设置清漆 Apache2 HTTP & HTTPS Z3D945423F8E9496B4629A5D180C.

Question

I have Apache2 with several sites on HTTPS (443, Let's encrypte) and HTTP (80), multiple CMS on Ubuntu 16.04, CPUx16, mem=48G. One of HTTPS (Wordpress) is overloaded - a nonprofit site that shows profiles of orphans with photos/videos and receives donations (up to 10k visitors per day). How do i set up Varnish for cache to memory photos/videos requests to reduce disk load?
Here Apache2 ports.conf :

Listen 80

<IfModule ssl_module>
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

I would be much appreciated for a detailed answer.

Answer 1

Apache port configuration

Adjust the ports.conf and turn Listen 80 into Listen 8080 .

In your vhosts , you'll have to turn <VirtualHost *:80> into <VirtualHost *:8080> as well.

Then you run sudo systemctl restart apache2 to make sure these changes take effect.

Varnish setup

Please run sudo systemctl edit --full varnish to edit the runtime settings of Varnish.

Please make sure Varnish is running on port 80 for regular HTTP and port 8443 for PROXY protocol .

ExecStart=/usr/sbin/varnishd -a :80 -a :8443,PROXY -f /etc/varnish/default.vcl -s malloc,20G

VCL setup

Please create /etc/varnish/letsencrypt.vcl and add the following code:

vcl 4.0;

backend certbot {
    .host = "127.0.0.1";
    .port = "8081";
}

sub vcl_recv {
    if (req.url ~ "^/\.well-known/acme-challenge/") {
        set req.backend_hint = certbot;
        return(pipe);
    }
}

sub vcl_pipe {
    if (req.backend_hint == certbot) {
        set req.http.Connection = "close";
        return(pipe);
    }
}

Please include this file directly after vcl 4.0; in your regular /etc/varnish/default.vcl . Here's an example:

vcl 4.0;
include "/etc/varnish/letsencrypt.vcl";

backend default {
    .host = "127.0.0.1";
    .port = "8080";
}

As you see, the backend in default.vcl points to port 8080 , which is Apache.

Please restart Varnish to make sure these VCL settings are active.

Hitch for TLS termination

Hitch is a TLS proxy developed by Varnish Software . It's powerful, lightweight and configurable.

Please run the following command to install it:

sudo apt-get install -y hitch
sudo systemctl enable hitch

Then create /etc/hitch/hitch.conf and add the following:

frontend = "[*]:443"
backend = "[localhost]:8443"
write-proxy-v2 = on
pem-file = "/etc/letsencrypt/live/yourdomain.com/hitch-bundle.pem"
ciphers = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
tls = on
ssl = off
prefer-server-ciphers = false

Prepare Hitch for LetsEncrypt

Please create /usr/local/bin/hitch-deploy-hook and put the following content in it:

#!/bin/bash
# Full path to pre-generated Diffie Hellman Parameters file
dhparams=/etc/hitch/dhparams.pem

if [[ "${RENEWED_LINEAGE}" == "" ]]; then
    echo "Error: missing RENEWED_LINEAGE env variable." >&2
    exit 1
fi

umask 077
cat ${RENEWED_LINEAGE}/privkey.pem \
${RENEWED_LINEAGE}/fullchain.pem \
${dhparams} > ${RENEWED_LINEAGE}/hitch-bundle.pem

Then run the following commands:

sudo chmod a+x /usr/local/bin/hitch-deploy-hook
openssl dhparam 2048 | sudo tee /etc/hitch/dhparams.pem

Running Cerbot

Make sure the LetsEncrypt cerbot is installed, by running the following command:

sudo apt-get install -y certbot

Then run the following command to install the certificates:

sudo certbot certonly --standalone --preferred-challenges http \
--http-01-port 8081 -d yourdomain.com \
--deploy-hook="/usr/local/bin/hitch-deploy-hook"

After the validation, the certificate will be available at /etc/letsencrypt/live/yourdomain.com/hitch-bundle.pem , which Hitch will use.

Please run sudo systemctl restart hitch to enable Hitch.

LetsEncrypt renewals can also be done using this binary. When renewing, please make sure you reload Hitch as a post renewal hook :

sudo certbot certonly --standalone --preferred-challenges http \
--http-01-port 8081 -d yourdomain.com \
--deploy-hook="/usr/local/bin/hitch-deploy-hook" \
--post-hook="systemctl reload hitch"

I use yourdomain.com as the domain in my examples. Please replace it with the actual value.