<commit_before># Define backend
backend default {
    .host = "<%= node['varnish']['backend_host'] %>";
    .port = "<%= node['varnish']['backend_port'] %>";
}

# Who is allowed to purge?
#acl purgers {
#    "localhost";
#    "<%= node['varnish']['backend_host'] %>";
#}

sub vcl_recv {

    # Define the desktop device
  set req.http.X-Device = "WEB";

  if (req.http.User-Agent ~ "iP(hone|od)" || req.http.User-Agent ~ "Android" || req.http.User-Agent ~ "iPad") {
    # Define smartphones and tablets
    set req.http.X-Device = "MOBILE";
  }

  elseif (req.http.User-Agent ~ "SymbianOS" || req.http.User-Agent ~ "^BlackBerry" || req.http.User-Agent ~ "^SonyEricsson" || req.http.User-Agent ~ "^Nokia" ||
  req.http.User-Agent ~ "^SAMSUNG" || req.http.User-Agent ~ "^LG") {
    # Define every other mobile device
    set req.http.X-Device = "MOBILE";
  }
    if (req.request == "PURGE") {
        if (!req.http.X-VARNISH-SECRET == "<%= node['varnish']['secret_key'] %>") {
            error 405 "You are not allowed to purge";
        }
        ban("obj.http.x-url ~ " + req.url);
        #ban("req.http.host == " + req.http.host + " && req.url ~ " + req.url + "$");
        error 200 "Purged." + req.url;
        #return(lookup);
    }

    # Set proxied ip header to original remote address
        set req.http.X-Forwarded-For = client.ip;

    # If the backend fails, keep serving out of the cache for 30m
        set req.grace = 30m;

    # Remove has_js and Google Analytics cookies
        set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(__[a-z]+|__utm*|has_js)=[^;]*", "");

    # Remove a ";" prefix, if present.
    set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");

    # Remove empty cookies.
    if (req.http.Cookie ~ "^\s*$") {
            unset req.http.Cookie;
    }

    # remove double // in urls,
        set req.url = regsuball( req.url, "//", "/"      );

    # Normalize Accept-Encoding
    if (req.http.Accept-Encoding) {
        if (req.url ~ "\.(jpg|png|gif|gz|tgz|bz2|tbz|mp3|ogg)$") {
            # No point in compressing these
            remove req.http.Accept-Encoding;
        } elsif (req.http.Accept-Encoding ~ "gzip") {
            set req.http.Accept-Encoding = "gzip";
        } elsif (req.http.Accept-Encoding ~ "deflate") {
            set req.http.Accept-Encoding = "deflate";
        } else {
            # unknown algorithm
            remove req.http.Accept-Encoding;
        }
    }

    # Remove cookies for static files
    if (req.url ~ "\.(gif|jpg|jpeg|swf|css|js|flv|mp3|mp4|pdf|ico|png|tif|tiff|mp3|htm|html)(\?.*|)$") {
        unset req.http.cookie;
        return(lookup);
    }

    # Disable caching for backend parts
    if ( req.url ~ "^/[^?]+/wp-(login|admin)" || req.url ~ "^/wp-(login|admin)" || req.url ~ "preview=true" ) {
        return(pass);
    }

    # always pass through posted requests and those with basic auth
    if ( req.request == "POST" || req.http.Authorization ) {
        return (pass);
    }

    # Strip cookies for cached content
    unset req.http.Cookie;
    return(lookup);

}

sub vcl_fetch {

    # If the backend fails, keep serving out of the cache for 30m
    set beresp.grace = 30m;
    set beresp.ttl = 48h;
    set beresp.http.x-url = req.url;
    # Remove some unwanted headers
    unset beresp.http.Server;
    unset beresp.http.X-Powered-By;

    # Respect the Cache-Control=private header from the backend
    if (beresp.http.Cache-   ~ "private") {
        set beresp.http.X-Cacheable = "NO:Cache-Control=private";
    } elsif (beresp.ttl < 1s) {
        set beresp.ttl   = 5s;
        set beresp.grace = 5s;
        set beresp.http.X-Cacheable = "YES:FORCED";
    } else {
        set beresp.http.X-Cacheable = "YES";
    }
     

    # Don't cache responses to posted requests or requests with basic auth
    if ( req.request == "POST" || req.http.Authorization ) {
        return (hit_for_pass);
    }
     
    # Cache error pages for a short while
    if( beresp.status == 404 || beresp.status == 500 || beresp.status == 301 || beresp.status == 302 ){
        set beresp.ttl = 1m;
        return(deliver);
    }

     
    # Do not cache non-success response
    if( beresp.status != 200 ){
    return(hit_for_pass);
    }

    # Strip cookies before these filetypes are inserted into the cache
    if (req.url ~ "\.(png|gif|jpg|swf|css|js)$") {
        unset beresp.http.set-cookie;
    }

    return(deliver);

}

sub vcl_hash {
 if ( req.http.X-Forwarded-Proto ) {
  if ( req.http.X-Device ~ "MOBILE" ) {
    hash_data( req.http.X-Forwarded-Proto + req.http.X-Device );
  }else{

    hash_data( req.http.X-Forwarded-Proto );
  }
}


}

sub vcl_deliver {

    unset resp.http.x-url; # Optional

    # Add debugging headers to cache requests
    if (obj.hits > 0) {
        set resp.http.X-Cache = "HIT";
    }
    else {
        set resp.http.X-Cache = "MISS";
    }

}

sub vcl_error {

    # Try connecting to apache 3 times before giving up
    if (obj.status == 503 && req.restarts < 2) {
        set obj.http.X-Restarts = req.restarts;
        return(restart);
    }
    if (obj.status == 301) {
        set obj.http.Location = req.url;
        set obj.status = 301;
        return(deliver);
    }
<commit_msg>add HTTP-HEADER X-Frame-Options = DENY<commit_after># Define backend
backend default {
    .host = "<%= node['varnish']['backend_host'] %>";
    .port = "<%= node['varnish']['backend_port'] %>";
}

# Who is allowed to purge?
#acl purgers {
#    "localhost";
#    "<%= node['varnish']['backend_host'] %>";
#}

sub vcl_recv {

    # Define the desktop device
  set req.http.X-Device = "WEB";

  if (req.http.User-Agent ~ "iP(hone|od)" || req.http.User-Agent ~ "Android" || req.http.User-Agent ~ "iPad") {
    # Define smartphones and tablets
    set req.http.X-Device = "MOBILE";
  }

  elseif (req.http.User-Agent ~ "SymbianOS" || req.http.User-Agent ~ "^BlackBerry" || req.http.User-Agent ~ "^SonyEricsson" || req.http.User-Agent ~ "^Nokia" ||
  req.http.User-Agent ~ "^SAMSUNG" || req.http.User-Agent ~ "^LG") {
    # Define every other mobile device
    set req.http.X-Device = "MOBILE";
  }
    if (req.request == "PURGE") {
        if (!req.http.X-VARNISH-SECRET == "<%= node['varnish']['secret_key'] %>") {
            error 405 "You are not allowed to purge";
        }
        ban("obj.http.x-url ~ " + req.url);
        #ban("req.http.host == " + req.http.host + " && req.url ~ " + req.url + "$");
        error 200 "Purged." + req.url;
        #return(lookup);
    }

    # Set proxied ip header to original remote address
        set req.http.X-Forwarded-For = client.ip;

    # If the backend fails, keep serving out of the cache for 30m
        set req.grace = 30m;

    # Remove has_js and Google Analytics cookies
        set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(__[a-z]+|__utm*|has_js)=[^;]*", "");

    # Remove a ";" prefix, if present.
    set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");

    # Remove empty cookies.
    if (req.http.Cookie ~ "^\s*$") {
            unset req.http.Cookie;
    }

    # remove double // in urls,
        set req.url = regsuball( req.url, "//", "/"      );

    # Normalize Accept-Encoding
    if (req.http.Accept-Encoding) {
        if (req.url ~ "\.(jpg|png|gif|gz|tgz|bz2|tbz|mp3|ogg)$") {
            # No point in compressing these
            remove req.http.Accept-Encoding;
        } elsif (req.http.Accept-Encoding ~ "gzip") {
            set req.http.Accept-Encoding = "gzip";
        } elsif (req.http.Accept-Encoding ~ "deflate") {
            set req.http.Accept-Encoding = "deflate";
        } else {
            # unknown algorithm
            remove req.http.Accept-Encoding;
        }
    }

    # Remove cookies for static files
    if (req.url ~ "\.(gif|jpg|jpeg|swf|css|js|flv|mp3|mp4|pdf|ico|png|tif|tiff|mp3|htm|html)(\?.*|)$") {
        unset req.http.cookie;
        return(lookup);
    }

    # Disable caching for backend parts
    if ( req.url ~ "^/[^?]+/wp-(login|admin)" || req.url ~ "^/wp-(login|admin)" || req.url ~ "preview=true" ) {
        return(pass);
    }

    # always pass through posted requests and those with basic auth
    if ( req.request == "POST" || req.http.Authorization ) {
        return (pass);
    }

    # Strip cookies for cached content
    unset req.http.Cookie;
    return(lookup);

}

sub vcl_fetch {

    # If the backend fails, keep serving out of the cache for 30m
    set beresp.grace = 30m;
    set beresp.ttl = 48h;
    set beresp.http.x-url = req.url;
    # Remove some unwanted headers
    unset beresp.http.Server;
    unset beresp.http.X-Powered-By;

    # Respect the Cache-Control=private header from the backend
    if (beresp.http.Cache-   ~ "private") {
        set beresp.http.X-Cacheable = "NO:Cache-Control=private";
    } elsif (beresp.ttl < 1s) {
        set beresp.ttl   = 5s;
        set beresp.grace = 5s;
        set beresp.http.X-Cacheable = "YES:FORCED";
    } else {
        set beresp.http.X-Cacheable = "YES";
    }
     

    # Don't cache responses to posted requests or requests with basic auth
    if ( req.request == "POST" || req.http.Authorization ) {
        return (hit_for_pass);
    }
     
    # Cache error pages for a short while
    if( beresp.status == 404 || beresp.status == 500 || beresp.status == 301 || beresp.status == 302 ){
        set beresp.ttl = 1m;
        return(deliver);
    }

     
    # Do not cache non-success response
    if( beresp.status != 200 ){
    return(hit_for_pass);
    }

    # Strip cookies before these filetypes are inserted into the cache
    if (req.url ~ "\.(png|gif|jpg|swf|css|js)$") {
        unset beresp.http.set-cookie;
    }

    return(deliver);

}

sub vcl_hash {
 if ( req.http.X-Forwarded-Proto ) {
  if ( req.http.X-Device ~ "MOBILE" ) {
    hash_data( req.http.X-Forwarded-Proto + req.http.X-Device );
  }else{

    hash_data( req.http.X-Forwarded-Proto );
  }
}


}

sub vcl_deliver {

    unset resp.http.x-url; # Optional
    set resp.http.X-Frame-Options = "DENY";
    # Add debugging headers to cache requests
    if (obj.hits > 0) {
        set resp.http.X-Cache = "HIT";
    }
    else {
        set resp.http.X-Cache = "MISS";
    }

}

sub vcl_error {

    # Try connecting to apache 3 times before giving up
    if (obj.status == 503 && req.restarts < 2) {
        set obj.http.X-Restarts = req.restarts;
        return(restart);
    }
    if (obj.status == 301) {
        set obj.http.Location = req.url;
        set obj.status = 301;
        return(deliver);
    }

{'fraction_non_alphanumeric': 0.15899185143073716, 'fraction_numerical': 0.009854083759711958, 'mean_word_length': 2.2974070602936583, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1999544', 'n_tokens_mistral': 3852, 'n_tokens_neox': 3644, 'n_words': 832}