plone.recipe.varnish 6.0.13.1
Build and/or configure Varnish Cache with zc.buildout
License: BSD
Requires Python: !=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,>=2.7
Keywords: buildout varnish cache proxy

.. This README is meant for consumption by humans and PyPI. PyPI can render rst files so please do not use Sphinx features.
   If you want to learn more about writing documentation, please check out: http://docs.plone.org/about/documentation_styleguide.html
   This text does not appear on PyPI or github. It is a comment.

.. image:: https://github.com/collective/plone.recipe.varnish/actions/workflows/tests.yml/badge.svg
    :target: https://github.com/collective/plone.recipe.varnish/actions/workflows/tests.yml

.. image:: https://img.shields.io/pypi/v/plone.recipe.varnish.svg
    :target: https://pypi.python.org/pypi/plone.recipe.varnish/
    :alt: Latest Version

.. image:: https://img.shields.io/pypi/pyversions/plone.recipe.varnish.svg?style=plastic
   :target: https://pypi.python.org/pypi/plone.recipe.varnish/
   :alt: Supported - Python Versions

.. image:: https://img.shields.io/pypi/l/plone.recipe.varnish.svg
    :target: https://pypi.python.org/pypi/plone.recipe.varnish/
    :alt: License

Varnish recipe for buildout
===========================

plone.recipe.varnish is a `zc.buildout`_ recipe to install `Varnish`_. Even
though the name contains the name Plone, there is nothing Plone-specific about
this recipe: it works for non-Zope sites just as well.

PLEASE NOTE: Version 6.x of this recipe now 'supports' Varnish 6.0 LTS only. Template
generation support for older unsupported Varnish versions or the intermediate
development versions have been removed.  Varnish Software (the company) has switched
to a half yearly time boxed release cycles without rigorous quality assurance, from
which an lts version is picked when deemed stable enough.

If you have custom vcl and/or want to use your current recipe, you can keep
plone.recipe.varnish pinned to versions 2.x, or you can use this 6.x version of the
recipe, but provide parameters for a custom download url and custom vcl file.


Configuring it is very simple. For example::

    [varnish-build]
    recipe = plone.recipe.varnish:build

    [varnish-configuration]
    recipe = plone.recipe.varnish:configuration
    backends = 127.0.0.1:8081

    [varnish-script]
    recipe = plone.recipe.varnish:script
    bind = 127.0.0.1:8000
    cache-size = 512M


This configures three buildout parts:

``varnish-build``
    which will download, compile and install varnish,

``varnish-configuration``
    which generates the VCL configuration file,
    sending requests to a backend at 127.0.0.1:8081, and

``varnish-script``
    which runs Varnish, configured to listen on 127.0.0.1:8000 for requests,
    using a 512 megabyte cache.

A wrapper script for the varnish startup command is created in the ``bin``
directory of your buildout.

Please note that the configuration generated by this recipe is specifically
meant for the latest LTS version of Varnish, version 6.0.x .


Area's of interest to look at when you use this recipe
------------------------------------------------------

Even though this recipe tries to provide sane defaults for most parameters for
a drop in placement, there are a few area's of expertise which you can learn
about to understand and test for a performant but stable Varnish set up.

* If you use this recipe, you will use buildout and a common setup for
  'single' projects is that your Varnish will only cache for one Plone site. An
  inherent problem with caching is cache invalidation: when an editor changes a
  page you want to make sure the next delivery for this content item fetched
  freshly from the backend (Plone) site. Plone's caching setup can be configured
  to send a purge requests for changed content to Varnish. The calculated has
  plays an essential role in this type of purging: if the calculated hash from
  the client request is different from the calculated hash on the purge request,
  purging will fail.

* There are clever alternative purge request setups, which can improve freshness
  but you really have to know what you are doing and experience so far is that
  more advanced schemes have broken between Varnish upgrades.

* Especially if you have multiple backends and you let Varnish do the load
  balancing, don't forget to enable the grace-sick and grace-healthy options.
  When the recipe notices there parameters, it automatically enables health probe
  settings in the generated vcl. grace helps serving pages temporarily when your
  backends are temporarily down.

* As soon as a cookie appears on an incoming request, Varnish will not cache the request
  and even store the url in a 'hit for pass' buffer so that subsequent similar requests
  don't get delayed by waiting in the backend request queue. The generated vcl has a function
  which strips off most irrelevant cookies from incomiing requests before they get passed
  to the backend to increase cache hit rate. the __ac cookie is the most notable exception,
  this indicates for Plone that a user is logged in and caching should be disabled.

* You can monitor Varnish caching operations in great detail by learning how to
  use varnishlog and the query language, but it will take at least a few hours if
  you have never used this tool before. It is easy to draw the wrong conclusions
  from just poking around a bit in varnishlog and seeing hits or misses.


Virtual hosting
---------------

Varnish supports virtual hosting by selecting a different backend server
based on headers on the incoming request. You can configure the backends
through the backends option::

  [varnish-configuration]
  backends =
     plone.org:127.0.0.1:8000
     plone.net:127.0.0.1:9000

This will generate a configuration which sends all traffic for the plone.org
host to a backend server running on port 8000 while all traffic for the
plone.net host is send to port 9000.


Zope 2 hosting (with Virtual Host Monster)
------------------------------------------

If you are using Zope 2 as backend server you will need to rewrite the URL
so the Zope Virtual Host Monster (VHM) can generate correct links for links in
your pages. This can be done either by a web server such as Apache or nginx
(placed either in front or behind Varnish) but can also be done by Varnish itself.

The three options are described below.

Option 1 (rewrites after Varnish)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If generating these VHM-style URLs in a proxy *behind* Varnish (or if using
VHM's 'mapping' feature), no extra Varnish configuration is needed.
Just make sure the ``backends`` option directs the traffic to the proxy.

Option 2 (rewrites before Varnish)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If generating these VHM-style URLs in a proxy *in front* of Varnish, no extra
Varnish configuration is needed as long as the original hostname is still retained
in the URL. If the hostname is not retained, you can tell Varnish to direct requests
based on the "path" instead of the hostname.  For example::

  [varnish-configuration]
  backends =
    /VirtualHostBase/http/plone.org:80/Plone:127.0.0.1:8000
    /VirtualHostBase/http/plone.net:80/Plone:127.0.0.1:9000

This will generate a configuration which sends all traffic for any request whose
path starts with ``/VirtualHostBase/http/plone.org:80/Plone`` to a backend server
running at 127.0.0.1 on port 8000, while request paths starting with
``/VirtualHostBase/http/plone.net:80/Plone`` are sent to port 9000.

Option 3 (rewrites within Varnish)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

To have Varnish generate these VHM-style URLs, you can use the
``zope2_vhm_map`` option.
Here is an example::

  [varnish-configuration]
  zope2_vhm_map =
      plone.org:/plone
      plone.net:/plone

This tells us that the domain plone.org should be mapped to the location
``/plone`` in the backend. By combining this with the information from the
``backends`` option a varnish configuration will be generated that
maps URLs correctly.

Load Balancing
--------------

Varnish supports load balancing by configuring a director for a pool of backends.
This director sends the incoming requests that cannot be fulfilled by varnish to
backends in the pool in either random or round robin fashion. You can configure
the director via the ``balancer`` option::

  [varnish-configuration]
  balancer = random

This will generate a configuration which sends all traffic to the director,
which will choose a 'random' backend server to fulfill the request if the
content requested is not cached by varnish itself.


plone.recipe.varnish reference
------------------------------

The ``plone.recipe.varnish`` recipe does one or more of the following:

``plone.recipe.varnish:build``
    compiles varnish from sources

``plone.recipe.varnish:configuration``
    generates a VCL-configuration file

``plone.recipe.varnish:script``
    generates a wrapper script inside your buildout that will start Varnish
    with the correct configuration.



Build varnish from sources
~~~~~~~~~~~~~~~~~~~~~~~~~~

``build`` is based on
`zc.recipe.cmmi <https://pypi.python.org/pypi/zc.recipe.cmmi>`_ - so all
parameters from that recipe are available here too (but rarely used). These options are available for the recipe part plone.recipe.varnish:build.

Three parameters are different/ extra:

``url``
    Location used for download of varnish sources. Defaults to the latest LTS version.

``jobs``
    Passes the number of parallel jobs to ``make``, defaults to ``4``. Adjust as
    needed to your CPU resources.

``compile-vmods``
    Boolean flag defaults to False, used for building Varnish modules. By defaults,
    the Varnish modules are from `module collection by Varnish Software
    <https://github.com/varnish/varnish-modules/releases>`_

VCL Configuration Generator
~~~~~~~~~~~~~~~~~~~~~~~~~~~

These options are available for the recipe part plone.recipe.varnish:configuration.

``backends``
    Specifies the backend or backends which will process the (uncached)
    requests. The syntax for backends:

    ``[<hostname>][/<path>]:<ip address>:<port>``

    The optional ``hostname`` and ``path`` allows you to do virtual hosting.
    If multiple backends are specified then each backend must include
    either a hostname or path (or both) so that Varnish can direct the
    matching request to the appropriate backend. Defaults to
    ``127.0.0.1:8080``.

``balancer``
    If included and set to either ``random`` or ``round_robin``, this option
    configures varnish to load balance the servers specified by the ``backends``
    directive. Possible values: ``none`` (default), ``round_robin`` or
    ``random``.

``between-bytes-timeout``
    If specified, this option configures the timeout (in seconds) for Varnish
    waiting between bytes when receiving data from a backend. Varnish will only
    wait this many seconds between bytes before giving up. A value of 0s means
    this will never time out. Defaults to *60s*, as per Varnish's default
    settings.

``bind``
    Hostname and port on which Varnish will listen for requests. Defaults
    to ``127.0.0.1:8000``.

``connect-timeout``
    If specified, this option configures the connection timeout (in seconds)
    for Varnish connecting to a backend server. Varnish will only try to
    connect to a given backend for this many seconds before giving up. Defaults
    to 0.4s, as per Varnish's default settings.

``cookie-pass``
    This list consists of lines with a cookie-match and urlexclude in the form:
    ``"cookiematch":"urlexcludes"``. If *cookiematch* applies for the cookiename,
    then the request is passed directly to the configured backend
    bypassing any caching. Additionally, if the current url matches urlexcludes,
    then the cookies are removed, and the request piped to the backend.
    Defaults are optimized for Plone, one line:
    ``"auth_token|__ac(|_(name|password|persistent))=":"\.(js|css|kss)$"``
    So when you are authenticated, the request is always handled by Plone.
    When an authenticated user requests a js/css/kss file,
    Plone will see you as anonymous because no cookies reach Plone.

``cookie-pass-not-exclude``
    If url matches this regexp, ``cookie-pass`` exclude rules are skipped. This is useful
    for url like ``++resource++zmi`` that requires authentication also for resources
    like js, css, ...

``cookie-whitelist``
    When the ``cookie-pass`` is processed and does not match, this means you are
    anonymous, at least with the default ``cookie-pass`` settings.
    In that case, this whitelist is used to to sanitize cookie data on the request.
    Cookie data to be sent to the backend includes only cookies with the given names.
    Defaults are optimized for Zope2/Plone:
    ``statusmessages __ac _ZopeId __cp auth_token``
    The ``__ac`` and ``auth_token`` cookies should not be needed, as they are
    already in the ``cookie-pass`` list, but they are here for safety in case
    you have customized the ``cookie-pass`` setting to not include them.
    If you have custom code that sets cookies and needs to read them in the backend,
    then you must add the cookie names to this list.

``first-byte-timeout``
    If specified, this option configures the timeout (in seconds) for Varnish
    receiving the first byte from a backend. Varnish will only wait for this
    many seconds before giving up. A value of 0s means Varnish will never time
    out. Defaults to 300s.

``purge-hosts``
    Specifies hostnames or IP addresses for purge ACL. By default ``localhost`` and
    the backends are allowed to purge. Additional allowed hosts are listed here.

``vcl_recv``, ``vcl_hit``, ``vcl_miss``, ``vcl_backend_fetch``, ``vcl_backend_response``, ``vcl_deliver``, ``vcl_pipe``, ``vlc_purge``, ``vcl_hash``, ``vcl_import``, ``vcl_init``, ``vcl_pass``, ``vcl_synth``
    Insert arbitrary VCL code into the generated config.

``verbose-headers``
    Enable sending extra headers in responses that expose what varnish
    did with the request and the cache status. Useful for debugging
    cache settings and optimizations.
    Possible values: ``on`` or ``off`` (default).

``zope2_vhm_map``
    Defines a virtual host mapping for Zope servers. This is a list of
    ``hostname:ZODB location`` entries which specify the location inside
    Zope where the website for a virtual host lives.

``zope2_vhm_port``
    Defines a virtual host mapping port to use in the VHM URL to send back to
    clients. Useful if there is another port mapping in front of varnish, such
    as haproxy. Defaults to bind port.

``zope2_vhm_ssl``
    If specified, this maps VHM URLs to ``https`` for all requests.
    Possible values: ``on`` or ``off`` (default).

``zope2_vhm_ssl_port``
    Defines a virtual host mapping port to use in the VHM URL to send back to
    clients. Useful if there is another port mapping in front of varnish, such
    as haproxy. Defaults to 443.

``vcl-version``
    Varnish VCL format version.
    If not given it defaults to ``4.0``.

``health-probe-*``
    Settings for backend health probes. Probes are activated if `grace-healthy` is set.

    See https://varnish-cache.org/docs/6.0/reference/vcl.html#probes for a
    detailed explanation of each setting.

    * `health-probe-url`: defaults to ``/ok``
    * `health-probe-timeout`: defaults to ``5s``
    * `health-probe-interval`: defaults to ``15s``
    * `health-probe-window`: defaults to ``10``
    * `health-probe-threshold`: defaults to ``8``
    * `health-probe-initial`: If not given varnish will default to `threshold -1`

``grace-healthy``
    Grace in the context of Varnish means delivering otherwise expired objects
    when circumstances call for it. This can happen because:
    (1) the backend-director selected is down, or
    (2) a different thread has already made a request to the backend that's
    not yet finished.

    If the backend is healthy, accept objects that are this number of seconds
    old. Clients will be delivered content that is no more than number of
    seconds past its TTL.

    Format: number followed by a time unit: ms, s, m, h.

    Defaults to ``None``. If this is set to ``None`` the grace
    feature is disabled.

``grace-sick``
    If the backend is sick, accept objects that are this old.
    See also ``grace-healthy``.

    Format: number followed by a time unit: ms, s, m, h.

    Defaults to ``600s``. Should be greater than ``grace-healthy``.


To test the generated configuration for syntactic correctness, run
``varnishd -C -f ./parts/varnish-configuration/varnish.vcl``.


Create script to start varnish
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Start varnish as a daemon or in foreground with the given settings. These options are available for the recipe part plone.recipe.varnish:script.

``bind``
    Hostname and port on which Varnish will listen for requests. Defaults
    to ``127.0.0.1:8000``.

``build-part``
    References the buildout part in order to get settings from there. Defaults
    to ``varnish-build``. Set it to ``false`` in order to switch it off.

``cache-location``
    Customise the location for the Varnish file storage.  Option only applicable
    when used with ``file`` or ``persistent`` cache-type options.  Defaults to
    using a file named ``storage`` inside the relevant parts directory
    (eg ``parts/varnish/storage``).  Changing the default location can be
    useful in putting the storage somewhere with quicker read speeds
    (e.g. RAM disk).

``cache-size``
    The size of the cache (limited to 2G on 32bit systems). Defaults to
    256M.

``cache-type``
    Specify the type of cache storage to use with Varnish.
    Possible values: ``file`` (storage for each object is allocated from an
    arena backed by a file),
    ``malloc`` (storage for each object is allocated with malloc; in memory),
    or ``persistent`` (experimental as at Varnish 2.1.4).
    Defaults to ``file``.

``configuration-file``
    Path to a Varnish VCL configuration file to use. Defaults to the generated
    file from the ``configuration-part`` setting.
    If no configuration was generated, this setting is mandatory.

``configuration-part``
    Names the buildout part to get settings from.
    Defaults to ``varnish-configuration``.

``daemon``
    The file and path of the varnish daemon ``varnishd`` to use.
    If not given, it looks for the build part
    (see the ``build-part`` setting)
    and uses its ``location`` setting plus the string ``/sbin/varnishd``.
    If there is no build part, it defaults to ``/usr/sbin/varnishd`` - the
    most common place
    where it's found on many Unix systems. Adjust it if needed.

``group``
    The name of the group that varnish should switch to before accepting any
    request. This defaults to the main group for the specified user.

``mode``
    Specify whether the varnish daemon should run in ``daemon`` or
    ``foreground`` mode.  The latter is useful when varnish is run by service
    supervision tools like daemontools or runit. Defaults to ``daemon``.

``name``
    If specified this sets the name of the varnish instance (defaults to
    the host name).

    From varnishd's manpage:

      Amongst other things, this name is used to construct the name of the
      directory in which varnishd keeps temporary files and persistent state.
      If the specified name begins with a forward slash, it is interpreted as
      the absolute path to the directory which should be used for this purpose.

``runtime-parameters``
    Runtime parameter configuration options. The full list of available options
    can be found in the manpage varnishd(1) for your version of varnish.
    Examples include ``thread_pool_max``, ``thread_pool_min``, ``sess_timeout``.

``telnet``
    If specified sets the hostname and port on which Varnish will listen
    for commands using its telnet interface.

``script-filename``
    Name of the start script file in ``buildout:bin-directory``.
    Defaults to the name of this buildout part.

``secret-file``

    In Varnish 4.X the telnet interface is no longer usable without
    authentication by default. A pre shared key mechanism has been put in place
    which requires both the varnish daemon and a client connection over telnet
    (like the varnishadm tool) to have a shared key to authenticate. By default
    if no secret-file is specified, it's no longer possible to authenticate to
    the telnet interface.

    To disable this security feature (and go back to the dark Varnish 2 & 3
    days) use ``secret-file = disabled``. This is discouraged.

    To enable the secret-file, give the path to a file on the filesystem that
    preferably has random content and is both accessible to the varnish daemon
    and a command line utility like varnishadm.

    An example buildout part to generate such a file could be::

        [varnish-secret]
        recipe = plone.recipe.command
        command = dd if=/dev/random of=${buildout:directory}/var/varnish_secret count=1
                  chmod 600 ${buildout:directory}/var/varnish_secret

    Giving secret-file the location of this file will pass on the secret to
    the varnish daemon when it starts up. Afterwards you can use varnishadm
    with the parameters -T host:port -S /path/to/varnish_secret to connect to
    the admin telnet interface.

``user``
    The name of the user varnish should switch to before accepting any
    requests. Defaults to ``nobody``.


.. _Varnish: https://varnish-cache.org/
.. _zc.buildout: https://pypi.org/project/zc.buildout/

Examples:
---------

Use system varnish at ``/usr/sbin/varnishd``, generate start script in
``./bin/varnishd`` using a VCL-file in
``./parts/varnish-configuration/varnish.vcl``::

    [buildout]
    parts =
        varnish-script
        varnish-configuration

    [varnish-script]
    recipe = plone.recipe.varnish:script

    [varnish-configuration]
    recipe = plone.recipe.varnish:configuration

Changelog
=========

6.0.13.1 (2024-10-21)
---------------------

- Add common font formats to the list of extensions where cookies should be unset.
  Remove kss from this list.
  [erral]


6.0.13 (2024-04-22)
-------------------

- Add ``cookie-pass-not-exclude`` config.
  The default value has ``++resource++zmi``, which is needed for Zope 5.9+ (Plone 6.0.10+).
  [mamico]

- Use Varnish 6.0.13 LTS [mamico]

- Add vcl_synth options to insert arbitrary vcl. [mamico]


6.0.11 (2023-08-18)
-------------------

- Use Varnish 6.0.11 LTS.  [maurits]

- Allow to configure storages other than file and malloc (https://varnish-cache.org/docs/trunk/users-guide/storage-backends.html)
  [mamico]

- BUGFIX: secret filename case sensitive [mamico]

- Remove strange check to make vhm_map generation work again. Fixes https://github.com/collective/plone.recipe.varnish/issues/19
  [agitator]


6.0.10 (2022-02-20)
-------------------

- Use Varnish 6.0.10 LTS.  [fredvd]

- Set the default varnish download url to https.  [maurits]

- Fixed typo that prevented mp3 and mp4 from being piped, like other large files.  [maurits]


6.0.9 (2021-12-15)
------------------

- Re-release 6.0.0b4 as version 6.0.9. [fredvd]


6.0.0b4 (2021-12-08)
--------------------

- Use Varnish 6.0.9 LTS.  [fredvd]

- Build VMODS [mamico]


6.0.0b3 (2020-07-15)
--------------------

- BUGFIX: omitting health-probe-url resulted in `.url = "None";` [frisi]


6.0.0b2 (2020-07-14)
--------------------

- Add options to configure backend health checks [frisi]

- Update documentation for health probes. [frisi]


6.0.0b1 (2020-02-26)
--------------------

- BREAKING: only support Varnish version 6.0 LTS and generates config (VCL) for this version
  only as well. If you want to use a different Varnish version with this recipe to use the
  software build and runner setup, provide your own VCL and a custom link to a Varnish
  download url. (Closes #70)
  [fredvd]

- Update to Varnish 6.0.6 LTS security release. [fredvd]

- Set default vcl_hash value so the fallback default.vcl hash function doesn't get activated. This
  will break purging because the hash from the incoming request on your public dns/hostname will
  never match the internal hostname when Plone makes the purge request. (Closes #61, Refs #70)

- Add an option to modify the health-check url defaulting to Plone's /ok view.
  [erral]

- Disable building sphinx documentation in the varnish-build/cmmi stage of installing the software.
  [fredvd]

- Update Varnish versions. Anything below 6.0.X is officially unmaintained. Update versions 6 and 6.0 to latest version 6.0.4
  [fredvd]

- Set default version to version 6, downloading 6.0.4 if no url is provided.
  [fredvd]



2.3.0 (2019-03-26)
------------------

- Simplified test buildout setup by not using plone versions.
  See `issue #69 <https://github.com/collective/plone.recipe.varnish/issues/69>`_.  [maurits]

- Updated default varnish 4 version to latest 4.1.11.  [maurits]

- Pick up vcl_hash custom code insertion again from the buildout recipe values.
  It was defined in the varnish templates but never picked up.
  [fredvd]

- Initial Varnish 6 support.
  [cleberjsantos]

- Fix custom vcl code insertion for ``vcl_purge``
  [mamico]

- Fix grace-sick default.
  [mamico]

2.2.0 (2018-01-05)
------------------

- Initial Varnish 5 support.
  vcl-version parameter has been added to control
  `Varnish VCL Syntax format version <https://book.varnish-software.com/4.0/chapters/VCL_Basics.html#vcl-syntax>`_.
  [maurits, jensens, cleberjsantos]


2.1.0 (2017-12-18)
------------------

- Use 4.1 version by default (4.0 was default until now).  [maurits]


2.0 (2017-12-15)
----------------

- When using varnish 4.1, use varnish 4.1.9.
  4.0 is still the default.  [cleberjsantos, maurits]

- fix default value for ``COOKIE_PASS_DEFAULT`` not matching any other
  urls than the intended static resources.
  [petschki]


2.0a8 (2017-11-03)
------------------

- New: refactor start script as Jinja2 template
  [petschki]

- Fix to failing travis tests, ``bin/createcoverage`` tries to open browser.
  [instification]

- Stripped query string before testing which urls to strip cookies on.
  https://github.com/collective/plone.recipe.varnish/issues/42 [instification]

- Fix custom vcl code insertion for ``vcl_backend_fetch`` and ``vcl_backend_response``
  Update documentation
  [petschki]

- Fix parameter for jailed user in ``varnish_version=4.1``
  [petschki]

- update documentation for ``varnish_version`` which only makes sense to be set in
  the build-part.
  [petschki]


2.0a7 (2017-08-16)
------------------

- Changed default downloads to ``.tgz`` instead of ``.tar.gz``.
  For some reason they were renamed after the last release of this recipe.
  [maurits]


2.0a6 (2017-08-15)
------------------

- Updated default urls to `varnish security releases <https://varnish-cache.org/security/VSV00001.html>`_.
  Also updated these urls to not use the ``repo.varnish-cache.org`` domain,
  because those links will stop working at `31 August 2017 <https://varnish-cache.org/news/index.html#package-repository-status>`_.
  [maurits]

- Fix VCL director: from round-robin to round_robin, tests refactored.
  [cleberjsantos]


2.0a5 (2016-08-29)
------------------

- Made three possible values for the ``varnish_version`` option.  4.0
  (uses 4.0.3), 4.1 (uses 4.1.3), 4 (uses 4.1.3).  4.0 is the default for now.
  4 is intended to be updated to 4.2.x when this is released and found
  to work.
  [maurits]

- Fix: to disable the secret-file authentication, an empty parameter should be
  passed to varnishd on startup.
  [fredvd, nutjob4life]


2.0a4 (2016-02-23)
------------------

- New: add option for secret-file in the script part so you can communicate to
  varnish with varnishadm. See docs for usage and secret-file generation.
  [fredvd]

- Fix: Split at max on two ':' to get a max of 3 parts as raw_backends
  [jensens]


2.0a3 (2015-12-22)
------------------

- re-release: 2.0a2 was a brown bag release
  [jensens]

2.0a2 (2015-12-22)
------------------

- Fix daemon location of script part of the recipe (/usr/bin/varnishd was
  always used.
  [fredvd]

- Fix tests,  download Varnish 4.0.3 as download.
  [fredvd]

2.0a1 (2015-03-02)
------------------

- refactoring and cleanup of the whole recipe and vcl generation:

  - skip support of varnish < v4.0, use 1.x series for older varnish support.
  - do not generate vcl code in python
  - use jinja2 templates for vcl
  - refactor vcl generation out in own testable class
  - change fixup cookies into a cookie whitelist
  - split up recipe in 3 parts: build, configuration generation and script
    generation.

  [jensens]


1.4 (unreleased)
----------------

- Fix test for running in the Varnish 2 or later.
  [cleberjsantos]

- Fixup VCL template Varnish 3.
  [cleberjsantos]

- add saint-mode for varnish_version 3.
  [cleder, cleberjsantos]

- set a default download-url for varnish_version 3.
  [cleder]

- Fixup string concat for varnish_version 3.
  [damaestro]

- Add zope2_vhm_port to be able to explicitly define a response
  port in VHM URLs.
  [damaestro]

- Add zope2_vhm_ssl to use VHM to render https urls.
  [damaestro]

- Add zope2_vhm_ssl_port to be able to explicitly define a response
  port in VHM URLs for ssl.
  [damaestro]

- Update verbose-headers to use upstream debug example:
  https://www.varnish-cache.org/trac/wiki/VCLExampleHitMissHeader
  [damaestro]

- Add cookie-fixup to better support caching of plone conent
  and to ensure no authenticated content gets cached.
  http://developer.plone.org/hosting/varnish.html
  [damaestro]

- Update VCL templates to be more flexible.
  [damaestro]


1.3 (2013-08-21)
----------------

- Add varnish_version option in order to control vcl generation for
  varnish version >= 3
  [rnix]


1.2.2 (2012-10-14)
------------------

- Moved to https://github.com/collective/plone.recipe.varnish
  [maurits]


1.2.1 (2011-05-13)
------------------

- Update known good Varnish to 2.1.5.
  [elro]

- Add vcl_recv, vcl_hit, vcl_miss, vcl_fetch, vcl_deliver, vcl_pipe options to
  insert arbitrary vcl.
  [elro]


1.2 (2011-01-11)
----------------

- Added new options ``cache-type``, ``cache-location`` for specifying type of
  Varnish storage (such as using malloc for alternative storage) and setting a
  custom location for said storage
  [davidjb]

- Added additional unit tests to check Varnish initialisation script
  [davidjb]

- Added new option 'purge-hosts'. Enables additional addresses allowed to purge.
  [jensens]

- Added the `name` option to be able to define the directory varnishd
  puts temporary files to and identify the instance when using varnishlog
  or varnishstat.
  [fRiSi]

- fixed configuration for verbose-headers=on (context in vlc_fetch is
  bresp instead of obj in newer varnish versions)
  [fRiSi]

1.1 (2010-08-05)
----------------

- Changed the default cache size to 256M from 1G.
  [hannosch]

- Updated Varnish to 2.1.3.
  [hannosch]

1.1b1 (2010-04-25)
------------------

- Updated advertised Varnish version to 2.1 and adjusted config.
  [hannosch]

- Correct documentation for the ``daemon`` setting and remove the default.
  [hannosch]

- Removed the deprecated build recipe.
  [hannosch]

- Added basic test infrastructure and a test for the simple buildout.
  [hannosch]

- Use the built-in set type instead of the deprecated sets module. This recipe
  now requires at least Python 2.4.
  [hannosch]

- Added the ability to configure runtime parameters in the varnish runner
  configuration and added information to the documentation for it.
  [benliles]

- Improve readability of the generated config.
  [ldr]

1.0.2 (2010-01-18)
------------------

- Update proposed Varnish to 2.0.6.
  [hannosch]

- Further documentation cleanup.
  [hannosch, vincentfretin]

1.0.1 (2009-11-27)
------------------

- Expose the ``download-url`` of a known-good Varnish release that works with
  the configuration produced by the instance recipe.
  [hannosch]

- Consistently use tabs in the generated vcl file.
  [hannosch]

- Whitespace and documentation cleanup.
  [hannosch]


1.0 (2009-08-27)
----------------

* Made the vcl template build its acl purge section. At present, the vcl will
  only allow purges coming from the local host. If we have multiple hosts that
  are separate from localhost, any PURGE requests will be denied without this.
  See http://varnish.projects.linpro.no/wiki/VCLExamplePurging
  [rockdj]

* Added ability to set various Varnish timeouts (connect_timeout,
  first_byte_timeout, and between_bytes_timeout) from each option in the
  buildout. Default values are set at Varnish defaults of 0.4s for
  connect_timeout, and 60s for between_bytes_timeout. Time for
  first_byte_timeout is set at 300s as per plone.recipe.varnish 1.0rc9.
  [rockdj]

* Set `req.http.host` for incoming virtual hosted URLs. Without setting this,
  purge requests sent from hosts other than localhost (the only host in the acl
  purge list) will result in a 404 message. See
  http://davidjb.com/blog/2009/01/plone-varnish-configuration-cache-hits-purge-fails
  [rockdj]


1.0rc11 (2009-06-27)
--------------------

* Reintroduced grace options. What the varnish documentation say about grace:
  "varnish serves stale (but cacheable) objects while retrieving object from
  backend". The problem is "default_ttl" value is 120s (see
  bin/varnishd/mgt_param.c in varnish 2.0.4). Added a special rule for
  createObject url to not look up in the cache.
  [vincentfretin]


1.0rc10 (2009-06-26)
--------------------

* 1.0rc9 generated broken configuration with balancer=none
  [vincentfretin]


1.0rc9 (2009-06-25)
-------------------

* Do not set req.grace and obj.grace. See
  http://vincentfretin.ecreall.com/articles/varnish-user-be-careful
  [vincentfretin, maurits]

* Removed `header_hit_deliver` and `header_hit_notcacheable` debug messages
  from default template. It is not safe to assign to the object during
  `vcl_hit` until http://varnish.projects.linpro.no/ticket/310 is not fixed.
  See also http://kristian.blog.linpro.no/2009/05/25/common-varnish-issues.
  [hannosch]

* Updated to refer to Varnish 2.0.4. Added a `first_byte_timeout` value of
  300 seconds to the backend definitions. This is a new option since Varnish
  2.0.3 and by default set to 60 seconds. This is arguably too low for certain
  edit operations in Plone sites.
  [hannosch]


1.0rc8 (2008-02-12)
-------------------

* Remove the custom vcl_hash from the template. Adding the Accept-Encoding
  header to the cache break effectively breaks purging since nobody will
  ever include those headers in a PURGE request. To make this safe we just
  remove the Accept-Encoding header from all incoming requests as well.
  [wichert]


1.0rc7 (2008-11-26)
-------------------

* Be more explicit about deprecating the :build entry point.
  [wichert]

* Make the :instance specifier optional: after :build has been removed
  we can deprecate :instance as well.
  [wichert]


1.0rc6 (2008-09-22)
-------------------

* Deprecate plone.recipe.varnish:build in favour of zc.recipe.cmmi: it does
  not make sense to duplicate its logic here.
  [wichert]

* Add feature to enable verbose headers in varnish.vcl. This is primary
  interesting for debugging of cache-settings. See README.txt.
  [jensens]

* Deal better with sources which do not have executable-bits set or
  are svn exports.
  [wichert]

* The 1.0rc5 release was broken and has been retracted. Currently the trunk
  is only usable with the Varnish 2.0-beta1 and later.
  [hannosch]


1.0rc5 (2008-04-27)
-------------------

* Pipe is evil: it pipes the whole connection to the backend which means
  varnish will no longer process any further requests if HTTP pipelining is
  used. Switch to using pass instead.
  [wichert]

* Add a default_ttl of zero seconds to the Varnish runner to avoid a Varnish
  bug with the handling of an Expires header with a date in the past.
  [newbery]

* Merged branches/newbery-hostnamepath.
  [newbery]

* We don't need to include Accept-Encoding in the hash. Varnish takes care
  of Vary negotiation already.
  [newbery]


1.0rc4 (2008-03-18)
-------------------

* Fixed typos / whitespace.
  [hannosch]

* Varnish 1.1.2 is out.
  [wichert]

* Merged witsch-foreground-support back to trunk.
  [witsch]

* Use a pidfile.
  [wichert]


1.0rc3 (2007-09-02)
-------------------

* Fixed a bug where options["location"] was being used before it was being set.
  [rocky]

* Made the module name determination a little more robust during
  createVarnishConfig so that recipes that specify version deps still work.
  [rocky]

* Do not use defaults for user and group.
  [wichert]

* We do need the parts: we use it for the file storage.
  [wichert]


1.0rc2 (2007-08-29)
-------------------

* Add an option to use an existing configuration file.
  [wichert]

* Remove hardcoded caching for images, binaries, CSS and javascript. This
  should be done by the backend server or a custom varnish configuration.
  [wichert]

* Add Accept-Encoding to the cache key so we can handle compressed content.
  [wichert]

* Test if a bin-directory exists. This allows us to compile varnish 1.0
  which does not have an sbin directory.
  [wichert]


1.0rc1 (2007-08-27)
-------------------

* Document the OSX bugfix we apply when building varnish.
  [wichert]

* Add a dummy update method to prevent needless recompiles.
  [wichert]

* Update for Varnish 1.1.1.
  [wichert]


1.0b2 (2007-08-25)
------------------

* When building from svn, we need to run autogen.sh.
  [optilude]

* Refactor the recipe: there are now separate recipes to build and configure
  Varnish. This makes it possible to reconfigure varnish without having to
  recompile with as well as using an already installed varnish.
  [wichert]

* Move the OSX patching code into a separate method.
  [wichert]

* Use pass for non-GET/HEAD requests. This makes a bit more sense and fixes a
  login problem for Plone sites.
  [wichert]

* Reorganize a bit for readability.
  [wichert]

* Support Python 2.3 as well.
  [wichert]

* Make it possible to specify the user and group as well.
  [wichert]

* Do not create the source directory - we move the extracted source in its
  place later.
  [wichert]

* If running on OS X, patch libtool as described in
  http://varnish.projects.linpro.no/ticket/118 and
  http://thread.gmane.org/gmane.comp.web.varnish.misc/668/focus=669.
  [optilude]

* VCL is not C. You need the curlies even on single-line if statements.
  [optilude]

* This rewriting style only works on Zope 3 - Zope 3 reinvented that wheel.
  [wichert]

* Add support for If-Modified-Since and If-None-Match requests.
  Thanks to newbery for the suggstions.
  [wichert]

* Explicitly mention that there is nothing Plone or Zope specific about
  this recipe.
  [wichert]


1.0b1 (2007-08-04)
------------------

* More documentation.
  [wichert]

* Ignore the port information in the host header.
  [wichert]

* Use the port varnish is bound to in the VHM mapping.
  [wichert]

* Define all default values centrally.
  [wichert]

* Add support for Zope virtual hosts.
  [wichert]

* Add support for virtual hosting.
  [wichert]

* Initial import of Varnish recipe.
  [wichert]