Drupal 8.0 cache tags implemented as xkey

cache_tags.vcl

#
# Drupal 8.0 cache tags implemented as xkey
#
# https://www.drupal.org/docs/8/api/cache-api/cache-tags-varnish
#

vcl 4.0;

import xkey;

# Only these IPs can purge
acl purge {
    "127.0.0.1";
}

sub vcl_recv {
    # Only allow BAN requests from IP addresses in the 'purge' ACL.
    if (req.method == "BAN") {
        # Same ACL check as above:
        if (!client.ip ~ purge) {
            return (synth(403, "Not allowed."));
        }

        # Logic for the ban, using the X-Cache-Tags header.
        if (req.http.X-Cache-Tags) {
            # Dont use ban, use xkey.purge()
            #ban("obj.http.X-Cache-Tags ~ " + req.http.X-Cache-Tags);
            set req.http.n-xkey = xkey.purge(regsuball(req.http.X-Cache-Tags, "\|", " "));
        } else {
            return (synth(403, "X-Cache-Tags header missing."));
        }

        # Throw a synthetic page so the request won't go to the backend.
        return (synth(200, "Ban added (xkey=" + req.http.n-xkey + ")"));
    }
}

sub vcl_backend_response {
    # Ban-lurker fields
    set beresp.http.X-Url = bereq.url;
    set beresp.http.X-Host = bereq.http.host;

    # Convert cache-tags to xkey
    set beresp.http.xkey = beresp.http.X-Cache-Tags;
    unset beresp.http.X-Cache-Tags;
}

sub vcl_deliver {
    # Remove all ban, purge, and xkey tags
    unset resp.http.X-Url;
    unset resp.http.X-Host;
    unset resp.http.X-Cache-Contexts;
    unset resp.http.xkey;
}