Download to read offline
![vcl 4.0;
import std;
sub vcl_recv {
set req.http.Host = regsub(req.http.Host, ":[0-9]+", "");
set req.url = std.querysort(req.url);
if (req.url ~ "#") {
set req.url = regsub(req.url, "#.*$", "");
}
if (req.url ~ "?$") {
set req.url = regsub(req.url, "?$", "");
}
if (req.restarts == 0) {
if (req.http.Accept-Encoding) {
if (req.http.User-Agent ~ "MSIE 6") {
unset req.http.Accept-Encoding;
} elsif (req.http.Accept-Encoding ~ "gzip") {
set req.http.Accept-Encoding = "gzip";
} elsif (req.http.Accept-Encoding ~ "deflate") {
set req.http.Accept-Encoding = "deflate";
} else {
unset req.http.Accept-Encoding;
}
}
}
}](https://image.slidesharecdn.com/thisferyn-lightningfast-170223161842/75/Lightning-fast-with-Varnish-54-2048.jpg)
![vcl 4.0;
sub vcl_recv {
set req.http.Cookie = regsuball(req.http.Cookie, "has_js=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "__utm.=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "_ga=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "_gat=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "utmctr=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "utmcmd.=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "utmccn.=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "__gads=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "__qc.=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "__atuv.=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "^;s*", "");
if (req.http.cookie ~ "^s*$") {
unset req.http.cookie;
}
}
Remove tracking
cookies](https://image.slidesharecdn.com/thisferyn-lightningfast-170223161842/75/Lightning-fast-with-Varnish-58-2048.jpg)
![vcl 4.0;
sub vcl_recv {
if (req.http.Cookie) {
set req.http.Cookie = ";" + req.http.Cookie;
set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
set req.http.Cookie = regsuball(req.http.Cookie, ";(PHPSESSID)=", "; 1=");
set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");
if (req.http.cookie ~ "^s*$") {
unset req.http.cookie;
}
}
}
Only keep session
cookie](https://image.slidesharecdn.com/thisferyn-lightningfast-170223161842/75/Lightning-fast-with-Varnish-59-2048.jpg)
![sub vcl_recv {
if (req.http.Cookie) {
set req.http.Cookie = ";" + req.http.Cookie;
set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
set req.http.Cookie = regsuball(req.http.Cookie, ";(language)=", "; 1=");
set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");
if (req.http.cookie ~ "^s*$") {
unset req.http.cookie;
return(pass);
}
return(hash);
}
}
sub vcl_hash {
hash_data(regsub( req.http.Cookie, "^.*language=([^;]*);*.*$", "1" ));
}
Language cookie cache
variation](https://image.slidesharecdn.com/thisferyn-lightningfast-170223161842/75/Lightning-fast-with-Varnish-60-2048.jpg)
![Banning
curl -XPURGE "http://example.com/products"
curl -XPURGE -H "x-purge-regex:/products"
"http://example.com"
varnishadm> ban obj.http.x-host == example.com &&
obj.http.x-url ~ ^/product/[0-9]+/details](https://image.slidesharecdn.com/thisferyn-lightningfast-170223161842/75/Lightning-fast-with-Varnish-77-2048.jpg)
Uploaded byVarnish Software
Lightning fast with Varnish
The document provides an overview of using Varnish to accelerate web applications. Some key points: - Varnish works by caching responses from backend servers in memory for future requests, reducing load on backends. It respects HTTP caching best practices like expiration, conditional requests, and cache variations. - Configuration is done through Varnish Configuration Language (VCL) scripts which control caching behavior. Common tasks covered include setting cache rules, purging content, and normalizing requests. - Techniques discussed include caching only safe requests, stripping cookies, blacklisting/whitelisting URLs, and using Edge Side Includes (ESI) to break pages into cacheable components. Guidelines are provided for optimizing caching of dynamic content.
More Related Content
![C99[2]](https://cdn.slidesharecdn.com/ss_thumbnails/c992-100302130206-phpapp01-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Lightning fast with Varnish
![[BDD 2025 - Mobile Development] Crafting Immersive UI with E2E and AGSL Shade...](https://cdn.slidesharecdn.com/ss_thumbnails/md-craftingimmersiveuiwithe2eandagslshaderveronicaputrianggraini-251124030840-0c677f44-thumbnail.jpg?width=640&height=640&fit=bounds)
![[DevFest Strasbourg 2025] - NodeJs Can do that !!](https://cdn.slidesharecdn.com/ss_thumbnails/devfeststrasbourg2025-nodejscandothat-251127142731-da65b6fd-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Full-Stack Development] The Modern Stack: Building Web & AI Appli...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-themodernstackbuildingwebaiapplicationswithserverless-251124030844-388cf04f-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-digitalaccessibilitywhydevelopersneedtoknowandcarein2025-251127011019-0674441d-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Artificial Intelligence] AI for the Underdogs: Innovation for Sma...](https://cdn.slidesharecdn.com/ss_thumbnails/ai-aifortheunderdogsinnovationforsmallbusinesses-251124030839-72a599a4-thumbnail.jpg?width=640&height=640&fit=bounds)
Lightning fast with Varnish
- 1. Lightning fast Using Varnishto accelerate your web applications By Thijs Feryn
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 9.
- 10.
- 11.
- 12.
- 14.
- 15.
- 16.
- 18. Why is itso good?
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
- 25. apt-get install apt-transport-https curlhttps://repo.varnish-cache.org/GPG-key.txt | apt-key add - echo "deb https://repo.varnish-cache.org/debian/ jessie varnish-4.1" >> /etc/apt/sources.list.d/varnish-cache.list apt-get update apt-get install varnish Install on Linux (Debian) There's stuff for Ubuntu, RHEL & CentOS too
- 26. -a :80 -a:81,PROXY -T localhost:6082 -f /etc/varnish/default.vcl -S /etc/varnish/secret -s malloc,3g -j unix,user=myUser Simple config
- 27.
- 28.
- 29.
- 30. ✓Doesn't cache whencookies are present ✓Doesn't cache when cookies are set ✓Doesn't cache when Autorization headers are present State Avoids caching user- specific content Affects hit rate
- 31. Expiration Expires: Sat, 09Sep 2017 14:30:00 GMT Cache-control: public, max-age=3600, s-maxage=86400 Cache-control: private, no-cache, no-store
- 32. Expiration precedence 1. beresp.ttl(VCL) 2. s-maxage 3. max-age 4. expires 5. 120 seconds by default
- 33. Conditional requests HTTP/1.1 200OK Host: localhost Etag: 7c9d70604c6061da9bb9377d3f00eb27 Content-type: text/html; charset=UTF-8 Hello world output GET /if_none_match.php HTTP/1.1 Host: localhost User-Agent: curl/7.48.0
- 34. Conditional requests HTTP/1.0 304Not Modified Host: localhost Etag: 7c9d70604c6061da9bb9377d3f00eb27 GET /if_none_match.php HTTP/1.1 Host: localhost User-Agent: curl/7.48.0 If-None-Match: 7c9d70604c6061da9bb9377d3f00eb27
- 35. Conditional requests HTTP/1.1 200OK Host: localhost Last-Modified: Fri, 22 Jul 2016 10:11:16 GMT Content-type: text/html; charset=UTF-8 Hello world output GET /if_none_match.php HTTP/1.1 Host: localhost User-Agent: curl/7.48.0
- 36. Conditional requests HTTP/1.0 304Not Modified Host: localhost Last-Modified: Fri, 22 Jul 2016 10:11:16 GMT GET /if_none_match.php HTTP/1.1 Host: localhost User-Agent: curl/7.48.0 If-Last-Modified: Fri, 22 Jul 2016 10:11:16 GMT
- 37. ✓Hostname (or IP) ✓URL Cachevariations Identify object in cache
- 38. Cache variations GET /HTTP/1.1 Host: localhost Accept-Language: nl HTTP/1.1 200 OK Host: localhost Vary: Accept-Language Hallo, deze pagina is in het Nederlands geschreven.
- 39.
- 40. ✓Only GET &HEAD ✓No Cookie ✓No Authorization Built-in VCL (frontend) Lookup in cache Otherwise pass and don't cache
- 41. ✓No Set-Cookie ✓TTL >0 ✓No "no-cache", "private", "no-store" Built-in VCL (backend) Store in cache Otherwise blacklist for 120s
- 42.
- 43. sub vcl_recv { if(req.method == "PRI") { /* We do not support SPDY or HTTP/2.0 */ return (synth(405)); } if (req.method != "GET" && req.method != "HEAD" && req.method != "PUT" && req.method != "POST" && req.method != "TRACE" && req.method != "OPTIONS" && req.method != "DELETE") { /* Non-RFC2616 or CONNECT which is weird. */ return (pipe); } if (req.method != "GET" && req.method != "HEAD") { /* We only deal with GET and HEAD by default */ return (pass); } if (req.http.Authorization || req.http.Cookie) { /* Not cacheable by default */ return (pass); } return (hash); }
- 44. sub vcl_pipe { #By default Connection: close is set on all piped requests, to stop # connection reuse from sending future requests directly to the # (potentially) wrong backend. If you do want this to happen, you can undo # it here. # unset bereq.http.connection; return (pipe); } sub vcl_pass { return (fetch); } sub vcl_hash { hash_data(req.url); if (req.http.host) { hash_data(req.http.host); } else { hash_data(server.ip); } return (lookup); }
- 45. sub vcl_purge { return(synth(200, "Purged")); } sub vcl_hit { if (obj.ttl >= 0s) { // A pure unadultered hit, deliver it return (deliver); } if (obj.ttl + obj.grace > 0s) { // Object is in grace, deliver it // Automatically triggers a background fetch return (deliver); } // fetch & deliver once we get the result return (miss); } sub vcl_miss { return (fetch); } sub vcl_deliver { return (deliver); }
- 46. sub vcl_backend_fetch { return(fetch); } sub vcl_backend_response { if (beresp.ttl <= 0s || beresp.http.Set-Cookie || beresp.http.Surrogate-control ~ "no-store" || (!beresp.http.Surrogate-Control && beresp.http.Cache-Control ~ "no-cache|no- store|private") || beresp.http.Vary == "*") { /* * Mark as "Hit-For-Pass" for the next 2 minutes */ set beresp.ttl = 120s; set beresp.uncacheable = true; } return (deliver); }
- 47.
- 50.
- 51.
- 52.
- 53.
- 54. vcl 4.0; import std; subvcl_recv { set req.http.Host = regsub(req.http.Host, ":[0-9]+", ""); set req.url = std.querysort(req.url); if (req.url ~ "#") { set req.url = regsub(req.url, "#.*$", ""); } if (req.url ~ "?$") { set req.url = regsub(req.url, "?$", ""); } if (req.restarts == 0) { if (req.http.Accept-Encoding) { if (req.http.User-Agent ~ "MSIE 6") { unset req.http.Accept-Encoding; } elsif (req.http.Accept-Encoding ~ "gzip") { set req.http.Accept-Encoding = "gzip"; } elsif (req.http.Accept-Encoding ~ "deflate") { set req.http.Accept-Encoding = "deflate"; } else { unset req.http.Accept-Encoding; } } } }
- 55. sub vcl_recv { if(req.url ~ "^/status.php$" || req.url ~ "^/update.php$" || req.url ~ "^/admin$" || req.url ~ "^/admin/.*$" || req.url ~ "^/user$" || req.url ~ "^/user/.*$" || req.url ~ "^/flag/.*$" || req.url ~ "^.*/ajax/.*$" || req.url ~ "^.*/ahah/.*$") { return (pass); } } URL blacklist
- 56. sub vcl_recv { if(req.url ~ "^/products/?" return (hash); } } URL whitelist
- 57.
- 58. vcl 4.0; sub vcl_recv{ set req.http.Cookie = regsuball(req.http.Cookie, "has_js=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "__utm.=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "_ga=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "_gat=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "utmctr=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "utmcmd.=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "utmccn.=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "__gads=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "__qc.=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "__atuv.=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "^;s*", ""); if (req.http.cookie ~ "^s*$") { unset req.http.cookie; } } Remove tracking cookies
- 59. vcl 4.0; sub vcl_recv{ if (req.http.Cookie) { set req.http.Cookie = ";" + req.http.Cookie; set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";"); set req.http.Cookie = regsuball(req.http.Cookie, ";(PHPSESSID)=", "; 1="); set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", ""); set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", ""); if (req.http.cookie ~ "^s*$") { unset req.http.cookie; } } } Only keep session cookie
- 60. sub vcl_recv { if(req.http.Cookie) { set req.http.Cookie = ";" + req.http.Cookie; set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";"); set req.http.Cookie = regsuball(req.http.Cookie, ";(language)=", "; 1="); set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", ""); set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", ""); if (req.http.cookie ~ "^s*$") { unset req.http.cookie; return(pass); } return(hash); } } sub vcl_hash { hash_data(regsub( req.http.Cookie, "^.*language=([^;]*);*.*$", "1" )); } Language cookie cache variation
- 61.
- 62. sub vcl_hash { hash_data(req.http.Accept-Language); } HTTP/1.1200 OK Host: localhost Vary: Accept-Language Hash language Or just use
- 63.
- 64. ✓Don't throw everythingin a session ✓Use dedicated cookies ✓Strip off tracking cookies in VCL ✓Match cookies in VCL & make decisions ✓Perform cache variations on cookie values ✓Only use session cookies when you really have to ✓Use JWT to store session state client-side Cookie guidelines
- 65.
- 67.
- 68.
- 69. <esi:include src="/header" /> Edge Side Includes ✓Placeholder ✓Parsedby Varnish ✓Output is a composition of blocks ✓State per block ✓TTL per block
- 70. sub vcl_recv { setreq.http.Surrogate-Capability = "key=ESI/1.0"; } sub vcl_backend_response { if (beresp.http.Surrogate-Control ~ "ESI/1.0") { unset beresp.http.Surrogate-Control; set beresp.do_esi = true; } } Edge Side Includes
- 71.
- 72. <esi:include src="/header" /> Choose wisely <hx:include src="/header"></hx:include> ESI, parsedby Varnish HInclude, parsed by Javascript
- 73. Breaking news isn'tbreaking
- 74.
- 75. acl purge { "localhost"; "127.0.0.1"; "::1"; } subvcl_recv { if (req.method == "PURGE") { if (!client.ip ~ purge) { return (synth(405, “Not allowed.”)); } return (purge); } } Purging
- 76. acl purge { "localhost"; "127.0.0.1"; "::1"; } subvcl_backend_response { set beresp.http.x-url = bereq.url; set beresp.http.x-host = bereq.http.host; } sub vcl_deliver { unset resp.http.x-url; unset resp.http.x-host; } sub vcl_recv { if (req.method == "PURGE") { if (!client.ip ~ purge) { return (synth(405, "Not allowed")); } if(req.http.x-purge-regex) { ban("obj.http.x-host == " + req.http.host + " && obj.http.x-url ~ " + req.http.x-purge-regex); } else { ban("obj.http.x-host == " + req.http.host + " && obj.http.x-url == " + req.url); } return (synth(200, "Purged")); } } Banning
- 77. Banning curl -XPURGE "http://example.com/products" curl-XPURGE -H "x-purge-regex:/products" "http://example.com" varnishadm> ban obj.http.x-host == example.com && obj.http.x-url ~ ^/product/[0-9]+/details
- 78.
- 79.
- 81.
- 84.