inviqa/chef-magento — pull request #14 by svalaskevicius (2012-11-05 13:50:13+00:00)
Title: Feature/limit access to ips

add functionality to limit apache site under varnish for the list of IPs, and present basic auth if the user comes from a different IP than given in the configurable whitelist. This functionality is primarily intended for qa and staging sites - production environment should have it turned off.

if chef detects apache site being used on the same node as varnish instance is and the current mode is not SSL (=> requests coming from varnish), then the source ip white list checking in the apache vhost is replaced by checking the proxy header, which is set by varnish

varnish checks the same whitelist as well and pipes non authorised requests for apache to generate basic auth request (possible improvement: use synthetic response directly from varnish)

if such authorisation is used, piping the site in vcl is replaced with pass, as then it will set the proxy header correctly