From dridi at varni.sh Wed Sep 11 06:36:13 2024 From: dridi at varni.sh (Dridi Boukelmoune) Date: Wed, 11 Sep 2024 06:36:13 +0000 Subject: When to use Varnish in front or behind NGinx In-Reply-To: References: Message-ID: On Fri, Aug 30, 2024 at 1:59?PM Lee Daniel wrote: > > Hey Guys, > > So happy to find this mailing list. > I am 2-3 weeks into using Varnish Cache for the first time. > > I am on a Plesk Webserver with multiple domains (Mainly Drupal sites) running Centos. > Plesk has an Nginx:80 -> Apache:7080 setup. > > Following Varnish documentation for 4.1.11, which is the latest version compatible with Drupal: > > Changed Nginx port from 80 to 8080. > Changed Varnish default port from 6081 to 80. > Changed my default backend to point back to Nginx on port 8080. > So now I have, Varnish -> Nginx -> Apache > > I do some test with Curl -I and get some hits. > > Connected to my Drupal sites successfully. > > However, doing some research I found out that Nginx does not support ssl/tls natively. > > Therefore, if ssl/tls termination needed, Varnish would have to be placed behind NGinx. > > e.g Nginx:80 -> Varnish:6080 -> Apache:7080 > > My job was to install Varnish on our servers to be used on specific sites for Caching purposes. > > I've read that Varnish first if you mainly want Caching and the full power of Varnish or Varnish behind Nginx if you want ssl termination and reduced power of Varnish Caching. > > > Can someone please weigh in on this? > Weigh in heavy if you must ?? Hi Lee, I'm wondering why you need an Apache (I assume httpd) server in the first place, my understanding is that there is a good deal of overlap with nginx in terms of features. If you want varnish to be your caching layer, then it should probably be behind nginx with no caching in nginx itself. If you do introduce varnish, then you will likely need something behind it to speak FastCGI with your PHP application. It can be httpd, or you could loop back to nginx. So the second suggestion is probably your safest bet: nginx:443 -> varnish:6081 -> httpd:7080 Dridi From admin at beckspaced.com Wed Sep 11 07:15:44 2024 From: admin at beckspaced.com (Admin Beckspaced) Date: Wed, 11 Sep 2024 09:15:44 +0200 Subject: When to use Varnish in front or behind NGinx In-Reply-To: References: Message-ID: <64cc20c4-d0c0-4f48-a46c-78c6a53b066a@beckspaced.com> Am 11.09.2024 um 08:36 schrieb Dridi Boukelmoune: > On Fri, Aug 30, 2024 at 1:59?PM Lee Daniel wrote: >> Hey Guys, >> >> So happy to find this mailing list. >> I am 2-3 weeks into using Varnish Cache for the first time. >> >> I am on a Plesk Webserver with multiple domains (Mainly Drupal sites) running Centos. >> Plesk has an Nginx:80 -> Apache:7080 setup. >> >> Following Varnish documentation for 4.1.11, which is the latest version compatible with Drupal: >> >> Changed Nginx port from 80 to 8080. >> Changed Varnish default port from 6081 to 80. >> Changed my default backend to point back to Nginx on port 8080. >> So now I have, Varnish -> Nginx -> Apache >> >> I do some test with Curl -I and get some hits. >> >> Connected to my Drupal sites successfully. >> >> However, doing some research I found out that Nginx does not support ssl/tls natively. >> >> Therefore, if ssl/tls termination needed, Varnish would have to be placed behind NGinx. >> >> e.g Nginx:80 -> Varnish:6080 -> Apache:7080 >> >> My job was to install Varnish on our servers to be used on specific sites for Caching purposes. >> >> I've read that Varnish first if you mainly want Caching and the full power of Varnish or Varnish behind Nginx if you want ssl termination and reduced power of Varnish Caching. >> >> >> Can someone please weigh in on this? >> Weigh in heavy if you must ?? > Hi Lee, > > I'm wondering why you need an Apache (I assume httpd) server in the > first place, my understanding is that there is a good deal of overlap > with nginx in terms of features. If you want varnish to be your > caching layer, then it should probably be behind nginx with no caching > in nginx itself. If you do introduce varnish, then you will likely > need something behind it to speak FastCGI with your PHP application. > It can be httpd, or you could loop back to nginx. > > So the second suggestion is probably your safest bet: > > nginx:443 -> varnish:6081 -> httpd:7080 > > > Dridi Hello there, why not use hitch as TLS/SSL terminator? https://github.com/varnish/hitch my setup is hitch:443 -> varnish -> apache Becki From dridi at varni.sh Thu Sep 12 15:16:22 2024 From: dridi at varni.sh (Dridi Boukelmoune) Date: Thu, 12 Sep 2024 15:16:22 +0000 Subject: When to use Varnish in front or behind NGinx In-Reply-To: <64cc20c4-d0c0-4f48-a46c-78c6a53b066a@beckspaced.com> References: <64cc20c4-d0c0-4f48-a46c-78c6a53b066a@beckspaced.com> Message-ID: > Hello there, > > why not use hitch as TLS/SSL terminator? > > https://github.com/varnish/hitch > > my setup is hitch:443 -> varnish -> apache It depends on what other services nginx may provide besides TLS terminaison. If the answer is "none that could not be implemented with Varnish" then hitch could also be a good fit, but the systems administrators managing those services may for some reason need to stick to nginx so I didn't bother bringing it up. Dridi From c23bd2a004-service at shee.org Thu Sep 12 16:05:59 2024 From: c23bd2a004-service at shee.org (c23bd2a004-service at shee.org) Date: Thu, 12 Sep 2024 18:05:59 +0200 Subject: When to use Varnish in front or behind NGinx In-Reply-To: References: <64cc20c4-d0c0-4f48-a46c-78c6a53b066a@beckspaced.com> Message-ID: Am Donnerstag, dem 12.09.2024 um 15:16 +0000 schrieb Dridi Boukelmoune: > > Hello there, > > > > why not use hitch as TLS/SSL terminator? > > > > https://github.com/varnish/hitch > > > > my setup is hitch:443 -> varnish -> apache > > It depends on what other services nginx may provide besides TLS > terminaison. If the answer is "none that could not be implemented > with > Varnish" then hitch could also be a good fit, but the systems > administrators managing those services may for some reason need to > stick to nginx so I didn't bother bringing it up. Is the hitch project still active? Some issues do not get any response and the code was not touched for some time ... From peter at mapledesign.co.uk Sat Sep 14 20:32:31 2024 From: peter at mapledesign.co.uk (Peter Bowyer) Date: Sat, 14 Sep 2024 21:32:31 +0100 Subject: xKey Maintenance Mode: what does this mean long-term? Message-ID: Hi, I'm one of the small-time Varnish users. Nothing I do is high traffic, but I use Varnish because it gives users a faster experience, lets me use cheap servers, and because it's a pleasure to use. xKey is a feature I use because it lets me easily flush dynamic HTML pages from the cache, for the whole site or for sections of it. xKey is now in maintenance mode [1]. It's great that it is still maintained. But it does give me concern about the future. Will Varnish (the corporation) open-source yKey? Is there an alternative planned in Varnish (the open source project)? Two tangents. 1. Drupal went their own way instead of using xKey and use a BAN with a regex (a regex which has been wrong until recently [2]). Can anyone estimate how much less performant this is than xKey? 2. The maintenance mode notice points us at yKey. I'd like to use the VMODs from Varnish (the corporation) for their DX and have offered them money multiple times, but their starting price for a license is usually more than the entire annual cost for the digital infrastructure of projects I work on. If anyone from the corporation is reading, t's a shame there's no SME licensing. Peter 1. https://github.com/varnish/varnish-modules/pull/226/files 2. https://www.drupal.org/project/varnish_purge/issues/3293641 -- Maple Design Ltd http://www.mapledesign.co.uk +44 (0)330 122 0034 Reg. in England no. 05920531 Prices exclude VAT where applicable -------------- next part -------------- An HTML attachment was scrubbed... URL: From hermunn at varnish-software.com Tue Sep 17 11:20:19 2024 From: hermunn at varnish-software.com (=?UTF-8?Q?P=C3=A5l_Hermunn_Johansen?=) Date: Tue, 17 Sep 2024 13:20:19 +0200 Subject: xKey Maintenance Mode: what does this mean long-term? In-Reply-To: References: Message-ID: Hello Peter, The xkey VMOD is indeed very useful, and it will continue working on upcoming versions of Varnish Cache. The status as maintenance mode is all about us (Varnish Software, the company) disclosing the fact that xkey will not gain new features. When it comes to your observations about Varnish Enterprise, yKey and pricing, we see your pain, and are working on improving in this area. Best, P?l l?r. 14. sep. 2024 kl. 22:34 skrev Peter Bowyer : > Hi, > > I'm one of the small-time Varnish users. Nothing I do is high traffic, but > I use Varnish because it gives users a faster experience, lets me use cheap > servers, and because it's a pleasure to use. > > xKey is a feature I use because it lets me easily flush dynamic HTML pages > from the cache, for the whole site or for sections of it. > > xKey is now in maintenance mode [1]. It's great that it is still > maintained. But it does give me concern about the future. Will Varnish (the > corporation) open-source yKey? Is there an alternative planned in Varnish > (the open source project)? > > > Two tangents. > 1. Drupal went their own way instead of using xKey and use a BAN with a > regex (a regex which has been wrong until recently [2]). Can anyone > estimate how much less performant this is than xKey? > > 2. The maintenance mode notice points us at yKey. I'd like to use the > VMODs from Varnish (the corporation) for their DX and have offered them > money multiple times, but their starting price for a license is usually > more than the entire annual cost for the digital infrastructure of projects > I work on. If anyone from the corporation is reading, t's a shame there's > no SME licensing. > > Peter > > 1. https://github.com/varnish/varnish-modules/pull/226/files > 2. https://www.drupal.org/project/varnish_purge/issues/3293641 > > -- > Maple Design Ltd > http://www.mapledesign.co.uk > +44 (0)330 122 0034 > > Reg. in England no. 05920531 > Prices exclude VAT where applicable > _______________________________________________ > varnish-misc mailing list > varnish-misc at varnish-cache.org > https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc > -------------- next part -------------- An HTML attachment was scrubbed... URL: From dridi at varni.sh Wed Sep 18 12:32:18 2024 From: dridi at varni.sh (Dridi Boukelmoune) Date: Wed, 18 Sep 2024 12:32:18 +0000 Subject: xKey Maintenance Mode: what does this mean long-term? In-Reply-To: References: Message-ID: > Two tangents. > 1. Drupal went their own way instead of using xKey and use a BAN with a regex (a regex which has been wrong until recently [2]). Can anyone estimate how much less performant this is than xKey? I expect a ban with many tags to perform poorly compared to vmod_xkey, generating a regular expression with a lot of back-tracking and executed on numerous occasions (roughly up to the number of objects before the ban was inserted) instead of just once. However, it should already be possible to take the space-delimited Cache-Tags header with vmod_xkey. Just create a copy of the header with the right name (beresp.http.xkey). Dridi From lee at caribbeannewmedia.com Sun Sep 22 07:49:18 2024 From: lee at caribbeannewmedia.com (Lee Daniel) Date: Sun, 22 Sep 2024 03:49:18 -0400 Subject: Too many redirects Message-ID: Hey Guys, My earlier question was "When to use Varnish in front or behind NGinx." Thanks much for the responses and advise. I actually prefer it the way that was suggested nginx:443-> varnish:6081 -> httpd:7080. That way, in plesk, I can configure nginx per site. The issue I am having now is when I set it up that way I get too many redirects. Through Varnishstat, I can see the hits being made but the webpage won't load. I have uploaded my configuration on github to reduce the text and ease to read. If anyone has the patience can you tell me what needs to be adjusted. I will upload my .htaccess, nginx.conf, httpd.conf and default.vlc. Repo here . I hope I did not do a terrible Job redacting. As of now my backend health is 5/5. The default.vlc I found online, claim to be well tailored for Drupal sites. Made little tweaks. I will appreciate any help. Regards, Lee -------------- next part -------------- An HTML attachment was scrubbed... URL: From peter at mapledesign.co.uk Mon Sep 23 06:47:21 2024 From: peter at mapledesign.co.uk (Peter Bowyer) Date: Mon, 23 Sep 2024 07:47:21 +0100 Subject: Too many redirects In-Reply-To: References: Message-ID: Hi Lee, This bit in your Apache config looks wrong: https://github.com/cnm-Git/Varnish-Default-VCL-Rules/blob/dfc45d79caca4bc05d778ba21e15b1d1ad0892d4/httpd.conf#L102-L114 When a request comes in for https://..com it gets redirected to... https://..com. Cue endless loop. Add rewrite:trace3 (or higher) to your LogLevel to get what's happening in the RewriteRules logged. Peter On Sun, 22 Sept 2024 at 08:49, Lee Daniel wrote: > Hey Guys, > > My earlier question was "When to use Varnish in front or behind NGinx." > > Thanks much for the responses and advise. > > I actually prefer it the way that was suggested nginx:443 -> varnish:6081 > -> httpd:7080. > That way, in plesk, I can configure nginx per site. The issue I am having > now is when I set it up that way I get too many redirects. Through > Varnishstat, I can see the hits being made but the webpage won't load. I > have uploaded my configuration on github to reduce the text and ease to > read. If anyone has the patience can you tell me what needs to be adjusted. > I will upload my .htaccess, nginx.conf, httpd.conf and default.vlc. > Repo here . I hope > I did not do a terrible Job redacting. > As of now my backend health is 5/5. The default.vlc I found online, claim > to be well tailored for Drupal sites. Made little tweaks. I will appreciate > any help. Regards, Lee > _______________________________________________ > varnish-misc mailing list > varnish-misc at varnish-cache.org > https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc > -- Maple Design Ltd http://www.mapledesign.co.uk +44 (0)330 122 0034 Reg. in England no. 05920531 Prices exclude VAT where applicable -------------- next part -------------- An HTML attachment was scrubbed... URL: From lee at caribbeannewmedia.com Fri Sep 27 05:19:49 2024 From: lee at caribbeannewmedia.com (Lee Daniel) Date: Fri, 27 Sep 2024 01:19:49 -0400 Subject: Too many redirects In-Reply-To: References: Message-ID: Hey Peter, Thanks so much for the helpful response. I'm only now seeing the response, I needed this weeks ago. It went to my spam ???? Anyways, I added the rewrite:trace3 to the LogLevel and some Apache errors did appear indeed. ? Error??? [rewrite:trace2] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] init rewrite engine with requested uri /??? ??? ??? ??? Apache error ?? Error??????? ??? [rewrite:trace3] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] applying pattern '^(.*)$' to uri '/'??? ??? ??? ??? Apache error ??? Error??????? ??? [rewrite:trace3] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] applying pattern '^(.*)$' to uri '/'??? ??? ??? ??? Apache error ??? Error?????? ??? [rewrite:trace3] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] applying pattern '^(.*)$' to uri '/'??? ??? ??? ??? Apache error ??? Error??????? ??? [rewrite:trace3] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] applying pattern '^(.*)$' to uri '/'??? ??? ??? ??? Apache error ??? Error??????? ??? [rewrite:trace3] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] applying pattern '^' to uri '/'??? ??? ??? ??? Apache error ??? Error??????? ??? [rewrite:trace2] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] rewrite '/' -> 'https://..com/' Apache error ?? Error??????? ??? [rewrite:trace2] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] explicitly forcing redirect with https://..com/ Apache error ??? Error??????? ??? [rewrite:trace2] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] setting lastsub to rule with output https://%{HTTP_HOST}%{REQUEST_URI}??? ??? ??? ??? Apache error ??? Error??????? ??? [rewrite:trace1] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] escaping https://..com/ for redirect??? ????Apache error ??? Error??????? ??? [rewrite:trace1] mod_rewrite.c(490): 127.0.0.1 - - [..com/sid#5583ddf8eb88][rid#7efbfc16ff50/initial] redirect to https://..com/ [REDIRECT/301] Does this confirm what was highlighted in the github repo as the issue? May I ask what would you suggest? Thanks, Lee Daniel On 9/23/24 02:47, Peter Bowyer wrote: > Hi Lee, > > This bit in your Apache config looks wrong: > https://github.com/cnm-Git/Varnish-Default-VCL-Rules/blob/dfc45d79caca4bc05d778ba21e15b1d1ad0892d4/httpd.conf#L102-L114 > > When a request comes in for https://..com it gets > redirected to... https://..com. Cue endless loop. > > Add rewrite:trace3 (or higher) to your LogLevel to get what's > happening in the RewriteRules logged. > > Peter > > On Sun, 22 Sept 2024 at 08:49, Lee Daniel > wrote: > > Hey Guys, > > My earlier question was "When to use Varnish in front or behind > NGinx." > > Thanks much for the responses and advise. > > I actually prefer it the way that was suggested nginx:443-> > varnish:6081 -> httpd:7080. > That way, in plesk, I can configure nginx per site. The issue I am > having now is when I set it up that way I get too many redirects. > Through Varnishstat, I can see the hits being made but the webpage > won't load. I have uploaded my configuration on github to reduce > the text and ease to read. If anyone has the patience can you tell > me what needs to be adjusted. I will upload my .htaccess, > nginx.conf, httpd.conf and default.vlc. > Repo here . > I hope I did not do a terrible Job redacting. > As of now my backend health is 5/5. The default.vlc I found > online, claim to be well tailored for Drupal sites. Made little > tweaks. I will appreciate any help. Regards, Lee > _______________________________________________ > varnish-misc mailing list > varnish-misc at varnish-cache.org > https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc > > > > -- > Maple Design Ltd > http://www.mapledesign.co.uk > +44 (0)330 122 0034 > > Reg. in England no. 05920531 > Prices exclude VAT where applicable -- -------------- next part -------------- An HTML attachment was scrubbed... URL: