The following snippet from wikimedia-frontend.vcl can be moved to HAProxy excluding PURGE method:
// To pass this check, the method must be in allowed_methods (even OPTIONS must be there to be supported),
// Additionally, if OPTIONS is allowed, it must be accompanied by Origin:
if (req.method !~ "<%= @vcl_config.fetch("allowed_methods", "^(GET|HEAD|POST|OPTIONS|PURGE)$") %>"
|| (req.method == "OPTIONS" && !req.http.Origin)) {
return (synth(405, "Method not allowed"));
}take into account that we set a different list of allowed methods per cluster:
hieradata/role/common/cache/text.yaml: allowed_methods: '^(GET|HEAD|OPTIONS|PATCH|POST|PURGE|PUT|DELETE)$' hieradata/role/common/cache/upload.yaml: allowed_methods: '^(GET|HEAD|OPTIONS|PURGE)$'
Change #1136998 had a related patch set uploaded (by Fabfur; author: Fabfur):
[operations/puppet@production] cache: copy allowed methods check to haproxy
Change #1136998 merged by Fabfur:
[operations/puppet@production] cache,haproxy: allowed methods check and set response headers
Change #1143755 had a related patch set uploaded (by Fabfur; author: Fabfur):
[operations/puppet@production] cache: remove unused allowed_methods check from varnish
Change #1143755 merged by Fabfur:
[operations/puppet@production] cache: remove unused allowed_methods check from varnish
Mentioned in SAL (#wikimedia-releng) [2025-08-31T23:09:31Z] <Krinkle> Remove unused allowed_methods Hiera key from deployment-cache-text and deployment-cache-upload in Horizon, ref T392073
Change #1183274 had a related patch set uploaded (by Krinkle; author: Krinkle):
[operations/puppet@production] varnish: remove unused allowed_methods /hieradata/role/common/cache/text.yaml