nginx + php-fpm + varnish + ssl

Question

I have a social networking site and because of that we want to run ssl all the time. does this defeat the purpose of using any type of cache system for even static content since everything will be ssl?

Could nginx be used to still cache even if it is ssl?

Right now I have nginx in front of apache but all it does is send dynamic requests to apache over port 80

edit: basically what i am trying to do is find the best way to take a lot of requests as we are getting a lot of traffic and want to ensure we keep performance going.

Answer 1

Given that a social networking site is such a personalized experience, I can't imagine Varnish will be any help at all.

SSL is going to be your major bottleneck as it will consume CPU. You could get round it with less complex/weaker ciphers - but then this poses a security risk in itself. Alternatively, you could use a dedicated hardware device for SSL termination/decryption.

In general, scaling up is a process of looking at what resources you are becoming scarce of and improving them as you going along. Monitoring everything with Munin will give you a good head start into this - and give you valuable feedback through graphs

Answer 2

I don't think adding SSL on top beats the purpose of caching.

What you do 'behind the scenes' may still be HTTP, even though all you transmit outside your network is encrypted. One way to achieve this is by simply adding SSL-termination in front of your existing stack, which proxies your current solution - including cache layers.

It's a bit difficult to be precise without having more insight on your setup, but that's the gist of it.

Answer 3

You can still cache static pages, images, css, etc with ssl. But it depends where you want to do the caching. The client can cache all those types of files if you configure everything regardless of the connection type (OK, some old versions of IE had problems and users can still disable it). If your backend servers are http and only the front servers (or loadbalancers) are speaking https then the frontends can also cache the static files.