Comments (4)
Some thoughts:
Implementation of Surrogate-Keys
It could be done via headers/conditions in the service configuration, though currently the docs fastly configuration is not created from version control (outside of fastly's own internal versioning), so I'm not sure if that's the best way to approach it.
Regardless this is better accomplished by setting Surrogate-Key
header values directly on the responses served via the backend.
Since as far as I am aware, there's no trivial way to manage adding HTTP headers with sphinx, I recommend doing this by using nginx add_header
directives in the nginx config rather than with VCL.
Access for purging
Currently purges using Surrogate-Keys are only accessible via the authenticated API, so we'd need some mechanism for issuing them when necessary.
from psf-salt.
What about using BANs with regexes implemented purely in VCL so we can do it without the authenticated API?
https://varnish-cache.org/docs/7.2/users-guide/purging.html
Something like:
if (req.method == "BAN") {
# Same ACL check as above:
if (!client.ip ~ purge) {
return(synth(403, "Not allowed."));
}
# Assumes req.url is a regex. This might be a bit too simple
if (std.ban("obj.http.url ~ " + req.url)) {
return(synth(200, "Ban added"));
} else {
# return ban error in 400 response
return(synth(400, std.ban_error()));
}
}
While we're at it, implementing an IP whitelist for PURGE and BAN should be great to avoid ReDoS attacks.
from psf-salt.
Surrogate-Key purges aren't exposed via Fastly's config/VCL but through their API, so I don't think that will work.
from psf-salt.
I almost never used fastly, I just had plain varnish in prod. Is fastly VCL restricted is some way blocking us to play this kind of tricks? :(
from psf-salt.
Related Issues (20)
- Automate addition of pypa/get-pip versions HOT 2
- Umask for documentarians on docs.nyc1.psf.io HOT 2
- Please move irker (IRC bots) from #python-dev to #python-dev-notifs HOT 1
- Make ZNC bouncer for buildbot.python.org IRC connection an ActualThing™️
- Access to code-speed servers HOT 2
- speed.python.org HTTPS certificate not renewed HOT 1
- Use the docsbuild github hook server?
- wh
- @NatanBagrov , HOT 2
- psfmember.org certificate renewal HOT 4
- Deprecated sshd configurations when upgrading to ubuntu 20.04 HOT 1
- Upgrade our roles to be compatible with Ubuntu 20.04 HOT 3
- Automate fetching lists of new Fastly IPs HOT 3
- cdn-logs: Hourly cronjob for logrotate not firing HOT 2
- "Invalid compound target: for results: " error when calling state.highstate
- "module.run" is using its deprecated version and will expire in version "Phosphorus" HOT 2
- `pkgrepo.managed` state reports Changed on every run
- Publishing salt-server-list.rst back to psf-salt onchanges HOT 2
- mail.python.org not listening on IPv6 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from psf-salt.