Add Frontend Caching to Foundation

[tomusher]

There is currently no cache solution in front of the Foundation and Donate sites. Investigate and implement Cloudflare for this.

• Cache static assets as well as HTML
• Implement cache bypass for session/csrf cookies
• Validate all elements of site work with HTML cached
• Optimise cacheability by removing csrftokens from forms that don't need them
• Enable Wagtail cache invalidation

Use Cloudflare Pro plan so we get the WAF.

[tomusher]

Related https://github.com/MozillaFoundation/mofo-devops/issues/776

[tomusher]

With @benhohner to create Cloudflare account.

[benhohner]

Ben to set up cloudflare Business account

[benhohner]

Working with CloudFlare support

[benhohner]

Implementation blocked by this issue Tom brought up:

I'm looking in to full caching for the foundation site - the biggest problem I'm seeing here is that we set a CSRF token on every page (in a meta tag) - that means every request wants to set a CSRF cookie, which has to be unique to each user. Are we able to:

• Review what is using this token to determine if it's needed (i.e. is CSRF protection worth it on that request/form)
• Limit the scope of pages that set the CSRF token cookie, so we can explicitly exclude them from caching?

[Pomax]

We needed CSRF for PNI product voting, but the only route we have that's protected by @csrf_protect is the old product voting route, to my knowledge. @KalobTaulien does wagtail automatically add CSRF protection for serve handing? (the POST route for voting on new PNI does not have explciit CSRF as far as I can tell)

[KalobTaulien]

@Pomax I don't recall off the top of my head, but my gut says no since we can check for if request.POST in the serve() method directly using any type of POST request without a CSRF token. But let me double check that before I give bad advice