41 votes

Ordering: 1. nginx 2. varnish 3. haproxy 4. webserver?

Foreword Update in 2016. Things are evolving, all servers are getting better, they all support SSL and the web is more amazing than ever. Unless stated, the following is targeted toward ...
user5994461's user avatar
  • 3,029
29 votes

Prevent port change on redirect in nginx

In my case, nginx listens to port 80 inside a docker container, but it's mapped to port 8080 (or any random port) outside the container. There is no reverse proxy in-between that can add proper ...
Luxian's user avatar
  • 431
17 votes
Accepted

varnish daemon not listening on configured port

You need to change the varnish start parameters in the systemd service definition as well. You could edit the line starting with ExecStart in the service defintion file: sudo vi /lib/systemd/system/...
Gerald Schneider's user avatar
15 votes
Accepted

Does it makes sense from a security perspective to remove the Server HTTP header?

RFC 7231 says about the Server header: An origin server MAY generate a Server field in its responses. MAY is interpreted as in RFC 2119: MAY This word, or the adjective "OPTIONAL", mean ...
Michael Hampton's user avatar
7 votes
Accepted

Possibility of rewriting response bodies in different webservers (nginx, apache, iis, etc.)

Ended up with this table: **Nginx**: ngx_http_sub_module --> http://p.defau.lt/?A6UukYFKZrYLalJ5KOuTKg **Nginx**: Nginx + lua. LUA body_filter --> http://p.defau.lt/?0ZxLWENoEkFIRD17QlEtbQ **...
Mindaugas Bernatavičius's user avatar
7 votes

varnish daemon not listening on configured port

Note that the drop-in should have an empty ExecStart= Otherwise you will get an error starting the service (duplicate ExecStart) sudo mkdir /etc/systemd/system/varnish.service.d sudo nano /etc/...
George's user avatar
  • 171
7 votes
Accepted

Does Varnish 5.0 support HTTP/2 for backend connections?

@Michael Hampton's answer is missing some points so here it goes: Varnish is the one software that does HTTP/2 in Hitch+Varnish combo, but most of the browsers requires TLS connection in order for ...
Danila Vershinin's user avatar
6 votes

Best practice for proxying package repositories

We use Squid for this; the nice thing about squid is that you can set individual expiry of objects based on a pattern match, fairly easily, which allows the metadata from the yum repo to be purged ...
Andrew's user avatar
  • 504
5 votes

Varnish VCL - Regular Expression Evaluation

There is a trick! Change the condition if(!req.http.Cookie ~ req.http.regex) to: if(!req.http.Cookie ~ {"" + req.http.regex + ""}) This switches it to a CSTR.
William N Bell's user avatar
5 votes

Varnish ACLs Behind Load Balancer Based on Client's IP

This can be done using std.ip, assuming ClientIP header is already set in vcl_recv(). For example: vcl 4.0; import std; acl admin_net { "10.10.1.160/27"; } sub vcl_deliver { if (std.ip(req.http....
Andrei's user avatar
  • 124
5 votes

Does Varnish require much RAM?

Varnish actually supports multiple storage backends. You can cache something to RAM, whereas something to disk: -s default=malloc,256m \ -s static=file,/var/lib/varnish/varnish_storage.bin,1G" This ...
Danila Vershinin's user avatar
5 votes

Best practice for proxying package repositories

That's a definitive use case for a proxy. A normal proxy, not a reverse-proxy (aka. load balancers). The most well-known and free and open-source is squid. Luckily it's one of the few good open-...
user5994461's user avatar
  • 3,029
4 votes

Best practice for proxying package repositories

This won't solve all your tasks, but maybe this is still helpful. Despite the name, apt-cacher-ng doesn't only work with Debian and derivatives, and is a caching proxy. Specialized for package ...
gxx's user avatar
  • 5,651
4 votes
Accepted

Google Ads and Varnish

The ads will not be cached, because Google ads are Javascript based. (the actual ads are pulled by Javascript code into your page dynamically, irrespective of Varnish cache).
Danila Vershinin's user avatar
4 votes

Redirect HTTP to HTTPS using Varnish 4.1

The below works: sub vcl_recv { if (client.ip != "127.0.0.1" && req.http.host ~ "example.com") { set req.http.x-redir = "https://example.com" + req.url; return(synth(850, "")...
greentealeaf's user avatar
4 votes

varnish redirect to home web dir

You need to remove first level of URL and pass requests to respective backend by using set req.backend_hint instead of set req.backend, like so: backend default { .host = "127.0.0.1"; .port = ...
Danila Vershinin's user avatar
4 votes

Does it makes sense from a security perspective to remove the Server HTTP header?

The Server HTTP header only serves one purpose - identification. It is not required anywhere for running your website properly, and by removing it, nothing is going to break. It reveals the internal ...
Danila Vershinin's user avatar
4 votes
Accepted

Allow location in NGINX based on IP - request comes from Varnish

By default Varnish 4 would set X-Forwarded-For header as the client's real IP, but NGINX would ignore that unless you set it up explicitly. Add these lines to your nginx configuration in the server ...
Victor Wong's user avatar
4 votes

Does Varnish 5.0 support HTTP/2 for backend connections?

Varnish doesn't support https at all. It never has and it never will. The so-called http2 frontend support that Varnish offers in 5.0 is actually not in Varnish at all. Rather, it uses another piece ...
Michael Hampton's user avatar
4 votes
Accepted

Unable to open Port 8080 for Varnish to access Nginx

The listen mydomain.co.in:8080; directive in your Nginx config is probably the issue. Nginx will only listen on the network interface for the IP that is resolved by the domain. I'm well aware that the ...
Thijs Feryn's user avatar
  • 1,226
3 votes

Running Varnish on Windows 7

Install varnish and cygrunsrv with cygwin Use cygrunsrv to install service by cygwin Specify command line arguments for varnishd.exe Uncommon, but important for use with cygrunsrv: -F do not fork: ...
Matthias M's user avatar
3 votes

where can i find varnish log files? /var/log/varnish is empty

We could use varnishlog too, a better remembered name compared with varnishncsa. We need run it with root privilege - sudo varnishlog, otherwise somethime it will said VSM: Could not get hold of ...
Key Shang's user avatar
  • 131
3 votes

How to hash based on host + path in Varnish?

It doesn't look like the default VCL-provided req object provides a way to get the request path, without query parameters, just the full URL. Thus using some VMODs might help. You might try using ...
Castaglia's user avatar
  • 3,379
3 votes

Is it possible to return a JSON response by varnish if backend is down?

How about this: sub vcl_backend_error { set beresp.http.Content-Type = "application/json; charset=utf-8"; synthetic( {"{ "msg" :{ "status": 2 } }"} ); return (deliver); }
Danila Vershinin's user avatar
3 votes

nginx redirect without port

Try to add absolute_redirect off to your location block location = /url1 { absolute_redirect off; return 301 /url2; }
foal's user avatar
  • 131
3 votes

Running VCC-compiler failed

You have a syntax error in your configuration file. You need to fix that. Expected '.' got 'sub' program line 98), at ('input' Line 11 Pos 1) means that the error is in line 11 of the configuration ...
HBruijn's user avatar
  • 80.3k
3 votes
Accepted

Varnish unsetting all except last x-forwarded-for IP address... bug?

So the work-around for this (possible bug in 4.1.3-1.el7.x86_64) was a clue I found while browsing other varnish logging questions, specifically one on disabling the x-forwarded-for header altogether. ...
dcmbrown's user avatar
  • 315
3 votes
Accepted

Caching setup for my webserver (varnish, bcache)

I think there is no benefit in using Varnish or any other cache utility if you are serving files from the filesystem without any additional processing. You could add the SSD drive as L2ARC in your ZFS ...
Tero Kilkanen's user avatar
3 votes

how can I read old varnish logs?

The error you see is due to lack of privileges. Try: sudo varnishlog -N <file.vsm> -d
Francisco J. Velázquez-G.'s user avatar
3 votes

Nginx tries to run on port 80 but the configs have been removed

Check that all the Server blocks have listen directives, otherwise nginx will default to 80 for that block.
Joris's user avatar
  • 5,979

Only top scored, non community-wiki answers of a minimum length are eligible