Do not provide private files from Varnish

templates/haproxy_cfg.jinja2

@@ -162,7 +162,8 @@ frontend http_in
   acl domain_ignores_varnish hdr(host) -i -n -f /etc/haproxy/ignore_varnish.list
   use_backend backend_varnish_bigpipe if domain_uses_bigpipe !domain_ignores_varnish
   acl static_content path_end .jpg .jpeg .gif .png .ico .swf .css .js .htm .html
-  use_backend backend_varnish if static_content !domain_ignores_varnish
+  acl static_content_private path_beg /system/
+  use_backend backend_varnish if static_content !static_content_private !domain_ignores_varnish
 {% endif %}
 {% if 'webserver' in groups %}
 {% for host in groups['webserver']|sort %}
@@ -289,7 +290,8 @@ frontend https_in_{{ cert.ip }}
   acl domain_ignores_varnish hdr(host) -i -n -f /etc/haproxy/ignore_varnish.list
   use_backend backend_varnish_bigpipe if domain_uses_bigpipe !domain_ignores_varnish
   acl static_content path_end .jpg .jpeg .gif .png .ico .swf .css .js .htm .html
-  use_backend backend_varnish if static_content !domain_ignores_varnish
+  acl static_content_private path_beg /system/
+  use_backend backend_varnish if static_content !static_content_private !domain_ignores_varnish
 {% endif %}
 {% if 'webserver' in groups %}
 {% for host in groups['webserver']|sort %}