Reworking varnish role pr devel 2.x

roles/debian/varnish_config/defaults/main.yml

@@ -17,3 +17,10 @@ varnish_config:
   upstream_proxies: []
   # Provide an alternative filename if you are providing a template.
   template_filename: default.vcl
+  # Varnish systemd overrides to make varnish consistent even after upgrades
+  varnish_pid: /run/varnishd.pid
+  limit_nofile: 131072
+  limit_memlock: 85983232
+  limit_core: infinity
+  tasks_max: infinity
+  varnish_storage: "malloc,{{ ansible_facts.memtotal_mb // 10 }}M"

roles/debian/varnish_config/tasks/main.yml

@@ -1,15 +1,24 @@
 ---
-- name: Copy Varnish default VCL.
-  ansible.builtin.template:
-    src: "{{ item }}"
-    dest: "{{ varnish_config_path }}/default.vcl"
-    owner: root
-    group: root
-    mode: 0644
-  with_first_found:
-    - "{{ playbook_dir }}/templates/{{ varnish_config.template_filename }}.j2"
-    - "{{ _ce_provision_base_dir }}/config/files/templates/{{ varnish_config.template_filename }}.j2"
-    - "default.vcl.j2"
-  notify:
-    - reload systemd # handlers in https://github.com/geerlingguy/ansible-role-varnish/blob/master/handlers/main.yml
-    - restart varnish
+- block:
+    - name: Copy Varnish default VCL.
+      ansible.builtin.template:
+        src: "{{ item }}"
+        dest: "{{ varnish_config_path }}/default.vcl"
+        owner: root
+        group: root
+        mode: 0644
+      with_first_found:
+        - "{{ playbook_dir }}/templates/{{ varnish_config.template_filename }}.j2"
+        - "{{ _ce_provision_base_dir }}/config/files/templates/{{ varnish_config.template_filename }}.j2"
+        - "default.vcl.j2"
+# This will keep varnish config as it is even after varnish upgrade
+    - name: Template varnish systemd service file
+      ansible.builtin.template:
+        src: varnish.service.j2
+        dest: /etc/systemd/system/varnish.service
+        mode: '0644'
+      notify:
+        - reload systemd
+        - restart varnish
+
+# TO DO: add varnish to unattended upgrades

roles/debian/varnish_config/templates/varnish.service.j2

@@ -0,0 +1,29 @@
+[Unit]
+Description=Varnish Cache, a high-performance HTTP accelerator
+After=network-online.target
+
+[Service]
+Type=forking
+KillMode=process
+
+PIDFile= {{ varnish_config.varnish_pid }}
+
+# Maximum number of open files (for ulimit -n)
+LimitNOFILE= {{ varnish_config.limit_nofile }}
+
+# Locked shared memory
+LimitMEMLOCK= {{ varnish_config.limit_memlock }}
+
+# Enable this to avoid "fork failed" on reload.
+TasksMax= {{ varnish_config.tasks_max }}
+
+# Maximum size of the corefile.
+LimitCORE= {{ varnish_config.limit_core }}
+
+ExecStart=/usr/sbin/varnishd -a :80 -T 127.0.0.1:6082 -P /run/varnishd.pid -f /etc/varnish/default.vcl -S /etc/varnish/secret -s {{ varnish_config.varnish_storage }}
+ExecReload=/usr/sbin/varnishreload
+
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target