authcache-varnish-get-key denied for all requests

Ok so I figured out what it is but I'm not sure how to fix it. I have the following block in my Nginx config

set_real_ip_from 127.0.0.1; # all addresses get a real IP.
real_ip_header X-Forwarded-For; # the ip is forwarded from the load balancer/proxy

It sets the IP correctly of all the requests coming through Varnish so I can still use Fail2ban to ban people. (Otherwise all my nginx logs are from 127.0.0.1 because they're run through Varnish).

Presumably because it's passing through the correct IP the settings PHP chunk:

$conf['reverse_proxy_addresses'] = array('127.0.0.1');

Is then blocking them because they're not now from 127.0.0.1. Is there some way to tell Drupal that these requests are coming from Varnish?

Yep seems good, I added an explanation of how to check if you have real IP enabled in case someone isn't 100% sure.

Is there any particular trade off I should be aware of by turning off that validation?

Hmm yes that is a problem, SSL traffic comes in through 443 and bypasses Varnish completely. Presumably that means they can grab from the cache and everyone is trusted.

Gonna have to come back to this, I guess the ideal solution would be for Nginx to pass requests through to Drupal as 127.0.0.1 and only use the real IP header for logging, but I need learn how to do it or even if it's possible.

EDIT: This might be the solution, to just change the log file reporting, will report back when I get it working:

http://linuxaria.com/article/how-to-log-the-correct-ip-having-varnish-an...

Ok so I got the log solution working. It's super simple, borrow the post I listed above.

In your http block in nginx you declare a new log format:

http {

....
log_format varnish_log '$http_x_forwarded_for - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent "$http_referer" ' '"$http_user_agent"' ;

Then in your virtual host file in /etc/nginx/sites-available/ you add the following option to your log settings:

access_log /var/log/nginx/access.log varnish_log;

Compromises: You can't change the log format of the error log, which means if you're using basic authentication as an extra layer of protection for your backend you can't use fail2ban to monitor it.

I think I like your method slightly better though, because it avoids that compromise completely.

Presumably in that case my settings.php file would look like:

/*
 * Authcache & Varnish
 */


$conf['authcache_varnish_header'] = FALSE;

$is_https = isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on';
if (!$is_https) {
  $conf['authcache_varnish_validate_reverse_proxy_address'] = FALSE;
} else {
$conf['reverse_proxy'] = TRUE;
$conf['reverse_proxy_addresses'] = array('127.0.0.1');
}

Oh of course, no need for the variable if you've disabled the validation.

I've updated this in the handbook.

I left out the log solution because it fixes the same problem that real IP fixes but without requiring any changes to Authcache, I thought it might be a little off topic.

Thanks very much for helping me sort all of that znerol, that's been really helpful.