I have a public website with some URLs/directories which are for private/internal use only. These private areas can only be accessed via certain IP addresses or with a known username/password.
Currently I achieve this via .htaccess files like this:
AuthType Basic
AuthName "Protected Area"
AuthUserFile /path/to/.htpasswd
SetEnvIf Remote_Addr 1.2.3.4 trusted
SetEnvIf X-Forwarded-For 1.2.3.4 trusted
# (Note I am aware X-Forwarded-For can be spoofed)
<RequireAny>
Require env trusted
Require valid-user
</RequireAny>
The problem is I want to add Varnish in front of my server to provide caching. Obviously the existing setup won't work with Varnish because it can't cache content restricted by .htaccess files in this way.
Is there a way I can continue to use my .htaccess files to protect my internal pages, or is there a similar approach I can use to place the responsibility for security on Varnish itself which doesn't require changing Varnish's VCL files every time I want to add or modify the restrictions?