Basic Varnish config for WP with CloudFront

customexec.conf

# /etc/systemd/system/varnish.service.d/customexec.conf

[Service]
ExecStart=
ExecStart=/usr/sbin/varnishd -a :80 -T localhost:6082 -f /etc/varnish/default.vcl -s default,64m

default.vcl

vcl 4.1;

backend default {
    .host = "127.0.0.1";
    .port = "8080";
}

acl purge {
  "127.0.0.1";
  "localhost";
}

sub vcl_recv {

  if (req.method == "PURGE") {
    if (!client.ip ~ purge) {
      return (synth(405, "Not allowed."));
    }

    ban("req.http.host ~ .*");
    return (synth(200, "Full cache cleared"));
  }

  if (req.http.Cache-Control ~ "no-cache") {
    return (pass);
  }

  if (req.method != "GET" && req.method != "HEAD" && req.method != "OPTIONS" ) {
    return (pipe);
  }

  if ( req.http.cookie ~ "wordpress_logged_in") {
    return (pass);
  }

  if (req.url ~ "/wp-") {
    return (pass);
  }

  # cache
  unset req.http.cookie;

  return (hash);

}

sub vcl_backend_response {

  if (bereq.url !~ "/wp-" && bereq.http.cookie !~ "wordpress_logged_in") {
    unset beresp.http.cache-control;
    unset beresp.http.Set-Cookie;
    unset beresp.http.expires;

    set beresp.ttl = 1h;
  }

}

sub vcl_deliver {

  if (obj.hits > 0) {
    set resp.http.X-Varnish-Cache = "HIT";
    set resp.http.X-Varnish-Cache-Hits = obj.hits;
  }
  else {
    set resp.http.X-Varnish-Cache = "MISS";
  }

}