Authorization && !beresp.http.Cache-Control ~ "public") {
 set beresp.uncacheable = true;
 return (deliver);
 }
 return (deliver);
}
== Erweiterung 'Visual Editor' ==
Hinter einem Proxyserver, speziell einem mit SSL, muss für den Visual Editor die Konfiguration in der LocalSettings.php angepasst werden.
# Set internal Server address
$wgInternalServer = "http://192.168.2.6";
# Special config for Visual Editor behind https Proxy
wfLoadExtension( 'Parsoid', "$IP/vendor/wikimedia/parsoid/extension.json" );
$wgVirtualRestConfig['modules']['parsoid'] = array(
 // URL to the Parsoid instance.
 // You should change $wgServer to match the non-local host running Parsoid
 'url' => $wgInternalServer . $wgScriptPath . '/rest.php',
 // Parsoid "domain", see below (optional, rarely needed)
 // 'domain' => 'localhost',
);
== Siehe auch ==
NGINX installieren (AlmaLinux/CentOS)
NGINX installieren (Raspberry Pi)
Reverse Proxy mit NGINX
== Quellen ==
https://www.mediawiki.org/wiki/Manual:$wgCdnServers
=== Einzelnachweise ===