Varinish + Apache + SSL

gistfile1.txt

# Public-facing, redirects to HTTPS
<VirtualHost *:80>
    ServerName www.example.com
    ServerAlias example.com

    CustomLog /var/log/apache2/www.example.com_access.log combined
    ErrorLog /var/log/apache2/www.example.com_error.log

    # Force HTTPS
    RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</VirtualHost>

# Public-facing, SSL termination
<VirtualHost *:443>
    ServerName www.example.com
    ServerAlias example.com

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/www.example.com.pem
    SSLCertificateKeyFile /etc/ssl/private/www.example.com.key

    RequestHeader set X-Forwarded-Proto "https"

    ProxyRequests Off
    ProxyPreserveHost On
    ProxyAddHeaders On

    RewriteEngine On
    
    # Proxy requests to Varnish
    RewriteRule ^/(.*) http://localhost:6081/$1 [P]
    ProxyPassReverse / http://localhost:6081/

    Header add Strict-Transport-Security "max-age=15552000"
    Header edit Location ^http: https:
</VirtualHost>

# Point Varnish at this vhost
<VirtualHost *:8888>
    ServerName www.example.com
    ServerAlias example.com

    # May want to point these at a different log file, given this will only log varnish cache misses
    CustomLog /var/log/apache2/www.example.com_access.log combined
    ErrorLog /var/log/apache2/www.example.com_error.log

    SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on
    
    DocumentRoot /var/www/www.example.com/docroot
    <Directory /var/www/www.example.com/docroot>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>