varnish add

deploy/varnish/default.vcl.template

@@ -0,0 +1,56 @@
+vcl 4.1;
+
+backend app {
+  .host = "app";
+  .port = "${APP_PORT}";
+}
+
+acl purge { "127.0.0.1"; }
+
+sub vcl_recv {
+  # PURGE tylko lokalnie
+  if (req.method == "PURGE") {
+    if (!client.ip ~ purge) { 
+      return (synth(405, "Not allowed")); 
+    }
+    return (purge);
+  }
+
+  # omijamy cache dla healthchecków / wewn. nagłówka
+  if (req.url == "/healthcheck" || req.http.X-Internal-Check) { 
+    return (pass); 
+  }
+
+  # metody inne niż GET/HEAD bez cache
+  if (req.method != "GET" && req.method != "HEAD") { 
+    return (pass); 
+  }
+
+  # static – agresywnie cache’ujemy
+  if (req.url ~ "^/static/" || req.url ~ "\.(css|js|png|jpg|svg|ico|woff2?)$") { 
+    return (hash); 
+  }
+
+  return (hash);
+}
+
+sub vcl_backend_response {
+  if (bereq.url ~ "^/static/" || bereq.url ~ "\.(css|js|png|jpg|svg|ico|woff2?)$") {
+    set beresp.ttl = 24h;
+  } else {
+    if (beresp.http.Cache-Control ~ "no-cache|no-store|private") {
+      set beresp.uncacheable = true;
+      set beresp.ttl = 0s;
+    } else {
+      set beresp.ttl = 60s;  # domyślny TTL dla HTML/API
+    }
+  }
+}
+
+sub vcl_deliver {
+  if (obj.hits > 0) {
+    set resp.http.X-Cache = "HIT";
+  } else {
+    set resp.http.X-Cache = "MISS";
+  }
+}