Re: [PATCH 1/1] snapshot::web Fix internal redirects to farm
On 11/21/24 9:30 AM, MOESSBAUER, Felix wrote:
>> Fastly matches on UA and inserts a header "X-Download-Directly: yes"
>> if
>> the UA is apt-cacher-ng, otherwise it will send "X-Download-Directly:
>> no". We sent a "Vary: X-Download-Directly" back.
>
> If you take care of the Fastly part, I'll update the local varnish VCL
> rules to handle the X-Download-Directly (I'll send the patch to this ML
> by EO today).
I'm not a service owner to apply the change, but I already worked on the
Fastly bits yesterday.
Relevant VCL (although definitions in Fastly are YAML for ~reasons):
> if (!req.http.X-Download-Directly) {
> set req.http.X-Download-Directly = "no";
> }
[...]
> if( req.http.User-Agent ~ "Apt-Cacher-NG/.+" ) {
> # Header rewrite X-Download-Directly for apt-cacher-ng : 10
> set req.http.X-Download-Directly = "yes";
> }
(From the VCL it looks like I could've also set Fastly-Vary-String, but
given that the webapp needs to do different things, relying on Vary
makes more sense to me.)
[1] is now live.
>
>>
>> The general guidance from Fastly[1] is to narrow the Vary header
>> content
>> down to a few cache keys. That'd be two. I think that'd be fine, as
>> it'd
>> only apply to files fetched by apt-cacher-ng where the caching would
>> then be worse. But that's better than being broken. And we could
>> still
>> patch apt-cacher-ng and fix it for the future - although then it'd be
>> cool if there would be a sane way to match on the UA to identify
>> fixed
>> versions. Like "apt-cacher-ng/version allow-redirects". =)
>
> The patch is already available, it just needs a proposed update upload:
> https://lists.debian.org/debian-snapshot/2024/10/msg00010.html
That'd need a bookworm-pu bug against release.debian.org for
consideration by the release managers first.
> Anyways, that's on your end. My rules will only care about the X-
> Download-Directly header.
Ack. :)
Kind regards
Philipp Kern
[1]
https://salsa.debian.org/dsa-team/mirror/cdn-fastly/-/commit/278e5d7d79a069e2d655bd71ebaf23e56d67e49f
Reply to: