11–20 of 27 posts
What's the deal with Antirez and PHK refusing to add TLS support?
I'm not "refusing to add TLS support" I insist that the certificate is safely isolated in a separate process for security reasons. There are many ways to skin that cat.
Earlier quoted context omitted.
Varnish Enterprise has https support.
the whole point of varnish software keeping a public version of "vinyl cache" as "varnish cache" with TLS is to give people a way to access a FOSS version with native TLS. I think TLS is table-stakes now, and has been for the last 10 years, at least.
TLS in -> hitch or caddy Cache -> varnish/vinyl TLS out -> haproxy
Connect them up with Unix sockets, if you like.
Earlier quoted context omitted.
the whole point of varnish software keeping a public version of "vinyl cache" as "varnish cache" with TLS is to give people a way to access a FOSS version with native TLS. I think TLS is table-stakes now, and has been for the last 10 years, at least.
just use the tool that does the job. TLS in -> hitch or caddy Cache -> varnish/vinyl TLS out -> haproxy Connect them up with Unix sockets, if you like.
I appreciate the mysql/mariadb comparison.
Earlier quoted context omitted.
the whole point of varnish software keeping a public version of "vinyl cache" as "varnish cache" with TLS is to give people a way to access a FOSS version with native TLS. I think TLS is table-stakes now, and has been for the last 10 years, at least.
just use the tool that does the job. TLS in -> hitch or caddy Cache -> varnish/vinyl TLS out -> haproxy Connect them up with Unix sockets, if you like.
Earlier quoted context omitted.
just use the tool that does the job. TLS in -> hitch or caddy Cache -> varnish/vinyl TLS out -> haproxy Connect them up with Unix sockets, if you like.
because the topic keeps coming up, I now wrote the tutorial which we should have had years ago: https://vinyl-cache.org/tutorials/tls_haproxy.html
It hasn't seen much action in a while, but maybe thats cos it works?
Earlier quoted context omitted.
because the topic keeps coming up, I now wrote the tutorial which we should have had years ago: https://vinyl-cache.org/tutorials/tls_haproxy.html
Thanks for this. You dont mention hitch though. Is that now deprecated/discouraged? It hasn't seen much action in a while, but maybe thats cos it works?
I would recommend migrating off within a year or two.
Earlier quoted context omitted.
Thanks for this. You dont mention hitch though. Is that now deprecated/discouraged? It hasn't seen much action in a while, but maybe thats cos it works?
fwiw; Varnish Software still maintains and supports hitch, but we can't say we see a bright future for it. Both the ergonomics and the performance of not being integrated into Varnish are pretty bad. It was the crutch we leaned as it was the best thing we could make available. I would recommend migrating off within a year or two.
The reason for hitch was that tls and caching are a different concern, and the current recommendation is to use haproxy, which also isnt integrated into varnish/vinyl.
But you say that the reason to migrate off hitch is that its not integrated?
But what happend to separation of concerns, then? Is the plan to integrate tls termination into vinyl? Is this a change of policy/outlook?
Thanks!
Earlier quoted context omitted.
Thanks for this. You dont mention hitch though. Is that now deprecated/discouraged? It hasn't seen much action in a while, but maybe thats cos it works?
fwiw; Varnish Software still maintains and supports hitch, but we can't say we see a bright future for it. Both the ergonomics and the performance of not being integrated into Varnish are pretty bad. It was the crutch we leaned as it was the best thing we could make available. I would recommend migrating off within a year or two.
Earlier quoted context omitted.
fwiw; Varnish Software still maintains and supports hitch, but we can't say we see a bright future for it. Both the ergonomics and the performance of not being integrated into Varnish are pretty bad. It was the crutch we leaned as it was the best thing we could make available. I would recommend migrating off within a year or two.
Thanks for the info, but I'm a bit confused, sorry. The reason for hitch was that tls and caching are a different concern, and the current recommendation is to use haproxy, which also isnt integrated into varnish/vinyl. But you say that the reason to migrate off hitch is that its not integrated? But what happend to separation of concerns, then? Is the plan to integrate tls termination into vinyl? Is this a change of…
Now that Varnish has been renamed, Varnish Software will keep what has been referred to as a downstream version or a fork, which has TLS built in, basically taking the TLS support from Varnish Enterprise.
This makes Hitch a moot point. So, I assume it'll receive security updates, but not much more.
Wrt. separation of concerns. Varnish with in-core TLS can push terabits per second (synthetic load, but still). Sure, for my blog, that isn't gonna matter, but having a single component to run/update is still valuable.
In particular using hitch/haproxy/nginx for backend is cumbersome.
TLS is a primary concern on the internet today.