My question is, how do I have to setup varnish, that the SSL requests pipe
through it and go directly to the managed server? And were do I have to
install the SSL certificate?
Varnish doesnt play with SSL in any fashion (
https://www.varnish-cache.org/docs/trunk/phk/ssl.html ), so you have to use
other tools or different approaches for serving/piping the SSL traffic.
Depending on the software you are familiar with you can either directly
forward the 443 port to your backend using the OS tools like
iptables/ipfw/xinetd/etc (or any other "firewall/portfoward type"
software) - then you need to install the certificate on the backend
webserver.
The drawback of this method is (unless you are using something like TPROXY
for the iptable rules) the backend won't see the original client ip.
Or use something like haproxy / nginx / stud to offload the SSL.
Then you have to install the certificate on the proxy (unless it works in
"tcp mode" - haproxy (and nginx with third party module) can operate like
that).
Usually this is more easy to setup and the client ip can be passed with
additional http headers (X-Forwarded-For) and most webservers have modules
to transparently convert the ip for the application (nginx - realip /
apache - mod_rpaf)
For a single instance of varnish I personally use Stud (
https://github.com/bumptech/stud ).
Haproxy ( http://haproxy.1wt.eu/ ) on the other hand is more suitable for
more complex setups (multiple backends / loadbalancing and more).
rr
_______________________________________________
varnish-misc mailing list
[email protected]
https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc
