# 配置文件版本控制
/etc/varnish/
├── default.vcl           # 主配置文件
├── backends/
│   ├── web.vcl          # 后端定义
│   ├── api.vcl          # API 后端
│   └── static.vcl       # 静态资源后端
├── directors/
│   ├── round-robin.vcl  # 轮询配置
│   └── fallback.vcl     # 故障转移配置
├── rules/
│   ├── cache-rules.vcl  # 缓存规则
│   ├── security.vcl     # 安全规则
│   └── routing.vcl      # 路由规则
├── probes/
│   └── health.vcl       # 健康检查配置
└── includes/
    └── functions.vcl    # 公共函数

#!/bin/bash
# deploy-vcl.sh - VCL 部署脚本

VCL_FILE="$1"
VCL_NAME="deploy_$(date +%Y%m%d_%H%M%S)"

echo "=== VCL Deployment ==="
echo "File: $VCL_FILE"
echo "Name: $VCL_NAME"

# 1. 验证 VCL 语法
echo "1. Validating VCL..."
if ! varnishd -C -f "$VCL_FILE"; then
    echo "ERROR: VCL validation failed"
    exit 1
fi
echo "   VCL validation passed"

# 2. 加载 VCL
echo "2. Loading VCL..."
if ! varnishadm vcl.load "$VCL_NAME" "$VCL_FILE"; then
    echo "ERROR: VCL loading failed"
    exit 1
fi
echo "   VCL loaded as $VCL_NAME"

# 3. 切换 VCL
echo "3. Activating VCL..."
if ! varnishadm vcl.use "$VCL_NAME"; then
    echo "ERROR: VCL activation failed"
    exit 1
fi
echo "   VCL activated"

# 4. 清理旧 VCL
echo "4. Cleaning up old VCLs..."
OLD_VCLS=$(varnishadm vcl.list | grep "^available" | awk '{print $3}' | head -n -3)
for vcl in $OLD_VCLS; do
    varnishadm vcl.discard "$vcl" 2>/dev/null
    echo "   Discarded: $vcl"
done

echo "=== Deployment Complete ==="

# prometheus.yml
scrape_configs:
  - job_name: 'varnish'
    static_configs:
      - targets:
        - 'varnish-01:9131'
        - 'varnish-02:9131'
        - 'varnish-03:9131'
    scrape_interval: 15s
    scrape_timeout: 10s
    metrics_path: /metrics

  - job_name: 'node'
    static_configs:
      - targets:
        - 'varnish-01:9100'
        - 'varnish-02:9100'
        - 'varnish-03:9100'

# alert-rules.yml
groups:
  - name: varnish
    rules:
      - alert: VarnishLowHitRate
        expr: rate(varnish_main_cache_hit[5m]) / (rate(varnish_main_cache_hit[5m]) + rate(varnish_main_cache_miss[5m])) * 100 < 70
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Varnish 缓存命中率低于 70%"
          description: "{{ $labels.instance }} 缓存命中率: {{ $value }}%"

      - alert: VarnishHighErrorRate
        expr: rate(varnish_main_client_req_5xx[5m]) / rate(varnish_main_client_req[5m]) * 100 > 1
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "Varnish 5xx 错误率超过 1%"

      - alert: VarnishBackendUnhealthy
        expr: varnish_backend_healthy == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Varnish 后端不健康: {{ $labels.backend }}"

      - alert: VarnishHighMemoryUsage
        expr: varnish_sma_g_bytes / (varnish_sma_g_bytes + varnish_sma_g_space) * 100 > 90
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Varnish 内存使用率超过 90%"

      - alert: VarnishThreadSaturation
        expr: varnish_main_threads > 400
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Varnish 线程数超过 400"

{
  "dashboard": {
    "title": "Varnish Cache Overview",
    "panels": [
      {
        "title": "Cache Hit Rate",
        "type": "stat",
        "targets": [{
          "expr": "rate(varnish_main_cache_hit[5m]) / (rate(varnish_main_cache_hit[5m]) + rate(varnish_main_cache_miss[5m])) * 100"
        }],
        "thresholds": {
          "steps": [
            {"value": 0, "color": "red"},
            {"value": 70, "color": "yellow"},
            {"value": 90, "color": "green"}
          ]
        }
      },
      {
        "title": "Request Rate",
        "type": "graph",
        "targets": [{
          "expr": "rate(varnish_main_client_req[5m])"
        }]
      },
      {
        "title": "Backend Health",
        "type": "stat",
        "targets": [{
          "expr": "count(varnish_backend_healthy == 1)"
        }]
      },
      {
        "title": "Response Time Distribution",
        "type": "heatmap",
        "targets": [{
          "expr": "rate(varnish_main_n_vcl_response[5m])"
        }]
      }
    ]
  }
}

# 1. 限制管理接口监听地址
varnishd -T 127.0.0.1:6082  # 只监听本地

# 2. 使用密钥认证
# /etc/varnish/secret
echo "your-secret-key" > /etc/varnish/secret
chmod 600 /etc/varnish/secret

# 启动时指定密钥
varnishd -T 127.0.0.1:6082 -S /etc/varnish/secret

# 3. 使用 SSH 隧道访问管理接口
ssh -L 6082:localhost:6082 user@varnish-server
varnishadm -T localhost:6082

#!/bin/bash
# cdn-purge.sh - 协调多级缓存清除

URL="$1"

# 1. 清除 Varnish 缓存
echo "Purging Varnish cache..."
curl -X PURGE -H "Host: www.example.com" "http://varnish:6081${URL}"

# 2. 清除 CDN 缓存（以 Cloudflare 为例）
echo "Purging Cloudflare cache..."
curl -X POST "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/purge_cache" \
    -H "Authorization: Bearer ${CF_API_TOKEN}" \
    -H "Content-Type: application/json" \
    --data "{\"files\":[\"https://www.example.com${URL}\"]}"

# 3. 清除应用层缓存
echo "Purging application cache..."
curl -X POST "http://app-server/cache/purge" \
    -H "Authorization: Bearer ${APP_TOKEN}" \
    -d "{\"url\": \"${URL}\"}"

echo "All caches purged."

## 部署前检查

- [ ] VCL 语法验证通过
- [ ] 后端健康检查正常
- [ ] 防火墙规则配置
- [ ] TLS 证书有效
- [ ] 监控告警配置
- [ ] 回滚方案准备
- [ ] 备份当前配置
- [ ] 通知相关人员

## 部署步骤

1. 备份当前配置
2. 加载新 VCL（不激活）
3. 验证新 VCL
4. 灰度发布（10% 流量）
5. 监控关键指标
6. 全量发布
7. 验证确认
8. 更新文档

## 部署后检查

- [ ] 缓存命中率正常
- [ ] 后端负载正常
- [ ] 错误率无异常
- [ ] 响应时间正常
- [ ] 监控数据正常
- [ ] 用户反馈正常

#!/bin/bash
# rollback-vcl.sh - VCL 回滚脚本

echo "=== VCL Rollback ==="

# 获取当前活动的 VCL
CURRENT=$(varnishadm vcl.list | grep "^active" | awk '{print $3}')
echo "Current VCL: $CURRENT"

# 列出可用的 VCL
echo "Available VCLs:"
varnishadm vcl.list | grep "^available"

# 使用上一个 VCL
PREVIOUS=$(varnishadm vcl.list | grep "^available" | tail -1 | awk '{print $3}')
if [ -z "$PREVIOUS" ]; then
    echo "ERROR: No previous VCL available"
    exit 1
fi

echo "Rolling back to: $PREVIOUS"

# 切换 VCL
if varnishadm vcl.use "$PREVIOUS"; then
    echo "Rollback successful"
    # 清理失败的 VCL
    varnishadm vcl.discard "$CURRENT" 2>/dev/null
else
    echo "ERROR: Rollback failed"
    exit 1
fi

# 容量计算公式

# 1. 缓存容量
# 缓存大小 = 平均对象大小 × 目标对象数 × 1.2（冗余）
# 示例：10KB × 100,000 × 1.2 = 1.2GB

# 2. 并发连接数
# 并发数 = 每秒请求数 × 平均响应时间
# 示例：1000 req/s × 0.1s = 100 并发

# 3. 带宽需求
# 带宽 = 每秒请求数 × 平均响应大小
# 示例：1000 req/s × 50KB = 50MB/s = 400Mbps

# 4. CPU 需求
# CPU 核数 = 并发数 / 500（每核约 500 并发）
# 示例：1000 / 500 = 2 核

# 监控验证
varnishstat -1 | grep -E "MAIN.sess|MAIN.client_req"

#!/bin/bash
# update-varnish.sh - Varnish 更新脚本

echo "=== Varnish Update ==="

# 1. 检查当前版本
CURRENT_VERSION=$(varnishd -V 2>&1 | head -1)
echo "Current version: $CURRENT_VERSION"

# 2. 备份配置
echo "Backing up configuration..."
tar -czf /backup/varnish-config-$(date +%Y%m%d).tar.gz /etc/varnish/

# 3. 停止服务
echo "Stopping Varnish..."
sudo systemctl stop varnish

# 4. 更新软件包
echo "Updating Varnish..."
sudo apt-get update
sudo apt-get install -y varnish

# 5. 验证新版本
NEW_VERSION=$(varnishd -V 2>&1 | head -1)
echo "New version: $NEW_VERSION"

# 6. 验证配置
echo "Validating configuration..."
if ! varnishd -C -f /etc/varnish/default.vcl; then
    echo "ERROR: Configuration invalid with new version"
    echo "Rolling back..."
    sudo apt-get install -y varnish=$CURRENT_VERSION
    exit 1
fi

# 7. 启动服务
echo "Starting Varnish..."
sudo systemctl start varnish

# 8. 验证服务
echo "Verifying service..."
sleep 5
if curl -sf http://localhost:6081/ > /dev/null; then
    echo "Update successful"
else
    echo "ERROR: Service not responding"
    exit 1
fi

echo "=== Update Complete ==="

#!/bin/bash
# zero-downtime-update.sh - 零停机更新

# 使用蓝绿部署

# 步骤 1：在新容器中启动 Varnish
docker run -d --name varnish-new \
    -p 6083:6081 \
    -v /etc/varnish:/etc/varnish:ro \
    varnish:7.5-new

# 步骤 2：验证新容器
sleep 10
if curl -sf http://localhost:6083/ > /dev/null; then
    echo "New container healthy"
else
    echo "New container failed"
    docker rm -f varnish-new
    exit 1
fi

# 步骤 3：切换流量（使用 HAProxy 或 Nginx）
# 更新负载均衡器配置，将流量指向新容器

# 步骤 4：停止旧容器
docker stop varnish-old
docker rm varnish-old

# 步骤 5：重命名新容器
docker rename varnish-new varnish-old

echo "Zero-downtime update complete"

# VCL 热更新（不中断服务）

# 1. 加载新 VCL
varnishadm vcl.load new_config /etc/varnish/new.vcl

# 2. 验证新 VCL
varnishadm vcl.list

# 3. 激活新 VCL
varnishadm vcl.use new_config

# 4. 清理旧 VCL
varnishadm vcl.discard old_config

# 注意：VCL 热更新不会中断现有连接
# 新连接将使用新 VCL，现有连接继续使用旧 VCL

#!/bin/bash
# backup-config.sh - Varnish 配置备份

BACKUP_DIR="/backup/varnish"
DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="${BACKUP_DIR}/varnish-config-${DATE}.tar.gz"

# 创建备份目录
mkdir -p "$BACKUP_DIR"

# 备份配置文件
tar -czf "$BACKUP_FILE" \
    /etc/varnish/ \
    /etc/default/varnish \
    /etc/systemd/system/varnish.service \
    2>/dev/null

# 保留最近 30 天的备份
find "$BACKUP_DIR" -name "*.tar.gz" -mtime +30 -delete

echo "Backup created: $BACKUP_FILE"

#!/bin/bash
# restore-config.sh - Varnish 配置恢复

BACKUP_FILE="$1"

if [ -z "$BACKUP_FILE" ]; then
    echo "Usage: $0 <backup-file>"
    exit 1
fi

echo "=== Restoring Varnish Configuration ==="
echo "Backup: $BACKUP_FILE"

# 1. 停止 Varnish
echo "Stopping Varnish..."
sudo systemctl stop varnish

# 2. 恢复配置
echo "Restoring configuration..."
sudo tar -xzf "$BACKUP_FILE" -C /

# 3. 验证配置
echo "Validating configuration..."
if ! varnishd -C -f /etc/varnish/default.vcl; then
    echo "ERROR: Configuration validation failed"
    exit 1
fi

# 4. 启动 Varnish
echo "Starting Varnish..."
sudo systemctl start varnish

# 5. 验证服务
echo "Verifying service..."
sleep 5
if curl -sf http://localhost:6081/ > /dev/null; then
    echo "Restore successful"
else
    echo "ERROR: Service not responding"
    exit 1
fi

echo "=== Restore Complete ==="

# Varnish 运维文档

## 1. 系统概述
- 部署架构
- 服务器列表
- 网络拓扑

## 2. 配置说明
- VCL 配置说明
- 参数配置说明
- 后端配置说明

## 3. 运维操作
- 日常巡检
- 故障处理
- 性能调优
- 版本更新

## 4. 应急预案
- 缓存清除
- 服务降级
- 故障转移
- 回滚操作

## 5. 监控告警
- 监控指标
- 告警规则
- 告警处理

## 6. 联系方式
- 运维负责人
- 开发负责人
- 供应商联系

## 变更记录

### 2026-05-10
- **类型**: 配置变更
- **内容**: 优化缓存策略，产品页 TTL 从 5 分钟调整为 10 分钟
- **原因**: 减少后端负载
- **影响**: 缓存命中率提升 5%
- **负责人**: 张三

### 2026-05-08
- **类型**: 版本升级
- **内容**: Varnish 7.4.3 → 7.5.1
- **原因**: 安全补丁
- **影响**: 无
- **负责人**: 李四