Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in the process of doing my homework for a move from apache w/o caching to nginx with caching, possibly via varnish...

After reading various blogs, articles, serverfault questions, etc. I understand that varnish cannot work with ssl, and that varnish might be better than nginx for actual caching of dynamic content. But I'm a little stuck in understanding how nginx caching works AND how nginx+varnish can play together when ssl is required.

How would the following be implemented, with nginx+varnish OR just nginx with caching?

  1. some urls driven by a custom php engine: i.e. is served by

  2. some urls are driven by wordpress: i.e. is handled by wordpress via

  3. should force ssl everywhere: i.e.* redirects to*

  4. www should redirect to top domain: i.e.* redirects to*

All of which serving the cached version if it exists (if I understand- caching is time based, so if I make an update to that page, I need to call PURGE if the varnish route and manually delete files if the nginx route)

share|improve this question
up vote 3 down vote accepted

If you want to use nginx and Varnish I would suggest something like this.

  • nginx as the frontend and SSL terminator, configured with Varnish as backend. This will also normalize (rewrite) hostnames from e.g. to
  • Varnish for caching content from its backend, nginx
  • nginx with virtualhosts running on e.g. port 8080 with all "application logic" like WordPress-rewrites, custom PHP-engine rewrites and such.

So basically you would have a stack like this:

nginx -> Varnish -> nginx -> php-fpm

The four bullet points you mention would then be solved like this.

  1. Backend-nginx with rewrites and proxy_pass to php-fpm.
  2. Backend-nginx with WordPress-related rewrites.
  3. Frontend-nginx with simple virtualhosts for redirections.
  4. Same as 3.
share|improve this answer
Thanks - so nginx frontend would be on public 80 and 443 (80 for forcing ssl), Varnish would be on localhost 80, and backend nginx would be on 8080? If that's right- will SSL certification break going from 80(nginx)->443(nginx)->80(varnish)->8080(nginx)? – davidkomer Sep 4 '12 at 12:01
Yeah, you are quite correct, but I would not run Varnish on port 80 localhost even though the port might be available. It will be confusing, so I suggest you just use the default Varnish port instead; 6081 – pkhamre Sep 4 '12 at 12:03
And about SSL certificate break; Nope, not if set up correctly. It will be HTTPS between client and server, but from the nginx-frontend to varnish and from varnish to nginx-backend it will be plain HTTP, don't use HTTPS in proxy unless you have to. – pkhamre Sep 4 '12 at 12:05
Thanks! Would you recommend this as opposed to keeping it all in nginx? I don't need ESI – davidkomer Sep 4 '12 at 13:34
Yes, definitely. But that is because I have lots of experience with Varnish for caching. I am not sure about nginx and caching, but I know Varnish is able to do pretty advanced caching. And it's very good at it! – pkhamre Sep 4 '12 at 13:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.