Allow GDAL vsicurl to fetch streamed replies and caching

default.vcl

vcl 4.1;

import dynamic;
backend default none;

sub vcl_init {
    new d = dynamic.director(port = "80");
}

sub vcl_recv {
    # Connect to haproxy, since Varnish cannot connect to HTTPS
	set req.backend_hint = d.backend("haproxy");
	# Specify the Host header
	set req.http.host = "ipt.nina.no";
}

sub vcl_backend_response {
    # Provides Content-Lenght header, needed by GDAL vsicurl
	set beresp.do_stream = false;
	# Drop Tomcat session ID to allow caching
	unset beresp.http.Set-Cookie;
}

docker-compose.yml

services:
  haproxy:
    image: haproxy:2.8
    volumes:
      - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
  proxy:
    image: varnish
    volumes:
      - ./default.vcl:/etc/varnish/default.vcl:ro
      - type: tmpfs
        target: /var/lib/varnish/varnishd:exec
    ports:
      - 8080:80

haproxy.cfg

global
  maxconn 15
  defaults
  mode http
  timeout connect 5000
  timeout check 5000
  timeout client 30000
  timeout server 30000

frontend nina
  bind *:80
  default_backend nina-url

backend nina-url
  server xxx nina.no:443 ssl verify none