for snapshot, disable keep-alive so we can rate-limit better

diff --git a/modules/roles/templates/snapshot/snapshot.debian.org.vcl.erb b/modules/roles/templates/snapshot/snapshot.debian.org.vcl.erb
index 25e6d12..8659b63 100644 (file)
--- a/modules/roles/templates/snapshot/snapshot.debian.org.vcl.erb
+++ b/modules/roles/templates/snapshot/snapshot.debian.org.vcl.erb
@@ -25,3 +25,13 @@ sub vcl_purge {
     return(restart);
   }
 }
+
+# We rate-limit requests by clients.
+#  Currently, we do that at the netfilter level, so one
+#  request per connection works best.
+sub vcl_deliver {
+  if (remote.ip != "127.0.0.1" &&
+      remote.ip != "::1") {
+    set resp.http.connection = "close";
+  }
+}