From 939305b3858b396dbae771e0586537bbc10dcc6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andre=CC=81=20R?= <ar@ez.no>
Date: Sat, 29 Oct 2016 01:06:27 +0200
Subject: [PATCH 1/8] [Docker] Add docker support for using varnish

---
 .env                                          |   5 +
 .travis.yml                                   |   4 +-
 app/config/default_parameters.yml             |   4 +
 app/config/env/docker.php                     |   6 +
 app/config/ezplatform.yml                     |   7 +
 doc/docker-compose/Dockerfile-varnish         |  16 ++
 doc/docker-compose/README.md                  |   1 +
 .../entrypoint/varnish/varnish4.vcl           | 221 ++++++++++++++++++
 doc/docker-compose/redis.yml                  |   4 +
 doc/docker-compose/selenium.yml               |   8 +-
 doc/docker-compose/solr.yml                   |   4 +
 doc/docker-compose/varnish.yml                |  39 ++++
 doc/varnish/vcl/varnish4.vcl                  |   4 +
 13 files changed, 317 insertions(+), 6 deletions(-)
 create mode 100644 doc/docker-compose/Dockerfile-varnish
 create mode 100644 doc/docker-compose/entrypoint/varnish/varnish4.vcl
 create mode 100644 doc/docker-compose/varnish.yml

diff --git a/.env b/.env
index 20198edd26..8257296f1e 100644
--- a/.env
+++ b/.env
@@ -23,3 +23,8 @@ APP_DOCKER_FILE=Dockerfile
 
 # Install config, used by .platform.app.yaml among others
 INSTALL_EZ_INSTALL_TYPE=clean
+
+# Behat / Selenium config
+EZP_TEST_REST_HOST=web
+BEHAT_SELENIUM_HOST=selenium
+BEHAT_WEB_HOST=web
diff --git a/.travis.yml b/.travis.yml
index 4eb5ba3901..a0b9b3c7b8 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,8 +16,8 @@ env:
     - SYMFONY_DEBUG=1
   # list of behat arguments to test
   matrix:
-    # Disabled until failures on BDD tests with redis is solved / figured out
-    #- TEST_CMD="bin/behat -vv --profile=rest --suite=fullJson --tags=~@broken" COMPOSE_FILE="doc/docker-compose/base-prod.yml:doc/docker-compose/redis.yml:doc/docker-compose/selenium.yml"
+    # Disabled until failures on BDD tests with redis, and travis segfault with varnish is solved / figured out
+    #- TEST_CMD="bin/behat -vv --profile=rest --suite=fullJson --tags=~@broken" COMPOSE_FILE="doc/docker-compose/base-prod.yml:doc/docker-compose/redis.yml:doc/docker-compose/varnish.yml:doc/docker-compose/selenium.yml" BEHAT_WEB_HOST="varnish"
     - TEST_CMD="bin/behat -vv --profile=rest --suite=fullJson --tags=~@broken" COMPOSE_FILE="doc/docker-compose/base-prod.yml:doc/docker-compose/selenium.yml"
     - TEST_CMD="bin/behat -vv --profile=rest --suite=fullXml --tags=~@broken"
     - TEST_CMD="bin/behat -vv --profile=core --tags=~@broken"
diff --git a/app/config/default_parameters.yml b/app/config/default_parameters.yml
index 6710401616..85bfeb1d90 100644
--- a/app/config/default_parameters.yml
+++ b/app/config/default_parameters.yml
@@ -28,3 +28,7 @@ parameters:
 
     cache_memcached_port: 11211
     cache_redis_port: 6379
+
+    # Settings for HttpCache
+    purge_type: "local"
+    purge_server: "http://my.varnish.server:80"
diff --git a/app/config/env/docker.php b/app/config/env/docker.php
index 79ca6d6cb5..6eb6833f86 100644
--- a/app/config/env/docker.php
+++ b/app/config/env/docker.php
@@ -94,3 +94,9 @@
     $loader = new Loader\YamlFileLoader($container, new FileLocator(__DIR__ . '/../cache_pool'));
     $loader->load($pool . '.yml');
 }
+
+// HttpCache setting (for configuring Varnish purging)
+if ($purgeServer = getenv('HTTPCACHE_PURGE_SERVER')) {
+    $container->setParameter('purge_type', 'http');
+    $container->setParameter('purge_server', $purgeServer);
+}
diff --git a/app/config/ezplatform.yml b/app/config/ezplatform.yml
index edc4d2c479..42ebffd375 100644
--- a/app/config/ezplatform.yml
+++ b/app/config/ezplatform.yml
@@ -1,4 +1,8 @@
 ezpublish:
+    # HttpCache settings, By default 'local' (Symfony HttpCache Proxy), by setting it to 'http' you can point it to Varnish
+    http_cache:
+        purge_type: %purge_type%
+
     # Repositories configuration, setup default repository to support solr if enabled
     repositories:
         default:
@@ -29,3 +33,6 @@ ezpublish:
             # so removing eng-GB from this list may lead to errors or content not being shown, unless you change
             # all eng-GB data to other locales first.
             languages: [eng-GB]
+            # HttpCache purge server(s) setting, eg Varnish, for when ezpublish.http_cache.purge_type is set to 'http'.
+            http_cache:
+                purge_servers: ["%purge_server%"]
diff --git a/doc/docker-compose/Dockerfile-varnish b/doc/docker-compose/Dockerfile-varnish
new file mode 100644
index 0000000000..51f9b88a4d
--- /dev/null
+++ b/doc/docker-compose/Dockerfile-varnish
@@ -0,0 +1,16 @@
+FROM debian:stretch
+
+ENV DEBIAN_FRONTEND noninteractive
+
+# Use packages from Varnish to get Varnsih 5.1 which is a bit more stable then Varnsih 5.0.0 in stretch
+RUN curl -s https://packagecloud.io/install/repositories/varnishcache/varnish5/script.deb.sh | sudo bash
+
+# If we need varnish modules this is one way, or we need to find a way to install on the package above.
+#RUN \
+#    apt-get update -q -y && \
+#    apt-get install -q -y --force-yes --no-install-recommends ca-certificates varnish-modules varnish
+
+
+EXPOSE 80 6082
+
+CMD ["varnishd", "-F", "-a", ":80", "-T", ":6082", "-f", "/etc/varnish/default.vcl", "-s", "malloc,256M"]
diff --git a/doc/docker-compose/README.md b/doc/docker-compose/README.md
index bfc31c0bd8..477148b5a9 100644
--- a/doc/docker-compose/README.md
+++ b/doc/docker-compose/README.md
@@ -32,6 +32,7 @@ The current Docker Compose files are made to be mixed and matched togtehr as you
 
 In addition the following exists but are work in progress, thus not tested yet and are known to be somewhat broken:
 - redis.yml _(optional, adds redis service and appends config to app)_
+- varnish.yml _(optional, adds varnish service and appends config to app)_
 - solr.yml _(optional, add solr service and configure app for it)_
 
 
diff --git a/doc/docker-compose/entrypoint/varnish/varnish4.vcl b/doc/docker-compose/entrypoint/varnish/varnish4.vcl
new file mode 100644
index 0000000000..7be2e95294
--- /dev/null
+++ b/doc/docker-compose/entrypoint/varnish/varnish4.vcl
@@ -0,0 +1,221 @@
+// Varnish 4 style - eZ 5.4+ / 2014.09+
+// Complete VCL example
+
+vcl 4.0;
+
+// Our Backend - Assuming that web server is listening on port 80
+// Replace the host to fit your setup
+backend ezplatform {
+    .host = "web";
+    .port = "80";
+}
+
+// ACL for invalidators IP
+acl invalidators {
+    "127.0.0.1";
+    "172.16.0.0"/20;
+    "app";
+}
+
+// ACL for debuggers IP
+acl debuggers {
+    "127.0.0.1";
+    "172.16.0.0"/20;
+}
+
+// Called at the beginning of a request, after the complete request has been received
+sub vcl_recv {
+
+    // Set the backend
+    set req.backend_hint = ezplatform;
+
+    // Advertise Symfony for ESI support
+    set req.http.Surrogate-Capability = "abc=ESI/1.0";
+
+    // Add a unique header containing the client address (only for master request)
+    // Please note that /_fragment URI can change in Symfony configuration
+    if (!req.url ~ "^/_fragment") {
+        if (req.http.x-forwarded-for) {
+            set req.http.X-Forwarded-For = req.http.X-Forwarded-For + ", " + client.ip;
+        } else {
+            set req.http.X-Forwarded-For = client.ip;
+        }
+    }
+
+    // Trigger cache purge if needed
+    call ez_purge;
+
+    // Don't cache requests other than GET and HEAD.
+    if (req.method != "GET" && req.method != "HEAD") {
+        return (pass);
+    }
+
+    // Normalize the Accept-Encoding headers
+    if (req.http.Accept-Encoding) {
+        if (req.http.Accept-Encoding ~ "gzip") {
+            set req.http.Accept-Encoding = "gzip";
+        } elsif (req.http.Accept-Encoding ~ "deflate") {
+            set req.http.Accept-Encoding = "deflate";
+        } else {
+            unset req.http.Accept-Encoding;
+        }
+    }
+
+    // Don't cache Authenticate & Authorization
+    // You may remove this when using REST API with basic auth.
+    if (req.http.Authenticate || req.http.Authorization) {
+        if (client.ip ~ debuggers) {
+            set req.http.X-Debug = "Not Cached according to configuration (Authorization)";
+        }
+        return (hash);
+    }
+
+    // Do a standard lookup on assets
+    // Note that file extension list below is not extensive, so consider completing it to fit your needs.
+    if (req.url ~ "\.(css|js|gif|jpe?g|bmp|png|tiff?|ico|img|tga|wmf|svg|swf|ico|mp3|mp4|m4a|ogg|mov|avi|wmv|zip|gz|pdf|ttf|eot|wof)$") {
+        return (hash);
+    }
+
+    // Retrieve client user hash and add it to the forwarded request.
+    call ez_user_hash;
+
+    // If it passes all these tests, do a lookup anyway.
+    return (hash);
+}
+
+// Called when the requested object has been retrieved from the backend
+sub vcl_backend_response {
+
+    if (bereq.http.accept ~ "application/vnd.fos.user-context-hash"
+        && beresp.status >= 500
+    ) {
+        return (abandon);
+    }
+
+    // Optimize to only parse the Response contents from Symfony
+    if (beresp.http.Surrogate-Control ~ "ESI/1.0") {
+        unset beresp.http.Surrogate-Control;
+        set beresp.do_esi = true;
+    }
+
+    // Allow stale content, in case the backend goes down or cache is not fresh any more
+    // make Varnish keep all objects for 1 hours beyond their TTL
+    set beresp.grace = 1h;
+}
+
+// Handle purge
+// You may add FOSHttpCacheBundle tagging rules
+// See http://foshttpcache.readthedocs.org/en/latest/varnish-configuration.html#id4
+sub ez_purge {
+
+    if (req.method == "BAN") {
+        if (!client.ip ~ invalidators) {
+            return (synth(405, "Method Not Allowed"));
+        }
+
+        if (req.http.X-Location-Id) {
+            ban("obj.http.X-Location-Id ~ " + req.http.X-Location-Id);
+            if (client.ip ~ debuggers) {
+                set req.http.X-Debug = "Ban done for content connected to LocationId " + req.http.X-Location-Id;
+            }
+            return (synth(200, "Banned"));
+        }
+    }
+}
+
+// Sub-routine to get client user hash, for context-aware HTTP cache.
+sub ez_user_hash {
+
+    // Prevent tampering attacks on the hash mechanism
+    if (req.restarts == 0
+        && (req.http.accept ~ "application/vnd.fos.user-context-hash"
+            || req.http.x-user-hash
+        )
+    ) {
+        return (synth(400));
+    }
+
+    if (req.restarts == 0 && (req.method == "GET" || req.method == "HEAD")) {
+        // Get User (Context) hash, for varying cache by what user has access to.
+        // https://doc.ez.no/display/EZP/Context+aware+HTTP+cache
+
+        // Anonymous user w/o session => Use hardcoded anonymous hash to avoid backend lookup for hash
+        if (req.http.Cookie !~ "eZSESSID" && !req.http.authorization) {
+            // You may update this hash with the actual one for anonymous user
+            // to get a better cache hit ratio across anonymous users.
+            // Note: You should then update it every time anonymous user rights change.
+            set req.http.X-User-Hash = "38015b703d82206ebc01d17a39c727e5";
+        }
+        // Pre-authenticate request to get shared cache, even when authenticated
+        else {
+            set req.http.x-fos-original-url    = req.url;
+            set req.http.x-fos-original-accept = req.http.accept;
+            set req.http.x-fos-original-cookie = req.http.cookie;
+            // Clean up cookie for the hash request to only keep session cookie, as hash cache will vary on cookie.
+            set req.http.cookie = ";" + req.http.cookie;
+            set req.http.cookie = regsuball(req.http.cookie, "; +", ";");
+            set req.http.cookie = regsuball(req.http.cookie, ";(eZSESSID[^=]*)=", "; \1=");
+            set req.http.cookie = regsuball(req.http.cookie, ";[^ ][^;]*", "");
+            set req.http.cookie = regsuball(req.http.cookie, "^[; ]+|[; ]+$", "");
+
+            set req.http.accept = "application/vnd.fos.user-context-hash";
+            set req.url = "/_fos_user_context_hash";
+
+            // Force the lookup, the backend must tell how to cache/vary response containing the user hash
+
+            return (hash);
+        }
+    }
+
+    // Rebuild the original request which now has the hash.
+    if (req.restarts > 0
+        && req.http.accept == "application/vnd.fos.user-context-hash"
+    ) {
+        set req.url         = req.http.x-fos-original-url;
+        set req.http.accept = req.http.x-fos-original-accept;
+        set req.http.cookie = req.http.x-fos-original-cookie;
+
+        unset req.http.x-fos-original-url;
+        unset req.http.x-fos-original-accept;
+        unset req.http.x-fos-original-cookie;
+
+        // Force the lookup, the backend must tell not to cache or vary on the
+        // user hash to properly separate cached data.
+
+        return (hash);
+    }
+}
+
+sub vcl_deliver {
+    // On receiving the hash response, copy the hash header to the original
+    // request and restart.
+    if (req.restarts == 0
+        && resp.http.content-type ~ "application/vnd.fos.user-context-hash"
+    ) {
+        set req.http.x-user-hash = resp.http.x-user-hash;
+
+        return (restart);
+    }
+
+    // If we get here, this is a real response that gets sent to the client.
+
+    // Remove the vary on context user hash, this is nothing public. Keep all
+    // other vary headers.
+    set resp.http.Vary = regsub(resp.http.Vary, "(?i),? *x-user-hash *", "");
+    set resp.http.Vary = regsub(resp.http.Vary, "^, *", "");
+    if (resp.http.Vary == "") {
+        unset resp.http.Vary;
+    }
+
+    // Sanity check to prevent ever exposing the hash to a client.
+    unset resp.http.x-user-hash;
+
+    if (client.ip ~ debuggers) {
+        if (obj.hits > 0) {
+            set resp.http.X-Cache = "HIT";
+            set resp.http.X-Cache-Hits = obj.hits;
+        } else {
+            set resp.http.X-Cache = "MISS";
+        }
+    }
+}
diff --git a/doc/docker-compose/redis.yml b/doc/docker-compose/redis.yml
index a069d61797..c7276a54d0 100644
--- a/doc/docker-compose/redis.yml
+++ b/doc/docker-compose/redis.yml
@@ -1,6 +1,10 @@
 version: '2.1'
 # Redis config, to be appended after base-prod or base-dev, ..., but before selenium.yml
 
+## WARNING:
+# This service is currently work in progress, is not tested by CI, and thus not guaranteed to work.
+# You are however more then welcome to try it out and help make it stable.
+
 services:
   app:
     depends_on:
diff --git a/doc/docker-compose/selenium.yml b/doc/docker-compose/selenium.yml
index cd11971dbb..5f2b9b1b25 100644
--- a/doc/docker-compose/selenium.yml
+++ b/doc/docker-compose/selenium.yml
@@ -1,5 +1,5 @@
 version: '2.1'
-# Appends services to prod.yml, prod+dev, prod+redis, ..., always latests
+# Appends services to prod.yml, prod+dev, prod+redis, ..., always latest
 
 services:
   selenium:
@@ -16,6 +16,6 @@ services:
     depends_on:
      - selenium
     environment:
-     - EZP_TEST_REST_HOST=web
-     - BEHAT_SELENIUM_HOST=selenium
-     - BEHAT_WEB_HOST=web
+     - EZP_TEST_REST_HOST
+     - BEHAT_SELENIUM_HOST
+     - BEHAT_WEB_HOST
diff --git a/doc/docker-compose/solr.yml b/doc/docker-compose/solr.yml
index 4c45f3710c..b4669e232a 100644
--- a/doc/docker-compose/solr.yml
+++ b/doc/docker-compose/solr.yml
@@ -4,6 +4,10 @@ version: '2.1'
 # NOTE: You'll need to manually reindex the solr index when booting this as we don't have entrypoint for solr yet.
 #       (Unless you use ezplatform:install command which indexes for you)
 
+## WARNING!
+# This service is currently work in progress, is not tested by CI, and thus not guaranteed to work.
+# You are however more then welcome to try it out and help make it stable.
+
 services:
   app:
     depends_on:
diff --git a/doc/docker-compose/varnish.yml b/doc/docker-compose/varnish.yml
new file mode 100644
index 0000000000..b99b685abe
--- /dev/null
+++ b/doc/docker-compose/varnish.yml
@@ -0,0 +1,39 @@
+version: '2.1'
+# Simple single server setup for prod
+
+## WARNING!
+# This service is currently work in progress, is not tested by CI, and thus not guaranteed to work.
+# You are however more then welcome to try it out and help make it stable.
+
+services:
+  app:
+    environment:
+     - SYMFONY_HTTP_CACHE=0
+     - SYMFONY_TRUSTED_PROXIES=varnish
+     - HTTPCACHE_PURGE_SERVER=http://varnish
+
+  varnish:
+    build:
+      context: .
+      dockerfile: Dockerfile-varnish
+    image: my_varnish
+    mem_limit: 384M
+    memswap_limit: 512M
+    ports:
+     - "8081:80"
+    depends_on:
+     - web
+    volumes:
+     - ${COMPOSE_DIR}/entrypoint/varnish/varnish4.vcl:/etc/varnish/default.vcl:ro
+
+
+## DEBUG??
+# In need of debugging all request going to Varnish, use varnishlog, example:
+# docker-compose exec varnish varnishlog -c -i ReqURL,ReqMethod -I ReqHeader:X-Location-Id
+# Or more relevant only BAN's with all info:
+# docker-compose exec varnish varnishlog -g request -q "ReqMethod eq 'BAN'"
+#
+# But before doing that check that http and not local purge client is set:
+# docker-compose exec app app/console --env=dev debug:container ezpublish.http_cache.purge_client
+#
+# And if in prod make sure you have rebuilt app container on code changes ;)
diff --git a/doc/varnish/vcl/varnish4.vcl b/doc/varnish/vcl/varnish4.vcl
index 8d743b6563..adbf3b88aa 100644
--- a/doc/varnish/vcl/varnish4.vcl
+++ b/doc/varnish/vcl/varnish4.vcl
@@ -1,5 +1,9 @@
 // Varnish 4 style - eZ 5.4+ / 2014.09+
 // Complete VCL example
+//
+// DEPRECATED: This approach for invalidation is deprecated and default has changed to xkey.
+// See doc/varnish/README.md
+
 
 vcl 4.0;
 

From f55834f489853c6021f5c91f3b3a384e2aec53d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andre=CC=81=20R?= <ar@ez.no>
Date: Wed, 21 Jun 2017 18:03:01 +0200
Subject: [PATCH 2/8] [Travis] Enable testing with Varnish

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index a0b9b3c7b8..df8380727e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,7 +18,7 @@ env:
   matrix:
     # Disabled until failures on BDD tests with redis, and travis segfault with varnish is solved / figured out
     #- TEST_CMD="bin/behat -vv --profile=rest --suite=fullJson --tags=~@broken" COMPOSE_FILE="doc/docker-compose/base-prod.yml:doc/docker-compose/redis.yml:doc/docker-compose/varnish.yml:doc/docker-compose/selenium.yml" BEHAT_WEB_HOST="varnish"
-    - TEST_CMD="bin/behat -vv --profile=rest --suite=fullJson --tags=~@broken" COMPOSE_FILE="doc/docker-compose/base-prod.yml:doc/docker-compose/selenium.yml"
+    - TEST_CMD="bin/behat -vv --profile=rest --suite=fullJson --tags=~@broken" COMPOSE_FILE="doc/docker-compose/base-prod.yml:doc/docker-compose/varnish.yml:doc/docker-compose/selenium.yml" BEHAT_WEB_HOST="varnish"
     - TEST_CMD="bin/behat -vv --profile=rest --suite=fullXml --tags=~@broken"
     - TEST_CMD="bin/behat -vv --profile=core --tags=~@broken"
     - TEST_CMD="bin/phpunit -v vendor/ezsystems/ezpublish-kernel/eZ/Bundle/EzPublishRestBundle/Tests/Functional"

From 4dce5dcc1784a53b562a1ccc6ac6239d7865e21f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andre=CC=81=20R?= <ar@ez.no>
Date: Wed, 21 Jun 2017 18:24:13 +0200
Subject: [PATCH 3/8] [Doc] Remove here invalid leftover from other branch

[skip ci]
---
 doc/varnish/vcl/varnish4.vcl | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/doc/varnish/vcl/varnish4.vcl b/doc/varnish/vcl/varnish4.vcl
index adbf3b88aa..8d743b6563 100644
--- a/doc/varnish/vcl/varnish4.vcl
+++ b/doc/varnish/vcl/varnish4.vcl
@@ -1,9 +1,5 @@
 // Varnish 4 style - eZ 5.4+ / 2014.09+
 // Complete VCL example
-//
-// DEPRECATED: This approach for invalidation is deprecated and default has changed to xkey.
-// See doc/varnish/README.md
-
 
 vcl 4.0;
 

From b9a980f02a205e3ae7b080cfaf0f278aba95dcb2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andre=CC=81=20R?= <ar@ez.no>
Date: Wed, 21 Jun 2017 22:19:59 +0200
Subject: [PATCH 4/8] Add curl to varnsih image

---
 doc/docker-compose/Dockerfile-varnish | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/docker-compose/Dockerfile-varnish b/doc/docker-compose/Dockerfile-varnish
index 51f9b88a4d..9d8717f9be 100644
--- a/doc/docker-compose/Dockerfile-varnish
+++ b/doc/docker-compose/Dockerfile-varnish
@@ -3,7 +3,8 @@ FROM debian:stretch
 ENV DEBIAN_FRONTEND noninteractive
 
 # Use packages from Varnish to get Varnsih 5.1 which is a bit more stable then Varnsih 5.0.0 in stretch
-RUN curl -s https://packagecloud.io/install/repositories/varnishcache/varnish5/script.deb.sh | sudo bash
+RUN apt-get install -q -y --force-yes --no-install-recommends ca-certificates curl \
+    curl -s https://packagecloud.io/install/repositories/varnishcache/varnish5/script.deb.sh | bash
 
 # If we need varnish modules this is one way, or we need to find a way to install on the package above.
 #RUN \

From 62e96ac26aad9b0cdaed513a172274bbcb0e18d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andre=CC=81=20R?= <ar@ez.no>
Date: Thu, 22 Jun 2017 10:34:20 +0200
Subject: [PATCH 5/8] Change to debian:jessie

---
 doc/docker-compose/Dockerfile-varnish | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/doc/docker-compose/Dockerfile-varnish b/doc/docker-compose/Dockerfile-varnish
index 9d8717f9be..77499dd209 100644
--- a/doc/docker-compose/Dockerfile-varnish
+++ b/doc/docker-compose/Dockerfile-varnish
@@ -1,12 +1,14 @@
-FROM debian:stretch
+FROM debian:jessie
 
 ENV DEBIAN_FRONTEND noninteractive
 
-# Use packages from Varnish to get Varnsih 5.1 which is a bit more stable then Varnsih 5.0.0 in stretch
-RUN apt-get install -q -y --force-yes --no-install-recommends ca-certificates curl \
-    curl -s https://packagecloud.io/install/repositories/varnishcache/varnish5/script.deb.sh | bash
+# Use packages from Varnish to get Varnsih 5.1, currently does not work on debian:stretch
+RUN apt-get update -q -y && \
+    apt-get install -q -y --force-yes --no-install-recommends ca-certificates curl && \
+    curl -s https://packagecloud.io/install/repositories/varnishcache/varnish5/script.deb.sh | bash && \
+    apt-get install -q -y --force-yes --no-install-recommends varnish
 
-# If we need varnish modules this is one way, or we need to find a way to install on the package above.
+# This will need debian:stretch, just here for referance, had segmentation faults so rather using varnsih 5.1 above
 #RUN \
 #    apt-get update -q -y && \
 #    apt-get install -q -y --force-yes --no-install-recommends ca-certificates varnish-modules varnish

From 5f14a5057f08d2f6cadc20cbef21fc9350b814c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andre=CC=81=20R?= <ar@ez.no>
Date: Thu, 22 Jun 2017 13:26:46 +0200
Subject: [PATCH 6/8] [Travis] Run platformui behat profile with redis

Both since it randomly crashes with Stash error when directories are attempted to be deleted between tests, and to get coverage with redis.
---
 .travis.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index df8380727e..fb1de30807 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,13 +16,11 @@ env:
     - SYMFONY_DEBUG=1
   # list of behat arguments to test
   matrix:
-    # Disabled until failures on BDD tests with redis, and travis segfault with varnish is solved / figured out
-    #- TEST_CMD="bin/behat -vv --profile=rest --suite=fullJson --tags=~@broken" COMPOSE_FILE="doc/docker-compose/base-prod.yml:doc/docker-compose/redis.yml:doc/docker-compose/varnish.yml:doc/docker-compose/selenium.yml" BEHAT_WEB_HOST="varnish"
     - TEST_CMD="bin/behat -vv --profile=rest --suite=fullJson --tags=~@broken" COMPOSE_FILE="doc/docker-compose/base-prod.yml:doc/docker-compose/varnish.yml:doc/docker-compose/selenium.yml" BEHAT_WEB_HOST="varnish"
     - TEST_CMD="bin/behat -vv --profile=rest --suite=fullXml --tags=~@broken"
     - TEST_CMD="bin/behat -vv --profile=core --tags=~@broken"
     - TEST_CMD="bin/phpunit -v vendor/ezsystems/ezpublish-kernel/eZ/Bundle/EzPublishRestBundle/Tests/Functional"
-    - TEST_CMD="bin/behat -vv --profile=platformui --tags='@common'"
+    - TEST_CMD="bin/behat -vv --profile=platformui --tags='@common'" COMPOSE_FILE="doc/docker-compose/base-dev.yml:doc/docker-compose/redis.yml:doc/docker-compose/selenium.yml"
 
 # test only master (+ Pull requests)
 branches:

From 282a5b6fd1bf809f15e65fe6f7804beffcd9558f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andre=CC=81=20R?= <ar@ez.no>
Date: Thu, 22 Jun 2017 15:02:48 +0200
Subject: [PATCH 7/8] [.env] Simplify env variables for web and selenium host

---
 .env                            | 6 +++---
 .travis.yml                     | 2 +-
 doc/docker-compose/selenium.yml | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.env b/.env
index 8257296f1e..32848aef72 100644
--- a/.env
+++ b/.env
@@ -25,6 +25,6 @@ APP_DOCKER_FILE=Dockerfile
 INSTALL_EZ_INSTALL_TYPE=clean
 
 # Behat / Selenium config
-EZP_TEST_REST_HOST=web
-BEHAT_SELENIUM_HOST=selenium
-BEHAT_WEB_HOST=web
+## web host refer to the tip of the setup, so varnish if that is used.
+WEB_HOST=web
+SELENIUM_HOST=selenium
diff --git a/.travis.yml b/.travis.yml
index fb1de30807..62ef13a525 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,7 +16,7 @@ env:
     - SYMFONY_DEBUG=1
   # list of behat arguments to test
   matrix:
-    - TEST_CMD="bin/behat -vv --profile=rest --suite=fullJson --tags=~@broken" COMPOSE_FILE="doc/docker-compose/base-prod.yml:doc/docker-compose/varnish.yml:doc/docker-compose/selenium.yml" BEHAT_WEB_HOST="varnish"
+    - TEST_CMD="bin/behat -vv --profile=rest --suite=fullJson --tags=~@broken" COMPOSE_FILE="doc/docker-compose/base-prod.yml:doc/docker-compose/varnish.yml:doc/docker-compose/selenium.yml" WEB_HOST="varnish"
     - TEST_CMD="bin/behat -vv --profile=rest --suite=fullXml --tags=~@broken"
     - TEST_CMD="bin/behat -vv --profile=core --tags=~@broken"
     - TEST_CMD="bin/phpunit -v vendor/ezsystems/ezpublish-kernel/eZ/Bundle/EzPublishRestBundle/Tests/Functional"
diff --git a/doc/docker-compose/selenium.yml b/doc/docker-compose/selenium.yml
index 5f2b9b1b25..db74dc05b8 100644
--- a/doc/docker-compose/selenium.yml
+++ b/doc/docker-compose/selenium.yml
@@ -16,6 +16,6 @@ services:
     depends_on:
      - selenium
     environment:
-     - EZP_TEST_REST_HOST
-     - BEHAT_SELENIUM_HOST
-     - BEHAT_WEB_HOST
+     - EZP_TEST_REST_HOST=$WEB_HOST
+     - BEHAT_SELENIUM_HOST=$SELENIUM_HOST
+     - BEHAT_WEB_HOST=$WEB_HOST

From 869f53a3dfadb4c27dc49767eafa7e686944d252 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andre=CC=81=20R?= <ar@ez.no>
Date: Wed, 5 Jul 2017 12:38:49 +0200
Subject: [PATCH 8/8] [VCL] Change to use include for paramters to avoid
 duplicating vcl

---
 .../entrypoint/varnish/parameters.vcl         |  19 ++
 .../entrypoint/varnish/varnish4.vcl           | 221 ------------------
 doc/docker-compose/varnish.yml                |   3 +-
 doc/varnish/vcl/parameters.vcl                |  21 ++
 doc/varnish/vcl/varnish3.vcl                  |  20 +-
 doc/varnish/vcl/varnish4.vcl                  |  20 +-
 6 files changed, 46 insertions(+), 258 deletions(-)
 create mode 100644 doc/docker-compose/entrypoint/varnish/parameters.vcl
 delete mode 100644 doc/docker-compose/entrypoint/varnish/varnish4.vcl
 create mode 100644 doc/varnish/vcl/parameters.vcl

diff --git a/doc/docker-compose/entrypoint/varnish/parameters.vcl b/doc/docker-compose/entrypoint/varnish/parameters.vcl
new file mode 100644
index 0000000000..14f4111c8b
--- /dev/null
+++ b/doc/docker-compose/entrypoint/varnish/parameters.vcl
@@ -0,0 +1,19 @@
+// Custom parameters.vcl for docker use
+
+backend ezplatform {
+    .host = "web";
+    .port = "80";
+}
+
+// ACL for invalidators IP
+acl invalidators {
+    "127.0.0.1";
+    "172.16.0.0"/20;
+    "app";
+}
+
+// ACL for debuggers IP
+acl debuggers {
+    "127.0.0.1";
+    "172.16.0.0"/20;
+}
diff --git a/doc/docker-compose/entrypoint/varnish/varnish4.vcl b/doc/docker-compose/entrypoint/varnish/varnish4.vcl
deleted file mode 100644
index 7be2e95294..0000000000
--- a/doc/docker-compose/entrypoint/varnish/varnish4.vcl
+++ /dev/null
@@ -1,221 +0,0 @@
-// Varnish 4 style - eZ 5.4+ / 2014.09+
-// Complete VCL example
-
-vcl 4.0;
-
-// Our Backend - Assuming that web server is listening on port 80
-// Replace the host to fit your setup
-backend ezplatform {
-    .host = "web";
-    .port = "80";
-}
-
-// ACL for invalidators IP
-acl invalidators {
-    "127.0.0.1";
-    "172.16.0.0"/20;
-    "app";
-}
-
-// ACL for debuggers IP
-acl debuggers {
-    "127.0.0.1";
-    "172.16.0.0"/20;
-}
-
-// Called at the beginning of a request, after the complete request has been received
-sub vcl_recv {
-
-    // Set the backend
-    set req.backend_hint = ezplatform;
-
-    // Advertise Symfony for ESI support
-    set req.http.Surrogate-Capability = "abc=ESI/1.0";
-
-    // Add a unique header containing the client address (only for master request)
-    // Please note that /_fragment URI can change in Symfony configuration
-    if (!req.url ~ "^/_fragment") {
-        if (req.http.x-forwarded-for) {
-            set req.http.X-Forwarded-For = req.http.X-Forwarded-For + ", " + client.ip;
-        } else {
-            set req.http.X-Forwarded-For = client.ip;
-        }
-    }
-
-    // Trigger cache purge if needed
-    call ez_purge;
-
-    // Don't cache requests other than GET and HEAD.
-    if (req.method != "GET" && req.method != "HEAD") {
-        return (pass);
-    }
-
-    // Normalize the Accept-Encoding headers
-    if (req.http.Accept-Encoding) {
-        if (req.http.Accept-Encoding ~ "gzip") {
-            set req.http.Accept-Encoding = "gzip";
-        } elsif (req.http.Accept-Encoding ~ "deflate") {
-            set req.http.Accept-Encoding = "deflate";
-        } else {
-            unset req.http.Accept-Encoding;
-        }
-    }
-
-    // Don't cache Authenticate & Authorization
-    // You may remove this when using REST API with basic auth.
-    if (req.http.Authenticate || req.http.Authorization) {
-        if (client.ip ~ debuggers) {
-            set req.http.X-Debug = "Not Cached according to configuration (Authorization)";
-        }
-        return (hash);
-    }
-
-    // Do a standard lookup on assets
-    // Note that file extension list below is not extensive, so consider completing it to fit your needs.
-    if (req.url ~ "\.(css|js|gif|jpe?g|bmp|png|tiff?|ico|img|tga|wmf|svg|swf|ico|mp3|mp4|m4a|ogg|mov|avi|wmv|zip|gz|pdf|ttf|eot|wof)$") {
-        return (hash);
-    }
-
-    // Retrieve client user hash and add it to the forwarded request.
-    call ez_user_hash;
-
-    // If it passes all these tests, do a lookup anyway.
-    return (hash);
-}
-
-// Called when the requested object has been retrieved from the backend
-sub vcl_backend_response {
-
-    if (bereq.http.accept ~ "application/vnd.fos.user-context-hash"
-        && beresp.status >= 500
-    ) {
-        return (abandon);
-    }
-
-    // Optimize to only parse the Response contents from Symfony
-    if (beresp.http.Surrogate-Control ~ "ESI/1.0") {
-        unset beresp.http.Surrogate-Control;
-        set beresp.do_esi = true;
-    }
-
-    // Allow stale content, in case the backend goes down or cache is not fresh any more
-    // make Varnish keep all objects for 1 hours beyond their TTL
-    set beresp.grace = 1h;
-}
-
-// Handle purge
-// You may add FOSHttpCacheBundle tagging rules
-// See http://foshttpcache.readthedocs.org/en/latest/varnish-configuration.html#id4
-sub ez_purge {
-
-    if (req.method == "BAN") {
-        if (!client.ip ~ invalidators) {
-            return (synth(405, "Method Not Allowed"));
-        }
-
-        if (req.http.X-Location-Id) {
-            ban("obj.http.X-Location-Id ~ " + req.http.X-Location-Id);
-            if (client.ip ~ debuggers) {
-                set req.http.X-Debug = "Ban done for content connected to LocationId " + req.http.X-Location-Id;
-            }
-            return (synth(200, "Banned"));
-        }
-    }
-}
-
-// Sub-routine to get client user hash, for context-aware HTTP cache.
-sub ez_user_hash {
-
-    // Prevent tampering attacks on the hash mechanism
-    if (req.restarts == 0
-        && (req.http.accept ~ "application/vnd.fos.user-context-hash"
-            || req.http.x-user-hash
-        )
-    ) {
-        return (synth(400));
-    }
-
-    if (req.restarts == 0 && (req.method == "GET" || req.method == "HEAD")) {
-        // Get User (Context) hash, for varying cache by what user has access to.
-        // https://doc.ez.no/display/EZP/Context+aware+HTTP+cache
-
-        // Anonymous user w/o session => Use hardcoded anonymous hash to avoid backend lookup for hash
-        if (req.http.Cookie !~ "eZSESSID" && !req.http.authorization) {
-            // You may update this hash with the actual one for anonymous user
-            // to get a better cache hit ratio across anonymous users.
-            // Note: You should then update it every time anonymous user rights change.
-            set req.http.X-User-Hash = "38015b703d82206ebc01d17a39c727e5";
-        }
-        // Pre-authenticate request to get shared cache, even when authenticated
-        else {
-            set req.http.x-fos-original-url    = req.url;
-            set req.http.x-fos-original-accept = req.http.accept;
-            set req.http.x-fos-original-cookie = req.http.cookie;
-            // Clean up cookie for the hash request to only keep session cookie, as hash cache will vary on cookie.
-            set req.http.cookie = ";" + req.http.cookie;
-            set req.http.cookie = regsuball(req.http.cookie, "; +", ";");
-            set req.http.cookie = regsuball(req.http.cookie, ";(eZSESSID[^=]*)=", "; \1=");
-            set req.http.cookie = regsuball(req.http.cookie, ";[^ ][^;]*", "");
-            set req.http.cookie = regsuball(req.http.cookie, "^[; ]+|[; ]+$", "");
-
-            set req.http.accept = "application/vnd.fos.user-context-hash";
-            set req.url = "/_fos_user_context_hash";
-
-            // Force the lookup, the backend must tell how to cache/vary response containing the user hash
-
-            return (hash);
-        }
-    }
-
-    // Rebuild the original request which now has the hash.
-    if (req.restarts > 0
-        && req.http.accept == "application/vnd.fos.user-context-hash"
-    ) {
-        set req.url         = req.http.x-fos-original-url;
-        set req.http.accept = req.http.x-fos-original-accept;
-        set req.http.cookie = req.http.x-fos-original-cookie;
-
-        unset req.http.x-fos-original-url;
-        unset req.http.x-fos-original-accept;
-        unset req.http.x-fos-original-cookie;
-
-        // Force the lookup, the backend must tell not to cache or vary on the
-        // user hash to properly separate cached data.
-
-        return (hash);
-    }
-}
-
-sub vcl_deliver {
-    // On receiving the hash response, copy the hash header to the original
-    // request and restart.
-    if (req.restarts == 0
-        && resp.http.content-type ~ "application/vnd.fos.user-context-hash"
-    ) {
-        set req.http.x-user-hash = resp.http.x-user-hash;
-
-        return (restart);
-    }
-
-    // If we get here, this is a real response that gets sent to the client.
-
-    // Remove the vary on context user hash, this is nothing public. Keep all
-    // other vary headers.
-    set resp.http.Vary = regsub(resp.http.Vary, "(?i),? *x-user-hash *", "");
-    set resp.http.Vary = regsub(resp.http.Vary, "^, *", "");
-    if (resp.http.Vary == "") {
-        unset resp.http.Vary;
-    }
-
-    // Sanity check to prevent ever exposing the hash to a client.
-    unset resp.http.x-user-hash;
-
-    if (client.ip ~ debuggers) {
-        if (obj.hits > 0) {
-            set resp.http.X-Cache = "HIT";
-            set resp.http.X-Cache-Hits = obj.hits;
-        } else {
-            set resp.http.X-Cache = "MISS";
-        }
-    }
-}
diff --git a/doc/docker-compose/varnish.yml b/doc/docker-compose/varnish.yml
index b99b685abe..c2c7a364b0 100644
--- a/doc/docker-compose/varnish.yml
+++ b/doc/docker-compose/varnish.yml
@@ -24,7 +24,8 @@ services:
     depends_on:
      - web
     volumes:
-     - ${COMPOSE_DIR}/entrypoint/varnish/varnish4.vcl:/etc/varnish/default.vcl:ro
+     - ${COMPOSE_DIR}/../varnish/vcl/varnish4.vcl:/etc/varnish/default.vcl:ro
+     - ${COMPOSE_DIR}/entrypoint/varnish/parameters.vcl:/etc/varnish/parameters.vcl:ro
 
 
 ## DEBUG??
diff --git a/doc/varnish/vcl/parameters.vcl b/doc/varnish/vcl/parameters.vcl
new file mode 100644
index 0000000000..b988fee6c8
--- /dev/null
+++ b/doc/varnish/vcl/parameters.vcl
@@ -0,0 +1,21 @@
+// Our Backend - Assuming that web server is listening on port 80
+// Replace the host to fit your setup
+//
+// For additional example see: doc/docker-compose/entrypoint/varnish/parameters.vcl
+
+backend ezplatform {
+    .host = "127.0.0.1";
+    .port = "80";
+}
+
+// ACL for invalidators IP
+acl invalidators {
+    "127.0.0.1";
+    "192.168.0.0"/16;
+}
+
+// ACL for debuggers IP
+acl debuggers {
+    "127.0.0.1";
+    "192.168.0.0"/16;
+}
diff --git a/doc/varnish/vcl/varnish3.vcl b/doc/varnish/vcl/varnish3.vcl
index 718c26ea75..fa14859993 100644
--- a/doc/varnish/vcl/varnish3.vcl
+++ b/doc/varnish/vcl/varnish3.vcl
@@ -1,24 +1,8 @@
 // Varnish 3 style - eZ 5.4+ / 2014.09+
 // Complete VCL example
 
-// Our Backend - Assuming that web server is listening on port 80
-// Replace the host to fit your setup
-backend ezplatform {
-    .host = "127.0.0.1";
-    .port = "80";
-}
-
-// ACL for invalidators IP
-acl invalidators {
-    "127.0.0.1";
-    "192.168.0.0"/16;
-}
-
-// ACL for debuggers IP
-acl debuggers {
-    "127.0.0.1";
-    "192.168.0.0"/16;
-}
+// For customizing your backend and acl rules see parameters.yml
+include "parameters.vcl";
 
 // Called at the beginning of a request, after the complete request has been received
 sub vcl_recv {
diff --git a/doc/varnish/vcl/varnish4.vcl b/doc/varnish/vcl/varnish4.vcl
index 8d743b6563..7bbf421632 100644
--- a/doc/varnish/vcl/varnish4.vcl
+++ b/doc/varnish/vcl/varnish4.vcl
@@ -3,24 +3,8 @@
 
 vcl 4.0;
 
-// Our Backend - Assuming that web server is listening on port 80
-// Replace the host to fit your setup
-backend ezplatform {
-    .host = "127.0.0.1";
-    .port = "80";
-}
-
-// ACL for invalidators IP
-acl invalidators {
-    "127.0.0.1";
-    "192.168.0.0"/16;
-}
-
-// ACL for debuggers IP
-acl debuggers {
-    "127.0.0.1";
-    "192.168.0.0"/16;
-}
+// For customizing your backend and acl rules see parameters.yml
+include "parameters.vcl";
 
 // Called at the beginning of a request, after the complete request has been received
 sub vcl_recv {