Confused about Apache and Varnish Ports when redirecting HTTP to HTTPS with Magento 2

Question

Our setup is a Magento 2.3.3 store running on a dedicated (not shared) Linux host. We have full root access and can edit all files as needed. The httpd server is Apache 2.4. Varnish is ver 6.3.

Varnish is installed. (var/page_cache/ remains empty. But curl -I -v --location-trusted 'https://www.example.com/shop does not show varnish or a cache hit, however I also don't have any products in the store yet. The returned page is the Luma home page.)

netstat -tulpn

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      15985/redis-server
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      192629/varnishd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      309/sshd
tcp        0      0 127.0.0.1:6082          0.0.0.0:*               LISTEN      192629/varnishd
tcp6       0      0 :::3306                 :::*                    LISTEN      323/mysqld
tcp6       0      0 :::80                   :::*                    LISTEN      192629/varnishd
tcp6       0      0 :::8080                 :::*                    LISTEN      192003/httpd
tcp6       0      0 127.0.0.1:9200          :::*                    LISTEN      26576/java
tcp6       0      0 ::1:9200                :::*                    LISTEN      26576/java
tcp6       0      0 127.0.0.1:9300          :::*                    LISTEN      26576/java
tcp6       0      0 ::1:9300                :::*                    LISTEN      26576/java
tcp6       0      0 :::22                   :::*                    LISTEN      309/sshd
tcp6       0      0 :::443                  :::*                    LISTEN      192003/httpd

I am confused about the configured ports. Even if Varnish is working (I'm not sure it is) I want to understand how it work, particularly how the ports should be configured.

I followed these documents when setting varnish up:

1. https://devdocs.magento.com/guides/v2.3/config-guide/varnish/config-varnish.html
2. https://devdocs.magento.com/guides/v2.3/config-guide/varnish/config-varnish-configure.html
3. https://devdocs.magento.com/guides/v2.3/config-guide/varnish/config-varnish-magento.html

Next I read the nice blog How To Use Apache2 for SSL Termination With Varnish. See section "HTTPS only". With the diagrams in the blog, everything makes sense in that context (without Magento). However, that does not appear to be the way it should be done in Magento, and this is when my confusion set in. See my configs below.

In our site all pages are served via HTTPS exclusively using a Let's Encrypt certificate. Everything is on localhost.

According to How To Use Apache2 for SSL Termination With Varnish, it seems I should have one more port (with a different value such as 8081) assigned to my virtual host. Is this not needed with Magento? (Varnish is only serving Magento in this setup.)

That reference shows external requests coming to port 443. (I have a redirect of HTTP to HTTPS in front of that.) Then going to an internal varnish port (example 8080) and finally going to an internal Apache port (8181).

The Magento docs have a similar diagram, but without the helpful port numbers. I see that the request termination is Apache above, but Magento in the image below. I'm not exactly clear how that affects things.

What should my ports be for each of these files?

Main httpd.conf:

Listen 8080

I do not have a ports.conf. I do not have any other VirtualHost directives defined.

Here are the host and port settings from /etc/varnish/default.vcl:

backend default {
  .host = "localhost";
  .port = "8080";

Here are the current virtual host files (only Magento is installed). In the HTTP conf I originally used port 80. Is port 80 the correct one for this file? With either port the curl test does not return Via: 1.1 varnish-v4 X-Magento-Cache-Debug: HIT

<VirtualHost *:8080>
        ServerAdmin [email protected]
        DocumentRoot "/var/www/html/magento2/pub/"
        ServerName www.example.com
        Redirect permanent / https://www.example.com
</VirtualHost>

And for HTTPS the port is OK:

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerAdmin [email protected]
    DocumentRoot "/var/www/html/magento2/pub/"
    ServerName example.com
    ServerAlias www.example.com

    SSLCertificateFile /etc/letsencrypt/live/www.example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/www.example.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite HIGH:!aNULL:!MD5:!3DES:!CAMELLIA:!AES128
</VirtualHost>
</IfModule>

Would it be better to use the setup from How To Use Apache2 for SSL Termination With Varnish? What about if I add a WordPress blog to the site and want to leverage Varnish for that too?

How to use HTTPS with varnish or a fast way (Struggling) (linked)

Answer 1

this is very simple solution, as example use HTTPS only:

apache 80 (return 301) -> apache 443 (proxy) -> varnish 8081 (cache) -> apache 8080 (php-fpm)

then in apache 443 (proxy), you need to configure something like this:

ProxyPreserveHost On
ProxyPass / http://127.0.0.1:8081/
RequestHeader set X-Forwarded-Port "443"
RequestHeader set X-Forwarded-Proto "https"

no php processed in here: apache 80 (return 301) -> apache 443 (proxy)

varnish then will be like:

backend default {
  .host = "localhost";
  .port = "8080";
}