@scandipwa/magento-scripts 1.14.1-alpha.1 → 1.14.1-alpha.10

package/index.js

@@ -5,6 +5,19 @@ const getLatestVersion = require('@scandipwa/scandipwa-dev-utils/latest-version'
 const logger = require('@scandipwa/scandipwa-dev-utils/logger');
 const semver = require('semver');
 const isInstalledGlobally = require('is-installed-globally');
+const isRunningRoot = require('./lib/util/is-running-root');
+
+if (isRunningRoot()) {
+    logger.error('Root privileges detected!');
+    console.log(`
+We detected that you are running ${ logger.style.misc('magento-scripts') } as root user.
+We cannot allow you to run ${ logger.style.misc('magento-scripts') } with root privileges, this will only cause more problems.
+
+If you are experiencing problems with ${ logger.style.misc('Docker') }, ${ logger.style.misc('PHPBrew') } and ${ logger.style.misc('PHP') } compilation or ${ logger.style.misc('Magento') } setup, running ${ logger.style.misc('magento-scripts') } as root will not solve those problems.
+`);
+
+    process.exit(1);
+}
 
 const commands = [
     require('./lib/commands/link'),

package/lib/commands/cli.js

@@ -7,6 +7,7 @@ const getProjectConfiguration = require('../config/get-project-configuration');
 const localAuthJson = require('../tasks/composer/local-auth-json');
 const checkConfigurationFile = require('../config/check-configuration-file');
 const { installComposer, installPrestissimo } = require('../tasks/composer');
+const ConsoleBlock = require('../util/console-block');
 
 /**
  * @param {import('yargs')} yargs
@@ -30,13 +31,39 @@ module.exports = (yargs) => {
             rendererOptions: { collapse: false, clearOutput: true }
         });
 
+        let ctx;
         try {
-            await tasks.run();
+            ctx = await tasks.run();
         } catch (e) {
             logger.error(e.message || e);
             process.exit(1);
         }
 
+        const block = new ConsoleBlock();
+
+        block
+            .addHeader('Create Magento App CLI')
+            .addEmptyLine()
+            .addLine(`Available aliases: ${logger.style.command('php')}, ${logger.style.command('magento')}, ${logger.style.command('composer')}`)
+            .addLine(`Available shortcuts: magento -> ${logger.style.command('m')}, composer -> ${logger.style.command('c')}`)
+            .addEmptyLine();
+
+        if (ctx.config.overridenConfiguration.configuration.varnish.enabled) {
+            block.addLine(`Clear Varnish cache: ${logger.style.command('cvc')}`);
+        }
+
+        block
+            .addLine(`Clear Magento cache: ${logger.style.command('m c:c')}`)
+            .addLine(`Magento setup upgrade: ${logger.style.command('m se:up')}`)
+            .addLine(`Magento DI compile: ${logger.style.command('m s:d:c')}`);
+
+        block
+            .addEmptyLine()
+            .addLine(`Clear Composer cache: ${logger.style.command('c cc')}`)
+            .addEmptyLine();
+
+        block.log();
+
         return cli();
     });
 };

package/lib/commands/execute.js

@@ -16,7 +16,8 @@ Available containers:
 - mysql
 - nginx
 - redis
-- elasticsearch`);
+- elasticsearch
+- varnish (if enabled)`);
         },
         async (argv) => {
             const containers = (await docker).getContainers();

package/lib/config/docker.js

@@ -12,7 +12,8 @@ module.exports = async ({ configuration, ssl, host }, config) => {
         redis,
         mysql,
         elasticsearch,
-        mariadb
+        mariadb,
+        varnish
     } = configuration;
 
     const {
@@ -42,7 +43,7 @@ module.exports = async ({ configuration, ssl, host }, config) => {
     const isLinux = os.platform() === 'linux';
     const isWsl = await getIsWsl();
     const isArm = (await getArch()) === 'arm64';
-    const isArmMac = (os.platform() === 'darwin') && isArm;
+    const isNotNativeLinux = (!isLinux || isWsl);
 
     if (!isLinux) {
         /**
@@ -53,7 +54,7 @@ module.exports = async ({ configuration, ssl, host }, config) => {
             name: `${ prefix }_nginx-data`,
             opts: {
                 type: 'nfs',
-                device: `${cacheDir}/nginx/conf.d`,
+                device: path.join(cacheDir, 'nginx', 'conf.d'),
                 o: 'bind'
             }
         };
@@ -61,7 +62,7 @@ module.exports = async ({ configuration, ssl, host }, config) => {
             name: `${ prefix }_pub-data`,
             opts: {
                 type: 'nfs',
-                device: `${ path.join(magentoDir, 'pub') }`,
+                device: path.join(magentoDir, 'pub'),
                 o: 'bind'
             }
         };
@@ -69,18 +70,62 @@ module.exports = async ({ configuration, ssl, host }, config) => {
             name: `${ prefix }_setup-data`,
             opts: {
                 type: 'nfs',
-                device: `${path.join(magentoDir, 'setup')}`,
+                device: path.join(magentoDir, 'setup'),
                 o: 'bind'
             }
         };
+        volumes.sslTerminator = {
+            name: `${ prefix }_ssl-terminator-data`,
+            opts: {
+                type: 'nfs',
+                device: path.join(cacheDir, 'ssl-terminator', 'conf.d'),
+                o: 'bind'
+            }
+        };
+
+        if (varnish.enabled) {
+            volumes.varnish = {
+                name: `${ prefix }_varnish-data`,
+                opts: {
+                    type: 'nfs',
+                    device: path.join(cacheDir, 'varnish'),
+                    o: 'bind'
+                }
+            };
+        }
     }
 
     const getContainers = (ports = {}) => {
         const dockerConfig = {
+            sslTerminator: {
+                _: 'SSL Terminator (Nginx)',
+                ports: isNotNativeLinux ? [
+                    `${ isIpAddress(host) ? host : '127.0.0.1' }:${ ports.sslTerminator }:80`
+                ] : [],
+                healthCheck: {
+                    cmd: 'service nginx status'
+                },
+                /**
+                 * Mount volumes directly on linux
+                 */
+                mountVolumes: [
+                    `${ isLinux ? path.join(cacheDir, 'ssl-terminator', 'conf.d') : volumes.sslTerminator.name }:/etc/nginx/conf.d`
+                ],
+                restart: 'on-failure:5',
+                // TODO: use connect instead
+                network: isNotNativeLinux ? network.name : 'host',
+                image: `nginx:${ nginx.version }`,
+                imageDetails: {
+                    name: 'nginx',
+                    tag: nginx.version
+                },
+                name: `${ prefix }_ssl-terminator`,
+                command: "nginx -g 'daemon off;'"
+            },
             nginx: {
                 _: 'Nginx',
-                ports: (!isLinux || isWsl) ? [
-                    `${isIpAddress(host) ? host : '127.0.0.1'}:${ ports.app }:80`
+                ports: isNotNativeLinux ? [
+                    `${ isIpAddress(host) ? host : '127.0.0.1' }:${ ports.app }:80`
                 ] : [],
                 healthCheck: {
                     cmd: 'service nginx status'
@@ -99,7 +144,7 @@ module.exports = async ({ configuration, ssl, host }, config) => {
                 ],
                 restart: 'on-failure:5',
                 // TODO: use connect instead
-                network: (!isLinux || isWsl) ? network.name : 'host',
+                network: isNotNativeLinux ? network.name : 'host',
                 image: `nginx:${ nginx.version }`,
                 imageDetails: {
                     name: 'nginx',
@@ -126,7 +171,7 @@ module.exports = async ({ configuration, ssl, host }, config) => {
                 connectCommand: ['redis-cli']
             },
             mysql: {
-                _: !isArmMac ? 'MySQL' : 'MariaDB',
+                _: !isArm ? 'MySQL' : 'MariaDB',
                 healthCheck: {
                     cmd: 'mysqladmin ping --silent'
                 },
@@ -154,15 +199,15 @@ module.exports = async ({ configuration, ssl, host }, config) => {
                     'seccomp=unconfined'
                 ],
                 network: network.name,
-                image: !isArmMac ? `mysql:${ mysql.version }` : `mariadb:${ mariadb.version }`,
-                imageDetails: !isArmMac ? {
+                image: !isArm ? `mysql:${ mysql.version }` : `mariadb:${ mariadb.version }`,
+                imageDetails: !isArm ? {
                     name: 'mysql',
                     tag: mysql.version
                 } : {
                     name: 'mariadb',
                     tag: mariadb.version
                 },
-                name: !isArmMac ? `${ prefix }_mysql` : `${ prefix }_mariadb`
+                name: !isArm ? `${ prefix }_mysql` : `${ prefix }_mariadb`
             },
             elasticsearch: {
                 _: 'ElasticSearch',
@@ -195,6 +240,34 @@ module.exports = async ({ configuration, ssl, host }, config) => {
             );
         }
 
+        if (varnish.enabled) {
+            dockerConfig.varnish = {
+                _: 'Varnish',
+                image: `varnish:${ varnish.version }`,
+                imageDetails: {
+                    name: 'varnish',
+                    tag: varnish.version
+                },
+                name: `${ prefix }_varnish`,
+                mountVolumes: [
+                    `${ isLinux ? path.join(cacheDir, 'varnish') : volumes.varnish.name }:/etc/varnish`
+                ],
+                ports: isNotNativeLinux ? [
+                    `${ isIpAddress(host) ? host : '127.0.0.1' }:${ ports.varnish }:80`
+                ] : [],
+                env: {
+                    VARNISH_SIZE: '2G'
+                },
+                restart: 'on-failure:30',
+                network: isNotNativeLinux ? network.name : 'host',
+                // eslint-disable-next-line max-len
+                command: `/bin/bash -c "varnishd -a :${ isNotNativeLinux ? 80 : ports.varnish } -t 600 -f /etc/varnish/default.vcl -s malloc,512m && varnishlog"`,
+                tmpfs: [
+                    '/var/lib/varnish:exec'
+                ]
+            };
+        }
+
         return dockerConfig;
     };
 

package/lib/config/get-port-config.js

@@ -26,6 +26,10 @@ const getAvailablePorts = () => ({
                     'utf-8'
                 )
             );
+            if (!ports.sslTerminator) {
+                ports.sslTerminator = ports.app;
+                ports.app = defaultPorts.app;
+            }
         }
         const {
             systemConfiguration: {
@@ -41,7 +45,7 @@ const getAvailablePorts = () => ({
             if (!isPortAvailable) {
                 throw new Error(`Port ${ctx.port} is not available`);
             } else {
-                availablePorts.app = ctx.port;
+                availablePorts.sslTerminator = ctx.port;
             }
         }
 
@@ -51,7 +55,7 @@ const getAvailablePorts = () => ({
 });
 
 /**
- * @type {import('listr2').ListrTask<import('../../typings/context').ListrContext>}
+ * @type {() => import('listr2').ListrTask<import('../../typings/context').ListrContext>}
  */
 const getCachedPorts = () => ({
     title: 'Getting cached ports',
@@ -65,6 +69,7 @@ const getCachedPorts = () => ({
                     'utf-8'
                 )
             );
+            ctx.cachedPorts = { ...ports };
         } else {
             ports = { ...defaultPorts };
         }

package/lib/config/port-config.js

@@ -54,7 +54,9 @@ const savePortsConfig = async (ports) => {
 
 // Map of default ports (key:value)
 const defaultPorts = {
-    app: 80,
+    app: 3031,
+    varnish: 8080,
+    sslTerminator: 80,
     fpm: 9000,
     xdebug: 9111,
     mysql: 3306,

package/lib/config/scandipwa-versions.js

@@ -9,7 +9,8 @@ const scandipwaMagentoVersionMapping = {
     '2.4.0': '3.1.0 - 3.1.6',
     '2.4.1': '3.2.0 - 4.2.1',
     '2.4.2': '4.3.0 - 5.0.3',
-    '2.4.3': '5.0.4'
+    '2.4.3': '5.0.4 - 5.2.6',
+    '2.4.4': '5.2.7'
 };
 
 module.exports = scandipwaMagentoVersionMapping;

package/lib/config/ssl-terminator/index.js

@@ -0,0 +1,10 @@
+const path = require('path');
+
+const sslTerminator = ({ templateDir }) => ({
+    version: '1.18.0',
+    configTemplate: path.join(templateDir || '', 'ssl-terminator.template.conf')
+});
+
+module.exports = {
+    sslTerminator
+};

package/lib/config/templates/magentorc.template

@@ -3,10 +3,8 @@ alias magento="php $PWD/bin/magento"
 alias m="magento"
 alias composer="php $PWD/node_modules/.create-magento-app-cache/composer/composer.phar"
 alias c="composer"
+<% if (it.varnishEnabled) { %>
+alias cvc="npm run exec varnish varnishadm ban req.url '~ /' && echo 'Varnish cache cleared!'"
+<% } %>
 
 export BASH_SILENCE_DEPRECATION_WARNING=1
-
-echo ""
-echo "Available aliases: php, magento, composer"
-echo "Available shortcuts: magento -> m, composer -> c"
-echo ""

package/lib/config/templates/nginx.template.conf

@@ -1,8 +1,3 @@
-real_ip_header X-Forwarded-For;
-set_real_ip_from 10.0.0.0/8;
-set_real_ip_from 172.0.0.0/8;
-real_ip_recursive on;
-
 upstream fastcgi_backend {
     # use tcp connection
     server <%= it.hostMachine %>:<%= it.ports.fpm %>;
@@ -10,16 +5,7 @@ upstream fastcgi_backend {
 
 server {
     listen <%= it.hostPort %>;
-    <% if (it.config.ssl.enabled) { %>listen 443 ssl;<% } %>
-
-    <% if (it.config.ssl.enabled) { %>server_name <%= it.networkToBindTo %>;
-
-    ssl_certificate /etc/nginx/conf.d/ssl_certificate.pem;
-    ssl_certificate_key /etc/nginx/conf.d/ssl_certificate-key.pem;
-    ssl_protocols TLSv1.2;<% } else if (it.config.host) { %>server_name <%= it.config.host %>;
-    <% } else { %>
     server_name _;
-    <% } %>
 
     set $MAGE_ROOT <%= it.mageRoot %>;
     resolver 127.0.0.11;

package/lib/config/templates/php.template.ini

@@ -1812,7 +1812,7 @@ ldap.max_links = -1
 
 [opcache]
 ; Determines if Zend OPCache is enabled
-; opcache.enable=1
+opcache.enable=1
 
 ; Determines if Zend OPCache is enabled for the CLI version of PHP
 ;opcache.enable_cli=0
@@ -1838,19 +1838,19 @@ ldap.max_links = -1
 
 ; When disabled, you must reset the OPcache manually or restart the
 ; webserver for changes to the filesystem to take effect.
-;opcache.validate_timestamps=1
+opcache.validate_timestamps=1
 
 ; How often (in seconds) to check file timestamps for changes to the shared
 ; memory storage allocation. ("1" means validate once per second, but only
 ; once per request. "0" means always validate)
-;opcache.revalidate_freq=2
+opcache.revalidate_freq=2
 
 ; Enables or disables file search in include_path optimization
 ;opcache.revalidate_path=0
 
 ; If disabled, all PHPDoc comments are dropped from the code to reduce the
 ; size of the optimized code.
-; opcache.save_comments=1
+opcache.save_comments=1
 
 ; If enabled, compilation warnings (including notices and deprecations) will
 ; be recorded and replayed each time a file is included. Otherwise, compilation
@@ -2038,3 +2038,5 @@ xdebug.mode=off
 <% } %>
 
 <% } %>
+
+apc.enabled=1

package/lib/config/templates/ssl-terminator.template.conf

@@ -0,0 +1,27 @@
+real_ip_header X-Forwarded-For;
+set_real_ip_from 10.0.0.0/8;
+set_real_ip_from 172.0.0.0/8;
+real_ip_recursive on;
+
+server {
+    listen <%= it.hostPort %>;
+<% if (it.config.ssl.enabled) { %>  listen 443 ssl;
+    server_name <%= it.networkToBindTo %>;
+
+    ssl_certificate /etc/nginx/conf.d/ssl_certificate.pem;
+    ssl_certificate_key /etc/nginx/conf.d/ssl_certificate-key.pem;
+    ssl_protocols TLSv1.2;<% } %>
+
+    server_name <% if (it.config.host) { %><%= it.config.host %><% } else { %>_<% } %>;
+
+    location / {
+        proxy_buffer_size   128k;
+        proxy_buffers   4 256k;
+        proxy_busy_buffers_size   256k;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header Host $http_host;
+
+        proxy_pass http://<%= it.hostMachine %>:<% if (it.config.configuration.varnish.enabled) { %><%= it.ports.varnish %><% } else { %><%= it.ports.app %><% } %>;
+    }
+}

package/lib/config/templates/varnish.template.vcl

@@ -0,0 +1,250 @@
+# VCL version 5.0 is not supported so it should be 4.0 even though actually used Varnish version is 6
+vcl 4.0;
+
+import std;
+# The minimal Varnish version is 6.0
+# For SSL offloading, pass the following header in your proxy server or load balancer: 'X-Forwarded-Proto: https'
+
+backend default {
+    .host = "<%= it.hostMachine %>";
+    .host_header = "Host: localhost";
+    .port = "<%= it.nginxPort %>";
+    .first_byte_timeout = 600s;
+    .probe = {
+        # .url = "/health_check.php";
+        .request =
+            "GET /health_check.php HTTP/1.1"
+            "Host: localhost"
+            "Connection: close"
+            "User-Agent: Varnish Health Probe";
+        .interval  = 10s;
+        .timeout   = 5s;
+        .window    = 5;
+        .threshold = 3;
+   }
+}
+
+acl purge {
+    "<%= it.hostMachine %>";
+    "localhost";
+    "172.0.0.0"/8;
+    "192.168.0.0"/16;
+}
+
+sub vcl_recv {
+    if (req.restarts > 0) {
+        set req.hash_always_miss = true;
+    }
+
+    if (req.method == "PURGE") {
+        if (client.ip !~ purge) {
+            return (synth(405, "Method not allowed"));
+        }
+        # To use the X-Pool header for purging varnish during automated deployments, make sure the X-Pool header
+        # has been added to the response in your backend server config. This is used, for example, by the
+        # capistrano-magento2 gem for purging old content from varnish during it's deploy routine.
+        if (!req.http.X-Magento-Tags-Pattern && !req.http.X-Pool) {
+            return (synth(400, "X-Magento-Tags-Pattern or X-Pool header required"));
+        }
+        if (req.http.X-Magento-Tags-Pattern) {
+          ban("obj.http.X-Magento-Tags ~ " + req.http.X-Magento-Tags-Pattern);
+        }
+        if (req.http.X-Pool) {
+          ban("obj.http.X-Pool ~ " + req.http.X-Pool);
+        }
+        return (synth(200, "Purged"));
+    }
+
+    if (req.method != "GET" &&
+        req.method != "HEAD" &&
+        req.method != "PUT" &&
+        req.method != "POST" &&
+        req.method != "TRACE" &&
+        req.method != "OPTIONS" &&
+        req.method != "DELETE") {
+          /* Non-RFC2616 or CONNECT which is weird. */
+          return (pipe);
+    }
+
+    # We only deal with GET and HEAD by default
+    if (req.method != "GET" && req.method != "HEAD") {
+        return (pass);
+    }
+
+    # Bypass customer, shopping cart, checkout
+    if (req.url ~ "/customer" || req.url ~ "/checkout") {
+        return (pass);
+    }
+
+    # Bypass health check requests
+    if (req.url ~ "^/(pub/)?(health_check.php)$") {
+        return (pass);
+    }
+
+    # Set initial grace period usage status
+    set req.http.grace = "none";
+
+    # normalize url in case of leading HTTP scheme and domain
+    set req.url = regsub(req.url, "^http[s]?://", "");
+
+    # collect all cookies
+    std.collect(req.http.Cookie);
+
+    # Compression filter. See https://www.varnish-cache.org/trac/wiki/FAQ/Compression
+    if (req.http.Accept-Encoding) {
+        if (req.url ~ "\.(jpg|jpeg|png|gif|gz|tgz|bz2|tbz|mp3|ogg|swf|flv)$") {
+            # No point in compressing these
+            unset req.http.Accept-Encoding;
+        } elsif (req.http.Accept-Encoding ~ "gzip") {
+            set req.http.Accept-Encoding = "gzip";
+        } elsif (req.http.Accept-Encoding ~ "deflate" && req.http.user-agent !~ "MSIE") {
+            set req.http.Accept-Encoding = "deflate";
+        } else {
+            # unknown algorithm
+            unset req.http.Accept-Encoding;
+        }
+    }
+
+    # Remove all marketing get parameters to minimize the cache objects
+    if (req.url ~ "(\?|&)(gclid|cx|ie|cof|siteurl|zanpid|origin|fbclid|mc_[a-z]+|utm_[a-z]+|_bta_[a-z]+)=") {
+        set req.url = regsuball(req.url, "(gclid|cx|ie|cof|siteurl|zanpid|origin|fbclid|mc_[a-z]+|utm_[a-z]+|_bta_[a-z]+)=[-_A-z0-9+()%.]+&?", "");
+        set req.url = regsub(req.url, "[?|&]+$", "");
+    }
+
+    # Static files caching
+    if (req.url ~ "^/(pub/)?(media|static)/") {
+        # Static files should not be cached by default
+        return (pass);
+
+        # But if you use a few locales and don't use CDN you can enable caching static files by commenting previous line (#return (pass);) and uncommenting next 3 lines
+        #unset req.http.Https;
+        #unset req.http.X-Forwarded-Proto;
+        #unset req.http.Cookie;
+    }
+
+    # Authenticated GraphQL requests should not be cached by default
+    if (req.url ~ "/graphql" && req.http.Authorization ~ "^Bearer") {
+        return (pass);
+    }
+
+    return (hash);
+}
+
+sub vcl_hash {
+    if (req.http.cookie ~ "X-Magento-Vary=") {
+        hash_data(regsub(req.http.cookie, "^.*?X-Magento-Vary=([^;]+);*.*$", "\1"));
+    }
+
+    # To make sure http users don't see ssl warning
+    if (req.http.X-Forwarded-Proto) {
+        hash_data(req.http.X-Forwarded-Proto);
+    }
+
+    if (req.url ~ "/graphql") {
+        call process_graphql_headers;
+    }
+}
+
+sub process_graphql_headers {
+    if (req.http.Store) {
+        hash_data(req.http.Store);
+    }
+    if (req.http.Content-Currency) {
+        hash_data(req.http.Content-Currency);
+    }
+}
+
+sub vcl_backend_response {
+
+    set beresp.grace = 3d;
+
+    if (beresp.http.content-type ~ "text") {
+        set beresp.do_esi = true;
+    }
+
+    if (bereq.url ~ "\.js$" || beresp.http.content-type ~ "text") {
+        set beresp.do_gzip = true;
+    }
+
+    if (beresp.http.X-Magento-Debug) {
+        set beresp.http.X-Magento-Cache-Control = beresp.http.Cache-Control;
+    }
+
+    # cache only successfully responses and 404s
+    if (beresp.status != 200 && beresp.status != 404) {
+        set beresp.ttl = 0s;
+        set beresp.uncacheable = true;
+        return (deliver);
+    } elsif (beresp.http.Cache-Control ~ "private") {
+        set beresp.uncacheable = true;
+        set beresp.ttl = 86400s;
+        return (deliver);
+    }
+
+    # validate if we need to cache it and prevent from setting cookie
+    if (beresp.ttl > 0s && (bereq.method == "GET" || bereq.method == "HEAD")) {
+        unset beresp.http.set-cookie;
+    }
+
+   # If page is not cacheable then bypass varnish for 2 minutes as Hit-For-Pass
+   if (beresp.ttl <= 0s ||
+       beresp.http.Surrogate-control ~ "no-store" ||
+       (!beresp.http.Surrogate-Control &&
+       beresp.http.Cache-Control ~ "no-cache|no-store") ||
+       beresp.http.Vary == "*") {
+        # Mark as Hit-For-Pass for the next 2 minutes
+        set beresp.ttl = 120s;
+        set beresp.uncacheable = true;
+    }
+
+    return (deliver);
+}
+
+sub vcl_deliver {
+    if (resp.http.X-Magento-Debug) {
+        if (resp.http.x-varnish ~ " ") {
+            set resp.http.X-Magento-Cache-Debug = "HIT";
+            set resp.http.Grace = req.http.grace;
+        } else {
+            set resp.http.X-Magento-Cache-Debug = "MISS";
+        }
+    } else {
+        unset resp.http.Age;
+    }
+
+    # Not letting browser to cache non-static files.
+    if (resp.http.Cache-Control !~ "private" && req.url !~ "^/(pub/)?(media|static)/") {
+        set resp.http.Pragma = "no-cache";
+        set resp.http.Expires = "-1";
+        set resp.http.Cache-Control = "no-store, no-cache, must-revalidate, max-age=0";
+    }
+
+    unset resp.http.X-Magento-Debug;
+    unset resp.http.X-Magento-Tags;
+    unset resp.http.X-Powered-By;
+    unset resp.http.Server;
+    unset resp.http.X-Varnish;
+    unset resp.http.Via;
+    unset resp.http.Link;
+}
+
+sub vcl_hit {
+    if (obj.ttl >= 0s) {
+        # Hit within TTL period
+        return (deliver);
+    }
+    if (std.healthy(req.backend_hint)) {
+        if (obj.ttl + 300s > 0s) {
+            # Hit after TTL expiration, but within grace period
+            set req.http.grace = "normal (healthy server)";
+            return (deliver);
+        } else {
+            # Hit after TTL and grace expiration
+            return (restart);
+        }
+    } else {
+        # server is not healthy, retrieve from cache
+        set req.http.grace = "unlimited (unhealthy server)";
+        return (deliver);
+    }
+}