www/varnish4: fix race condition on start, new features

[feld]

Summary

Fix race condition by removing _.vsm on start

• varnishncsa and varnishlog wait for this file before starting.
• varnishd does not clean this up which causes them to think varnishd is successfully running. This causes them to fail to start.

Fix default description of varnishd_flags

Add a "configtest" option to test your configuration

Run configtest in start_precmd to ensure config is good before starting

• This provides good positive feedback to the user and clearly points out which config they are using

Run configtest before restarting to ensure config is good

• Prevent foot-shooting

Add a "reload" option to reload your VCL file

• It does a configtest to make sure you don't break your running service. More foot protection.

Install pid files on first-run as mode 644 instead of default 775.

Install log files on first-run as mode 640 instead of default 775.

[feld]

add "restart_precmd" to run the configtest

Don't allow a restart unless the VCL config is valid

[feld]

Mode 664 -> 644 for pid files

[feld]

www/varnish4/files/varnishd.in

128 ↗

(On Diff #9741)

I think this is OK.

https://www.varnish-cache.org/docs/trunk/reference/vsm.html

We do not yet support multiple varnish instances via rc script (-n foo instead of $(hostname) ), but if we did this is easily updated to handle that.

[mat]

www/varnish4/files/varnishd.in

44 ↗

(On Diff #9741)

So, if varnishd_config is unset you add -f ${varnishd_config} to the command line ? this feels wrong.

[feld]

www/varnish4/files/varnishd.in

44 ↗

(On Diff #9741)

oh, these descriptions are swapped. I'll fix, thanks!

[feld]

Fix varnishd_flags description: varnishd_config set vs unset examples were swapped

[feld]

fixed swapped descriptions

[mat]

www/varnish4/files/varnishncsa.in

62 ↗

(On Diff #9768)

Why 664 ?

[feld]

Log files should be 640 by default

[feld]

www/varnish4/files/varnishncsa.in

62 ↗

(On Diff #9770)

good catch. I intended this to be 640 so users in the varnish group could read the logs, but they're not world-readable.

[feld]

varnishlog and varnishncsa have a built-in "wait for varnishd" via -t

setting "-t 0" will allow them to wait indefinitely for varnishd to attach
to the _.vsm file

[feld]

I misread the docs.

-t 0 tries once and fails immediately.
-t off tries indefinitely.

[feld]

rc script docs for varnishlog_flags and varnishncsa_flags didn't match
reality

[mat]

www/varnish4/files/varnishncsa.in

28 ↗

(On Diff #9786)

A small reminder, this does not work ?

[feld]

remove _.vsm wait code for varnishncsa rc script, too

[feld]

Fix ability to specify varnishncsa_logformat

Due to shell quoting hell that comes from rc.subr combined with
$name_user="" privilege dropping feature there's no way to get
varnishncsa_logformat to work. The solution is to lean on daemon(8) to
handle starting the process with the right uid. This will permit us to
pass escaped quotes through as an argument and preserve the entire
string.

As a result, do the same for varnishlog for consistency.

The privsep was a new feature and there's not a great reason for general
users to require the ability to change UID that the daemons run as.

[feld]

I think all concerns have been addressed. Please test if you can!

[feld]

I missed removing $varnishlog_user and $varnishncsa_user from the
install commands in start_precmd