Varnish Cache 5.0 • Hacker News Board

Re: Varnish Cache 5.0

#51

Post by lkarsten » Thu, Sep 15, 2016, 10:41 PM UTC

jamwt wrote: post #48

ruben_varnish wrote: post #11

Earlier quoted context omitted.

Yes, Varnish does h2c so for HTTPS you will need something like 1.4 or later: https://hitch-tls.org/ Made by Varnish Software to provide a "browser-vendor-compliant" HTTP/2 stack.

Hmm... you guys sure have pretty thoroughly sanitized all references to Stud at this point in code, documentation, READMEs, etc. :-(

Hi jamwt. We haven't forgotten your(?) excellent work on stud!

Both changes.rst and the man page explain where Hitch came from.

Hitch has seen significant changes since we forked stud 0.3.2, for example proper reload/sighup support, an improved configuration format, and OCSP stapling. Running it on a large scale (cert/ip -wise) also works better now.

If you're ever in our parts of the world, let us know and we'll buy you some beers/coffee/$beverage and tell you all about how your old project is doing.

Re: Varnish Cache 5.0

#52

Post by phkamp » Fri, Sep 16, 2016, 7:06 AM UTC

lkarsten wrote: post #51

jamwt wrote: post #48

Earlier quoted context omitted.

Hmm... you guys sure have pretty thoroughly sanitized all references to Stud at this point in code, documentation, READMEs, etc. :-(

Hi jamwt. We haven't forgotten your(?) excellent work on stud! Both changes.rst and the man page explain where Hitch came from. Hitch has seen significant changes since we forked stud 0.3.2, for example proper reload/sighup support, an improved configuration format, and OCSP stapling. Running it on a large scale (cert/ip -wise) also works better now. If you're ever in our parts of the world, let us know and we'll buy…

Pssst, jamwt!

Don't let them buy you beer.

Insist on tasting their homebrew instead.

Re: Varnish Cache 5.0

#53

Post by ruben_varnish » Fri, Sep 16, 2016, 9:03 AM UTC

jamwt wrote: post #48

ruben_varnish wrote: post #11

Earlier quoted context omitted.

Yes, Varnish does h2c so for HTTPS you will need something like 1.4 or later: https://hitch-tls.org/ Made by Varnish Software to provide a "browser-vendor-compliant" HTTP/2 stack.

Hmm... you guys sure have pretty thoroughly sanitized all references to Stud at this point in code, documentation, READMEs, etc. :-(

The reference to Bump is also on the copyright notice on the license file.

As Lasse pointed out, we never meant to take away any merit from your work. If you feel we could highlight the Hitch's origin from Stud better, let us know how. We are open to suggestions.

And yes, if you ever come to Oslo, you have an open invitation to come by an test our homebrew :)

Re: Varnish Cache 5.0

#54

Post by omn1 » Fri, Sep 16, 2016, 9:33 AM UTC

fgsch wrote: post #31

omn1 wrote: post #9

Earlier quoted context omitted.

Not sure if the performance gains are still valid. There's reports that state the contrary: https://deliciousbrains.com/page-caching-varnish-vs-nginx-fa... Nginx has something similar to ESI called SSI ( http://serverfault.com/questions/406103/main-differences-bet... )

There is quite a few places for improvement in that test (e.g. tweaking number of threads in Varnish) and by no means the tests are like for like. I will take it with a grain of salt or do your own tests, if you really care.

Yes, important point: Always test with your own infrastructure and run your own benchmark. There's nothing replacing own experimentation and experience. What works for one company does not necessarily work for others as well.

Re: Varnish Cache 5.0

#55

Post by convolvatron » Sun, Sep 18, 2016, 2:28 AM UTC

phkamp wrote: post #22

hannob wrote: post #10

Do I understand this right? It supports HTTP/2, but doesn't support HTTPS. Therefore it supports HTTP/2 in a mostly unusable form, because browser vendors (for good reasons) decided to support HTTP/2 only over HTTPS.

The reason I don't want to link Varnish against a SSL library, is that in my considered opinion, they all suck. From a purely operational point of view, you are better of with two different SSL proxies in front if your Varnish (or other webserver), so that you can turn OpenSSL off in even-numbered weeks and the other (pick your poison) in odd-numbered weeks. The code to hold safely onto your certificate and do all th…

they do. they really do. i've read your screed about this and i completely agree. absolutely appalling. in particular a marked inability to handle thread concurrency, which is pretty fatal to varnish.

however. given that tls is operationally important. and using an additional proxy causes a lot of configuration and performance headaches. isn't there any better path forward?