Reworked Varnish service configuration

Author: carlalexander

roles/varnish/defaults/main.yml

@@ -24,11 +24,6 @@ varnish__admin_listen: '6082'
 # How much memory is reserved for the Varnish cache
 varnish__memory_allocation: '{{ 0.5 * ansible_memtotal_mb|int }}m'
 
-# .. envvar:: varnish__ncsa_enabled
-#
-# Is Varnish NCSA-style logging enabled?
-varnish__ncsa_enabled: True
-
 # .. envvar:: varnish__ttl
 #
 # Default time to live (TTL) for cached objects.

roles/varnish/handlers/main.yml

@@ -1,13 +1,8 @@
 ---
 
+- name: Reload systemd daemon
+  shell: systemctl daemon-reload
+  notify: Restart varnish
+
 - name: Restart varnish
   service: name=varnish state=restarted
-
-- name: Reload varnish
-  service: name=varnish state=reloaded
-
-- name: Restart varnishncsa
-  service: name=varnishncsa state=restarted
-
-- name: Reload varnishncsa
-  service: name=varnishncsa state=reloaded

roles/varnish/tasks/main.yml

@@ -10,29 +10,14 @@
   with_flattened:
     - 'varnish'
 
-- name: Configure Varnish
+- name: Configure Varnish service
   template:
-    src: 'etc/default/varnish.j2'
-    dest: '/etc/default/varnish'
+    src: 'etc/systemd/system/varnish.service.j2'
+    dest: '/etc/systemd/system/varnish.service'
     owner: 'root'
     group: 'root'
     mode: '0644'
-  notify: [ 'Restart varnish' ]
-
-- name: Append "varnish" group to "varnishlog" user
-  user:
-    name: 'varnishlog'
-    append: 'true'
-    groups: 'varnish'
-
-- name: Configure Varnish NCSA-style logging
-  template:
-    src: 'etc/default/varnishncsa.j2'
-    dest: '/etc/default/varnishncsa'
-    owner: 'root'
-    group: 'root'
-    mode: '0644'
-  notify: [ 'Restart varnishncsa' ]
+  notify: [ 'Reload systemd daemon' ]
 
 - name: Configure default.vcl for Varnish
   template:

roles/varnish/templates/etc/default/varnish.j2

@@ -0,0 +1,20 @@
+# {{ ansible_managed }}
+
+[Unit]
+Description=Varnish HTTP accelerator
+Documentation=https://www.varnish-cache.org/docs/4.1/ man:varnishd
+
+[Service]
+Type=simple
+LimitNOFILE=131072
+LimitMEMLOCK=82000
+PIDFile=/run/varnishd.pid
+ExecStart=/usr/sbin/varnishd -j unix,user=vcache -P /run/varnishd.pid -F -a *:{{ varnish__listen }} -T localhost:{{ varnish__admin_listen }} -t {{ varnish__ttl }} -f /etc/varnish/default.vcl -S /etc/varnish/secret -s malloc,{{ varnish__memory_allocation }}
+ExecReload=/usr/share/varnish/reload-vcl
+ProtectSystem=full
+ProtectHome=true
+PrivateTmp=true
+PrivateDevices=true
+
+[Install]
+WantedBy=multi-user.target

roles/varnish/templates/etc/default/varnishncsa.j2

@@ -74,7 +74,6 @@ dependencies:
     tags: [ 'depend::varnish', 'depend::varnish:wordpress', 'depend-of::wordpress', 'type::dependency' ]
     varnish__listen: '{{ wordpress__varnish_listen }}'
     varnish__backends: [ '{{ wordpress__varnish_backend }}' ]
-    varnish__ncsa_enabled: '{{ wordpress__varnish_ncsa_enabled }}'
     varnish__add_ban_lurker_headers: '{{ wordpress__varnish_add_ban_lurker_headers }}'
     varnish__normalize_query_parameters: '{{ wordpress__varnish_normalize_query_parameters }}'
     varnish__purge_allow: '{{ wordpress__varnish_purge_allow }}'