The front Varnish caches anonymous SPARQL queries on their body

The client POSTs every query (the SPARQL 1.1 Protocol's query via POST),
and varnish-frontend passed every POST, so each visitor's views reached
the platform even when the store's own Varnish already held the result:
there a hit is ~2 ms, through the platform ~0.3 s, and in a page's burst
1-4 s. A URL-keyed cache cannot tell two POSTs to /sparql apart, so the
body is cached (std.cache_req_body, up to 64 KB) and hashed into the key
(bodyaccess, which the varnish image ships).

Only reads, and only anonymous ones: application/sparql-query, or a form
with query= and no update=, to /sparql or /ns, without Client-Cert,
On-Behalf-Of or an id_token cookie - the same rule as the GET branch,
since an authenticated response carries the agent's identity. A miss is
fetched as the POST it was. Results are kept for an hour; any write that
passes through bans them all, as the end-user Varnish does for GETs, and
a cached query no longer bans /sparql as if it were a write.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: namedgraph

docker-compose.yml

@@ -488,6 +488,7 @@ configs:
       vcl 4.0;
 
       import std;
+      import bodyaccess;
 
       backend default {
           .host = "${VARNISH_FRONTEND_BACKEND_HOST:-linkeddatahub}";
@@ -535,6 +536,25 @@ configs:
               return (pipe);
           }
 
+          # Anonymous SPARQL queries are cached on their body. The platform's client POSTs every query (the
+          # SPARQL 1.1 Protocol's "query via POST"), and a URL-keyed cache cannot tell two of those apart, so
+          # without this every visitor's views reach the platform. Only reads are cached - a query body, never
+          # an update - and only anonymous ones, for the same reason the GET branch below passes authenticated
+          # requests: the response would carry the agent's identity. Bodies over 64 KB pass.
+          if (req.method == "POST" && req.url ~ "^/(sparql|ns)(\?|$)" &&
+            !req.http.Client-Cert && !req.http.On-Behalf-Of && req.http.Cookie !~ "LinkedDataHub\.id_token=" &&
+            (req.http.Content-Type ~ "^application/sparql-query" || req.http.Content-Type ~ "^application/x-www-form-urlencoded")) {
+              if (std.cache_req_body(64KB)) {
+                  if (req.http.Content-Type ~ "^application/sparql-query" ||
+                    (bodyaccess.rematch_req_body("(^|&)query=") == 1 && bodyaccess.rematch_req_body("(^|&)update=") == 0)) {
+                      set req.http.X-SPARQL-Query = "cache";
+                      unset req.http.Cookie;
+                      return (hash);
+                  }
+              }
+          }
+          unset req.http.X-SPARQL-Query;
+
           if (req.method != "GET" && req.method != "HEAD") {
               /* We only deal with GET and HEAD by default */
               return (pass);
@@ -576,7 +596,33 @@ configs:
           return (hash);
       }
 
+      sub vcl_hash {
+          # a cached query is keyed on its body as well as the URL (and, through Vary, the Accept header)
+          if (req.http.X-SPARQL-Query == "cache") {
+              bodyaccess.hash_req_body();
+          }
+      }
+
+      sub vcl_backend_fetch {
+          # a cache miss is fetched as a GET unless told otherwise; the query is the POST's body
+          if (bereq.http.X-SPARQL-Query == "cache") {
+              set bereq.method = "POST";
+          }
+      }
+
       sub vcl_backend_response {
+          if (bereq.http.X-SPARQL-Query == "cache") {
+              # an error is not kept; a result is kept for an hour at most, and dropped by any write (below)
+              if (beresp.status != 200) {
+                  set beresp.uncacheable = true;
+                  set beresp.ttl = 0s;
+              } else {
+                  set beresp.ttl = 1h;
+                  set beresp.http.X-SPARQL-Query = "cached";
+              }
+              return (deliver);
+          }
+
           /* Add Vary: Origin for static files to enable proper CORS caching */
           if (bereq.url ~ "^/static/") {
               if (beresp.http.Vary) {
@@ -590,6 +636,8 @@ configs:
           if ((beresp.status == 200 || beresp.status == 201 || beresp.status == 204) && bereq.method ~ "POST|PUT|DELETE|PATCH") {
               set beresp.http.X-LinkedDataHub = "Banned";
               ban("req.url == " + bereq.url + " && req.http.host == " + bereq.http.host);
+              # a write can change any query's result
+              ban("obj.http.X-SPARQL-Query == cached");
           }
 
           /* NS (ontology) SPARQL queries from authenticated clients are cache-busted per-request with _nc;
@@ -602,6 +650,10 @@ configs:
 
           return (deliver);
       }
+
+      sub vcl_deliver {
+          unset resp.http.X-SPARQL-Query;
+      }
   varnish-admin_vcl:
     content: |
       vcl 4.0;