Lets Encrypt certbot challenge VCL with backend failover

lets_encrypt.vcl

# Lets Encrypt certbot challenge VCL

backend certbot {
    .host = "127.0.0.1";
    .port = "888";
}

sub vcl_recv {
    unset req.http.X-lets-certbot;
    if (req.url ~ "^/\.well-known/acme-challenge/" && !req.restarts) {
        set req.backend_hint = certbot;
        set req.http.X-lets-certbot = "true";
        return (pass);
    }
}

sub vcl_pass {
    if (req.backend_hint == certbot && req.http.X-lets-certbot) {
        return (fetch);
    }
}

sub vcl_backend_fetch {
    if (bereq.backend == certbot && bereq.http.X-lets-certbot) {
        return (fetch);
    }
}

sub vcl_backend_response {
    if (bereq.backend == certbot && bereq.http.X-lets-certbot) {
        return (deliver);
    }
}

sub vcl_backend_error {
    if (bereq.backend == certbot && bereq.http.X-lets-certbot) {
        return (abandon);
    }
}

sub vcl_synth {
    if (req.backend_hint == certbot && req.http.X-lets-certbot) {
        return (restart);
    }
}

sub vcl_deliver {
    if (req.backend_hint == certbot && req.http.X-lets-certbot) {
        return (deliver);
    }
}