Varnish in-depth training - Symfony Live Berlin 2017

by Thijs Feryn

Slide 1

Slide 1 text

By Thijs Feryn Varnish in -depth training

Slide 2

Slide 2 text

Slow websites suck

Slide 3

Slide 3 text

Web performance is an essential part of the user experience

Slide 4

Slide 4 text

Slow ~ Down

Slide 5

Slide 5 text

Saturated market

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

Heavy load

Slide 11

Slide 11 text

Mo money Mo servers

Slide 12

Slide 12 text

Identify slowest parts

Slide 13

Slide 13 text

No content

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

Reduce the impact of the code on the server

Slide 16

Slide 16 text

Not just raw speed

Slide 17

Slide 17 text

Scale

Slide 18

Slide 18 text

Refactor slow code Write fast code

Slide 19

Slide 19 text

Optimize database

Slide 20

Slide 20 text

Improve the API call

Slide 21

Slide 21 text

Optimize runtime

Slide 22

Slide 22 text

After a while you hit the limits

Slide 23

Slide 23 text

Cache

Slide 24

Slide 24 text

Don’t recompute if the data hasn’t changed

Slide 25

Slide 25 text

3 x 2 = ?

Slide 26

Slide 26 text

What can you cache? Byte code Database output External services Files from disk Pages

Slide 27

Slide 27 text

Caching is not a compensation for poor code

Slide 28

Slide 28 text

Caching is an essential architectural strategy

Slide 29

Slide 29 text

Pages

Slide 30

Slide 30 text

Normally User Server

Slide 31

Slide 31 text

With Varnish User Varnish Server

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

Hi, I’m Thijs

Slide 34

Slide 34 text

I’m @ThijsFeryn on Twitter

Slide 35

Slide 35 text

I’m an Evangelist At

Slide 36

Slide 36 text

I’m an Evangelist At

Slide 37

Slide 37 text

I’m a at board member

Slide 38

Slide 38 text

No content

Slide 39

Slide 39 text

Let's dive right in!

Slide 40

Slide 40 text

Varnish

Slide 41

Slide 41 text

Cache?

Slide 42

Slide 42 text

Loadbalancer?

Slide 43

Slide 43 text

Proxy?

Slide 44

Slide 44 text

Web application firewall?

Slide 45

Slide 45 text

HTTP accelerator

Slide 46

Slide 46 text

Regular proxy User Proxy Server Office

Slide 47

Slide 47 text

With reverse proxy User Proxy Server Datacenter

Slide 48

Slide 48 text

Bit of history

Slide 49

Slide 49 text

No content

Slide 50

Slide 50 text

No content

Slide 51

Slide 51 text

No content

Slide 52

Slide 52 text

No content

Slide 53

Slide 53 text

No content

Slide 54

Slide 54 text

No content

Slide 55

Slide 55 text

Varnish Moral License http://phk.freebsd.dk/VML/

Slide 56

Slide 56 text

No content

Slide 57

Slide 57 text

No content

Slide 58

Slide 58 text

Main project “sponsors”

Slide 59

Slide 59 text

How does it work?

Slide 60

Slide 60 text

varnishd VCL file Compiled & linked as shared object Client HTTP Backend HTTP Memory Logs Writes verbose “transaction” logs to memory varnishlog varnishtop Read memory logs, displays information varnishncsa varnishadm Allow basic management tasks Custom protocol

Slide 61

Slide 61 text

Install & configure

Slide 62

Slide 62 text

https://packagecloud.io/varnishcache/varnish5 https://packagecloud.io/varnishcache/varnish41

Slide 63

Slide 63 text

$ curl -s https://packagecloud.io/install/repositories/ varnishcache/varnish5/script.deb.sh | sudo bash $ apt-get install varnish Debian & Ubuntu

Slide 64

Slide 64 text

$ apt-cache policy varnish varnish: Installed: 5.2.0-1~stretch Candidate: 5.2.0-1~stretch Version table: *** 5.2.0-1~stretch 500 500 https://packagecloud.io/varnishcache/varnish5/debian stretch/main amd64 Packages 100 /var/lib/dpkg/status 5.1.3-1~stretch 500 500 https://packagecloud.io/varnishcache/varnish5/debian stretch/main amd64 Packages 5.1.2-1~stretch 500 500 https://packagecloud.io/varnishcache/varnish5/debian stretch/main amd64 Packages 5.0.0-7+deb9u1 500 500 http://deb.debian.org/debian stretch/main amd64 Packages 500 http://security.debian.org stretch/updates/main amd64 Packages

Slide 65

Slide 65 text

$ apt-get install varnish=5.2.0-1~stretch

Slide 66

Slide 66 text

$ curl -s https://packagecloud.io/install/repositories/ varnishcache/varnish5/script.rpm.sh | sudo bash $ yum install varnish RHEL & CentOS

Slide 67

Slide 67 text

Config file

Slide 68

Slide 68 text

No content

Slide 69

Slide 69 text

SysV Systemd Ubuntu/Debian /etc/default/varnish /etc/systemd/system/varnish.service RHEL/CentOS /etc/sysconfig/varnish /etc/varnish/varnish.params

Slide 70

Slide 70 text

cp /lib/systemd/system/varnish.service \ /etc/systemd/system/ Copy defaults file Ubuntu & Debian with systemd

Slide 71

Slide 71 text

Startup options

Slide 72

Slide 72 text

[Unit] Description=Varnish Cache, a high-performance HTTP accelerator [Service] Type=forking # Maximum number of open files (for ulimit -n) LimitNOFILE=131072 # Locked shared memory - should suffice to lock the shared memory log # (varnishd -l argument) # Default log size is 80MB vsl + 1M vsm + header -> 82MB # unit is bytes LimitMEMLOCK=85983232 # On systemd >= 228 enable this to avoid "fork failed" on reload. #TasksMax=infinity # Maximum size of the corefile. LimitCORE=infinity # Set WARMUP_TIME to force a delay in reload-vcl between vcl.load and vcl.use # This is useful when backend probe definitions need some time before declaring # configured backends healthy, to avoid routing traffic to a non-healthy backend. #WARMUP_TIME=0 ExecStart=/usr/sbin/varnishd -a :80 -T localhost:6082 -f /etc/varnish/default.vcl -S /etc/varnish/ secret -s malloc,256m ExecReload=/usr/share/varnish/reload-vcl [Install] WantedBy=multi-user.target Debian Stretch with systemd

Slide 73

Slide 73 text

$ vim /etc/systemd/system/varnish.service $ systemctl daemon-reload $ service varnish reload Reload with systemd

Slide 74

Slide 74 text

DAEMON_OPTS="-a :80 \ -T localhost:6082 \ -f /etc/varnish/default.vcl \ -S /etc/varnish/secret \ -s malloc,256m" Ubuntu Trusty without systemd

Slide 75

Slide 75 text

vim /etc/default/varnish service varnish reload Reload with sysv

Slide 76

Slide 76 text

-a: binding address & port -T: admin binding -f: VCL file -S: secret file -s: storage -j: jailing -l: shared memory log size -t: default TTL -p: runtime parameters Options

Slide 77

Slide 77 text

DAEMON_OPTS="-j unix,user=www-data \ -a main=0000:80 \ -a proxy=0.0.0.0:81,PROXY \ -T localhost:6082 \ -f /etc/varnish/default.vcl \ -S /etc/varnish/secret \ -l 100m,10m \ -t 60 \ -p feature=+esi_disable_xml_check \ -p connect_timeout=20s \ -p first_byte_timeout=100s \ -p between_bytes_timeout=5s \ -s malloc,3g"

Slide 78

Slide 78 text

The backend

Slide 79

Slide 79 text

Slide 80

Slide 80 text

Point of entry? Bind to 80 Otherwise 6081

Slide 81

Slide 81 text

8080 HTTP-ALT

Slide 82

Slide 82 text

Listen 8080 Apache ports.conf vhost

Slide 83

Slide 83 text

listen 8080; Nginx vhost

Slide 84

Slide 84 text

✓In VCL file ✓In config file using "-b" Link backend to Varnish

Slide 85

Slide 85 text

DAEMON_OPTS="-j unix,user=www-data \ -a main=0.0.0.0:80 \ -a proxy=0.0.0.0:81,PROXY \ -T localhost:6082 \ -b 127.0.0.1:8080 \ -S /etc/varnish/secret \ -s malloc,3g" Can't have -f In config file

Slide 86

Slide 86 text

vcl 4.0;    backend default {  .host = "127.0.0.1";  .port = "8080";  } In VCL file Minimal VCL

Slide 87

Slide 87 text

Typical setups

Slide 88

Slide 88 text

All-in-one User Varnish (80) Nginx (8080)

Slide 89

Slide 89 text

Dedicated Varnish User Varnish (80) Nginx (80)

Slide 90

Slide 90 text

Multiple webservers User Varnish (80) Nginx (8080) Varnish (80) Nginx (8080) KeepAliveD

Slide 91

Slide 91 text

Multiple webservers & dedicated Varnish User Varnish (80) KeepAliveD Varnish (80) Nginx (80) Nginx (80)

Slide 92

Slide 92 text

Loadbalancing User Varnish (80) KeepAliveD Varnish (80) Nginx (80) Nginx (80)

Slide 93

Slide 93 text

HAProxy loadbalancers User HAProxy (80) Varnish (6081) KeepAliveD HAProxy (80) Varnish (6081) Nginx (80) Nginx (80)

Slide 94

Slide 94 text

Share the cache

Slide 95

Slide 95 text

Share the cache User Nginx (80) Nginx (80) 1 2 3 4 5 6 HAProxy (80) Varnish ( 6080 & 6081) HAProxy (80) Varnish ( 6080 & 6081)

Slide 96

Slide 96 text

Share the cache 2 User HAProxy (80) Varnish ( 6080 & 6081) Nginx (80) Nginx (80) 1 5 3 4 2 6 HAProxy (80) Varnish ( 6080 & 6081)

Slide 97

Slide 97 text

vcl 4.0; import std; backend nginx { .host = "nginx"; .port = "80"; } backend nginx2 { .host = "nginx2"; .port = "80"; } backend varnish { .host = "varnish"; .port = "6080"; } backend varnish2 { .host = "varnish2"; .port = "6080"; } sub vcl_recv { if(server.hostname == "varnish") { if(std.port(server.ip) == 6080) { set req.backend_hint = nginx; set req.http.x-esi = "yes"; } else { set req.backend_hint = varnish2; set req.http.x-esi = "no"; } } else { if(std.port(server.ip) == 6080) { set req.backend_hint = nginx2; set req.http.x-esi = "yes"; } else { set req.backend_hint = varnish; set req.http.x-esi = "no"; } } } sub vcl_backend_response { if (bereq.http.x-esi == "yes" && beresp.http.Surrogate-Control ~ "ESI/1.0") { unset beresp.http.Surrogate-Control; set beresp.do_esi = true; } }

Slide 98

Slide 98 text

sub vcl_recv { if(server.hostname == "varnish") { if(std.port(server.ip) == 6080) { set req.backend_hint = nginx; set req.http.x-esi = "yes"; } else { set req.backend_hint = varnish2; set req.http.x-esi = "no"; } } else { if(std.port(server.ip) == 6080) { set req.backend_hint = nginx2; set req.http.x-esi = "yes"; } else { set req.backend_hint = varnish; set req.http.x-esi = "no"; } } }

Slide 99

Slide 99 text

What about TLS/SSL?

Slide 100

Slide 100 text

✓HAProxy ✓Nginx ✓Pound ✓Hitch Terminate TLS/SSL

Slide 101

Slide 101 text

HAProxy 172.18.0.3 Varnish 172.18.0.8 Nginx Public HTTP & HTTPS HTTP HTTP Certificates go here

Slide 102

Slide 102 text

How do you know if it was HTTP or HTTPS?

Slide 103

Slide 103 text

X-Forwarded-Proto: https X-Forwarded-Proto: http

Slide 104

Slide 104 text

if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false) $_SERVER['HTTPS']='on';

Slide 105

Slide 105 text

No content

Slide 106

Slide 106 text

SetEnvIf X-Forwarded-Proto "https" HTTPS=on Header append Vary: X-Forwarded-Proto RewriteEngine on RewriteCond %{HTTPS} !=on RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC] RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Slide 107

Slide 107 text

Demo setup

Slide 108

Slide 108 text

https://github.com/ThijsFeryn/ varnishtraining

Slide 109

Slide 109 text

$ docker-compose up $ docker-compose down $ docker-compose up -d $ docker-compose logs $ docker-compose logs -f $ docker-compose logs varnish $ docker-compose logs -f varnish

Slide 110

Slide 110 text

HAProxy (80 & 81) Varnish (6080, 6081, 6082, 6083) Nginx (80) PHP-FPM (9000) Varnish 2 (6080, 6081, 6082, 6083) Nginx 2 (80) PHP-FPM 2 (9000) MySQL (3306) Redis (6379) Demo setup

Slide 111

Slide 111 text

✓sflive-varnish2: 172.18.0.10 ✓sflive-varnish: 172.18.0.8 ✓sflive-nginx2: 172.18.0.6 ✓sflive-nginx: 172.18.0.2 ✓sflive-php2: 172.18.0.5 ✓sflive-php: 172.18.0.4 ✓sflive-haproxy: 172.18.0.3 ✓sflive-redis: 172.18.0.7 ✓sflive-mysql: 172.18.0.9 Demo setup IPs

Slide 112

Slide 112 text

No content

Slide 113

Slide 113 text

FROM debian:stretch as builder WORKDIR /usr/lib/varnish/vmods/ RUN apt-get update \ && apt-get install -y curl \ && curl -s https://packagecloud.io/install/repositories/varnishcache/varnish5/ script.deb.sh | bash \ && apt-get install -y unzip automake varnish=5.2.0-1~stretch varnish- dev=5.2.0-1~stretch build-essential libtool docutils-common libmhash-dev --allow- unauthenticated \ && curl -O https://download.varnish-software.com/varnish-modules/varnish- modules-0.12.1.tar.gz \ && tar xvzf varnish-modules-0.12.1.tar.gz \ && (cd varnish-modules-0.12.1 && ./configure && make && make install) \ && curl -O -L https://github.com/gquintard/libvmod-accept/archive/master.zip \ && unzip master.zip \ && (cd libvmod-accept-master && ./autogen.sh && ./configure && make && make install) \ && curl -O -L https://github.com/varnish/libvmod-digest/archive/master.zip \ && unzip master.zip \ && (cd libvmod-digest-master && ./autogen.sh && ./configure && make && make install) FROM debian:stretch WORKDIR /etc/varnish EXPOSE 6080 EXPOSE 6081 EXPOSE 6082 EXPOSE 6083 ENV SIZE 100m ENV SECRET E29F6DE6-3803-449E-8A01-AA537A8715B1 ARG BACKEND=nginx

Slide 114

Slide 114 text

Slide 115

Slide 115 text

Slide 116

Slide 116 text

Slide 117

Slide 117 text

Slide 118

Slide 118 text

install) \ && curl -O -L https://github.com/varnish/libvmod-digest/archive/master.zip \ && unzip master.zip \ && (cd libvmod-digest-master && ./autogen.sh && ./configure && make && make install) FROM debian:stretch WORKDIR /etc/varnish EXPOSE 6080 EXPOSE 6081 EXPOSE 6082 EXPOSE 6083 ENV SIZE 100m ENV SECRET E29F6DE6-3803-449E-8A01-AA537A8715B1 ARG BACKEND=nginx RUN apt-get update \ && apt-get install -y curl \ && curl -s https://packagecloud.io/install/repositories/varnishcache/varnish5/ script.deb.sh | bash \ && apt-get install -y varnish=5.2.0-1~stretch libmhash-dev --no-install-recommends --allow-unauthenticated \ && rm -rf /var/lib/apt/lists/* \ && /bin/bash -c ' echo "$SECRET" > /etc/varnish/secret' \ && rm -rf /usr/lib/varnish/vmods/libvmod_*.so COPY --from=builder /usr/lib/varnish/vmods/libvmod_*.so /usr/lib/varnish/vmods/ CMD ["/bin/bash","-c","/usr/sbin/varnishd -j unix,user=varnish -s malloc,$SIZE -F -a internal=0.0.0.0:6080 -a main=0.0.0.0:6081 -a proxy=0.0.0.0:6083,PROXY -T 0.0.0.0:6082 -f /etc/varnish/default.vcl -S /etc/varnish/secret -p feature=+esi_disable_xml_check - p vsl_mask=+Hash"]

Slide 119

Slide 119 text

Slide 120

Slide 120 text

Slide 121

Slide 121 text

What’s the real IP? 172.18.0.1 ?

Slide 122

Slide 122 text

HAProxy 172.18.0.3 Varnish 172.18.0.8 Nginx Public 172.18.0.1

Slide 123

Slide 123 text

X-Forwarded-For

Slide 124

Slide 124 text

Nginx Public 172.18.0.1 Client IP: 172.18.0.1 X-Forwarded-For:

Slide 125

Slide 125 text

Varnish 172.18.0.8 Nginx Public 172.18.0.1 Client IP: 172.18.0.8 X-Forwarded-For: 172.18.0.1

Slide 126

Slide 126 text

HAProxy 172.18.0.3 Varnish 172.18.0.8 Nginx Public 172.18.0.1 Client IP: 172.18.0.8 X-Forwarded-For: 172.18.0.3

Slide 127

Slide 127 text

PROXY Protocol

Slide 128

Slide 128 text

Add original IP as TCP preamble

Slide 129

Slide 129 text

DAEMON_OPTS="-j unix,user=www-data \ -a :80 \ -a :81,PROXY \ -T localhost:6082 \ -f /etc/varnish/default.vcl \ -S /etc/varnish/secret \ -l 100m,10m \ -t 60 \ -p feature=+esi_disable_xml_check \ -p connect_timeout=20s \ -p first_byte_timeout=100s \ -p between_bytes_timeout=5s \ -s malloc,3g"

Slide 130

Slide 130 text

Varnish automatically sets X-Forwarded-For to the original IP using PROXY protocol

Slide 131

Slide 131 text

HAProxy 172.18.0.3 Varnish 172.18.0.8 Nginx Public 172.18.0.1 Client IP: 172.18.0.8 X-Forwarded-For: 172.18.0.1

Slide 132

Slide 132 text

No content

Slide 133

Slide 133 text

There are rules

Slide 134

Slide 134 text

✓Idempotence ✓State ✓Expiration ✓Conditional requests ✓Cache variations Varnish speaks HTTP

Slide 135

Slide 135 text

Idempotence Execute multiple times Result doesn't change

Slide 136

Slide 136 text

✓ GET ✓ HEAD - POST - PUT - DELETE - PATCH Idempotence Result changes Result doesn't change Don't cache

Slide 137

Slide 137 text

State

Slide 138

Slide 138 text

State ~ user specific data Cookies Auth headers

Slide 139

Slide 139 text

About cookies

Slide 140

Slide 140 text

✓ Request header ✓ Sent by client (~browser) ✓ Sent on every request ✓ Describes state ✓ Is not cached ✓ 3rd party tracking cookies vs own cookies About cookies Cookie: key=value;key2=value2

Slide 141

Slide 141 text

✓ Response header ✓ Sent by backend server ✓ Only when backend is called ✓ Changes state ✓ Is not cached ✓ Blacklisted for 120s (by default) About cookies Set-Cookie: key=another_value

Slide 142

Slide 142 text

Time To Live

Slide 143

Slide 143 text

✓ 120s by default ✓ Respects HTTP cache-control header ✓ Respects expires header ✓ Override in VCL file Time to live

Slide 144

Slide 144 text

1.VCL 2.s-maxage 3.max-age 4.expires 5.Default value 120s TTL Order

Slide 145

Slide 145 text

Use TTL not to cache Cache-Control: max-age=0 Cache-Control: s-maxage=0 Cache-Control: private Cache-Control: no-cache Cache-Control: no-store Expires: Fri, 1 Jan 1971 00:00:00 GMT

Slide 146

Slide 146 text

Combine values Cache-Control: public, maxage=1000, s-maxage=3600

Slide 147

Slide 147 text

Age Age: 10 How old is the cached object?

Slide 148

Slide 148 text

Real cache duration max-age - Age s-maxage - Age

Slide 149

Slide 149 text

Don’t set the Age header yourself!

Slide 150

Slide 150 text

Conditional requests

Slide 151

Slide 151 text

Only fetch payload that has changed

Slide 152

Slide 152 text

Otherwise: HTTP/1.1 304 Not Modified

Slide 153

Slide 153 text

In both directions User Varnish Server 304 Not Modified 304 Not Modified

Slide 154

Slide 154 text

✓ Conserve bandwidth ✓ Reduce load on the backend when revalidating Conditional requests

Slide 155

Slide 155 text

Conditional requests HTTP/1.1 200 OK Host: localhost Etag: 7c9d70604c6061da9bb9377d3f00eb27 Content-type: text/html; charset=UTF-8 Hello world output GET /if_none_match.php HTTP/1.1 Host: localhost User-Agent: curl/7.48.0

Slide 156

Slide 156 text

Conditional requests HTTP/1.0 304 Not Modified Host: localhost Etag: 7c9d70604c6061da9bb9377d3f00eb27 GET /if_none_match.php HTTP/1.1 Host: localhost User-Agent: curl/7.48.0 If-None-Match: 7c9d70604c6061da9bb9377d3f00eb27

Slide 157

Slide 157 text

Conditional requests HTTP/1.1 200 OK Host: localhost Last-Modified: Fri, 22 Jul 2016 10:11:16 GMT Content-type: text/html; charset=UTF-8 Hello world output GET /if_none_match.php HTTP/1.1 Host: localhost User-Agent: curl/7.48.0

Slide 158

Slide 158 text

Conditional requests HTTP/1.0 304 Not Modified Host: localhost Last-Modified: Fri, 22 Jul 2016 10:11:16 GMT GET /if_none_match.php HTTP/1.1 Host: localhost User-Agent: curl/7.48.0 If-Last-Modified: Fri, 22 Jul 2016 10:11:16 GMT

Slide 159

Slide 159 text

Store etag or modification date

Slide 160

Slide 160 text

Validate early on

Slide 161

Slide 161 text

Exit quickly

Slide 162

Slide 162 text

Varnish can revalidate aynchronously

Slide 163

Slide 163 text

And serve stale data while that happens

Slide 164

Slide 164 text

Grace mode

Slide 165

Slide 165 text

Effective TTL = TTL + grace

Slide 166

Slide 166 text

Cache-Control: public, max-age=100, s-maxage=3600, stale-while-revalidate=7200 Stale-While-Revalidate Set grace mode

Slide 167

Slide 167 text

Variations

Slide 168

Slide 168 text

Cache is not the same for everyone

Slide 169

Slide 169 text

✓ URL ✓ Hostname ✓ IP if hostname is not set ✓ Vary header Basic variations

Slide 170

Slide 170 text

Vary header Vary: Accept-Encoding Vary: Accept-Language Vary: Cookie Watch out!

Slide 171

Slide 171 text

The flow

Slide 172

Slide 172 text

No content

Slide 173

Slide 173 text

No content

Slide 174

Slide 174 text

Varnish Configuration Language

Slide 175

Slide 175 text

DSL compiled and linked as shared object

Slide 176

Slide 176 text

/etc/varnish/default.vcl

Slide 177

Slide 177 text

Hooks & subroutines

Slide 178

Slide 178 text

VCL Recv VCL Hash VCL Miss VCL Hit VCL Backend Response VCL Deliver VCL Purge VCL Error VCL Pipe VCL Pass VCL Synth VCL Backend Error

Slide 179

Slide 179 text

✓vcl_recv: receive request ✓vcl_hash: compose cache key ✓vcl_miss: not found in cache ✓vcl_hit: found in cache ✓vcl_pass: don’t store in cache ✓vcl_pipe: bypass cache ✓vcl_backend_fetch: connect to backend ✓vcl_backend_response: response from backend ✓vcl_backend_error: backend fetch failed

Slide 180

Slide 180 text

✓vcl_purge: after successful purge ✓vcl_synth: send synthetic output ✓vcl_deliver: return data to client ✓vcl_init: initialize VMODs ✓vcl_fini: discard VMODs ✓vcl_fail: stop execution

Slide 181

Slide 181 text

Actions

Slide 182

Slide 182 text

✓ hash: lookup in cache ✓ pass: don't cache ✓ synth: synthetic HTML output ✓ pipe: bypass cache ✓ purge: remove from cache VCL_RECV

Slide 183

Slide 183 text

✓ synth: synthetic HTML output ✓ pipe: bypass cache VCL_PIPE

Slide 184

Slide 184 text

✓ fetch: fetch data from backend, don't cache ✓ restart: restart transaction ✓ synth: synthetic HTML output VCL_PASS

Slide 185

Slide 185 text

✓ deliver: send cached object ✓ miss: synchronous refresh despite hit ✓ pass: fetch data from backend despite hit, don't cache ✓ restart: restart transaction ✓ synth: synthetic HTML output VCL_HIT

Slide 186

Slide 186 text

✓ fetch: fetch data from backend ✓ pass: fetch data from backend, don't cache ✓ restart: restart transaction ✓ synth: synthetic HTML output VCL_MISS

Slide 187

Slide 187 text

✓ lookup: look for cached object by using hash key VCL_HASH

Slide 188

Slide 188 text

✓ restart: restart transaction ✓ synth: synthetic HTML output VCL_PURGE

Slide 189

Slide 189 text

✓ deliver: deliver object to client ✓ restart: restart transaction ✓ synth: synthetic HTML output VCL_DELIVER

Slide 190

Slide 190 text

✓ deliver: deliver synthetic output to client ✓ restart: restart transaction VCL_SYNTH

Slide 191

Slide 191 text

✓ fetch: fetch object from backend ✓ abandon: abandon request and send HTTP 503 error VCL_BACKEND_FETCH

Slide 192

Slide 192 text

✓ deliver: send fetched data to client ✓ abandon: abandon request and send HTTP 503 error ✓ retry: retry backend request VCL_BACKEND_RESPONSE

Slide 193

Slide 193 text

✓ deliver: send fetched data to client ✓ retry: retry backend request VCL_BACKEND_ERROR

Slide 194

Slide 194 text

Typical flows

Slide 195

Slide 195 text

✓ vcl_recv: hash ✓ vcl_hash: lookup ✓ vcl_miss: fetch ✓ vcl_backend_request: fetch ✓ vcl_backend_response: deliver ✓ vcl_deliver: deliver MISS

Slide 196

Slide 196 text

✓ vcl_recv: hash ✓ vcl_hash: lookup ✓ vcl_hit: deliver ✓ vcl_deliver: deliver HIT

Slide 197

Slide 197 text

✓ vcl_recv: pass ✓ vcl_pass: fetch ✓ vcl_backend_request: fetch ✓ vcl_backend_response: deliver ✓ vcl_deliver: deliver PASS

Slide 198

Slide 198 text

Objects

Slide 199

Slide 199 text

✓ req: incoming request object ✓ req_top: top level esi request ✓ bereq: request object to send to backend ✓ beresp: backend response ✓ resp: response to send back to client ✓ obj: cached object ✓ client: client information ✓ server: server information ✓ local: local TCP information ✓ remote: remote TCP information ✓ storage: storage information VCL Objects

Slide 200

Slide 200 text

Variables

Slide 201

Slide 201 text

✓ req.url ✓ req.http.host ✓ req.http.user-agent ✓ req.backend_hint ✓ req.method ✓ … req variables

Slide 202

Slide 202 text

✓ bereq.backend ✓ bereq.http.user-agent ✓ bereq.method ✓ bereq.url ✓ … bereq variables

Slide 203

Slide 203 text

✓ beresp.age ✓ beresp.backend.ip ✓ beresp.backend.name ✓ beresp.do_esi ✓ beresp.grace ✓ beresp.keep ✓ beresp.http.set-cookie ✓ beresp.ttl ✓ beresp.status ✓ beresp.uncacheable beresp variables

Slide 204

Slide 204 text

✓ client.ip ✓ client.identity client variables local variables ✓ local.ip remote variables ✓ remote.ip

Slide 205

Slide 205 text

✓ obj.age ✓ obj.grace ✓ obj.hits ✓ obj.http.cache-control ✓ obj.reason ✓ obj.status ✓ obj.ttl object variables

Slide 206

Slide 206 text

✓ resp.http.user-agent ✓ resp.is_streaming ✓ resp.reason ✓ resp.status resp variables

Slide 207

Slide 207 text

✓ storage..free_space ✓ storage..used_space ✓ storage..happy storage variables

Slide 208

Slide 208 text

Default behaviour

Slide 209

Slide 209 text

vcl 4.0; sub vcl_recv { if (req.method == "PRI") { return (synth(405)); } if (req.method != "GET" && req.method != "HEAD" && req.method != "PUT" && req.method != "POST" && req.method != "TRACE" && req.method != "OPTIONS" && req.method != “PATCH" && req.method != "DELETE") { return (pipe); } if (req.method != "GET" && req.method != "HEAD") { return (pass); } if (req.http.Authorization || req.http.Cookie) { return (pass); } return (hash); } Idempotence State Action Receive request

Slide 210

Slide 210 text

sub vcl_hash { hash_data(req.url); if (req.http.host) { hash_data(req.http.host); } else { hash_data(server.ip); } return (lookup); } Lookup in cache Variations Action

Slide 211

Slide 211 text

sub vcl_purge { return (synth(200, "Purged")); } sub vcl_hit { if (obj.ttl >= 0s) { return (deliver); } if (obj.ttl + obj.grace > 0s) { return (deliver); } return (miss); } sub vcl_miss { return (fetch); } sub vcl_deliver { return (deliver); } Remove from cache Found in cache Not found in cache Return HTTP response to client

Slide 212

Slide 212 text

sub vcl_synth { set resp.http.Content-Type = "text/html; charset=utf-8"; set resp.http.Retry-After = "5"; synthetic( {" "} + resp.status + " " + resp.reason + {"

Error "} + resp.status + " " + resp.reason + {"

"} + resp.reason + {"

Guru Meditation:

XID: "} + req.xid + {"

Varnish cache server

"} ); return (deliver); } Send custom HTML

Slide 213

Slide 213 text

sub vcl_backend_fetch { return (fetch); } sub vcl_backend_response { if (bereq.uncacheable) { return (deliver); } else if (beresp.ttl <= 0s || beresp.http.Set-Cookie || beresp.http.Surrogate-control ~ "no-store" || (!beresp.http.Surrogate-Control && beresp.http.Cache-Control ~ "no-cache|no-store|private") || beresp.http.Vary == "*") { set beresp.ttl = 120s; set beresp.uncacheable = true; } return (deliver); } Send backend request Receive backend response TTL State Receive backend response

Slide 214

Slide 214 text

sub vcl_backend_error { set beresp.http.Content-Type = "text/html; charset=utf-8"; set beresp.http.Retry-After = "5"; synthetic( {" "} + beresp.status + " " + beresp.reason + {"

Error "} + beresp.status + " " + beresp.reason + {"

"} + beresp.reason + {"

Guru Meditation:

XID: "} + bereq.xid + {"

Varnish cache server

"} ); return (deliver); } Send custom HTML on backend error

Slide 215

Slide 215 text

Minimal VCL

Slide 216

Slide 216 text

vcl 4.0; backend default { .host = "127.0.0.1"; .port = "8080"; } Minimal VCL

Slide 217

Slide 217 text

vcl 4.0; backend default { .host = "127.0.0.1"; .port = "80"; .max_connections = 300; .first_byte_timeout = 300s; .connect_timeout = 5s; .between_bytes_timeout = 2s; } More backend work

Slide 218

Slide 218 text

vcl 4.0; backend default { .host = "127.0.0.1"; .port = "80"; .max_connections = 300; .first_byte_timeout = 300s; .connect_timeout = 5s; .between_bytes_timeout = 2s; .probe = { .url = "/"; .interval = 5s; .timeout = 1s; .window = 5; .threshold = 3; } } Even more backend work

Slide 219

Slide 219 text

vcl 4.0; backend default { .host = "127.0.0.1"; .port = "80"; .max_connections = 300; .first_byte_timeout = 300s; .connect_timeout = 5s; .between_bytes_timeout = 2s; .probe = { .request = "HEAD / HTTP/1.1" "Host: localhost" "Connection: close" "User-Agent: Varnish Health Probe"; .interval = 5s; .timeout = 1s; .window = 5; .threshold = 3; } } Even more backend work

Slide 220

Slide 220 text

VMOD

Slide 221

Slide 221 text

Varnish modules

Slide 222

Slide 222 text

Written in C

Slide 223

Slide 223 text

Exposes new VCL objects

Slide 224

Slide 224 text

Added functionality

Slide 225

Slide 225 text

vcl 4.0; import directors; import std; import cookie; sub vcl_init { new vdir = directors.round_robin(); vdir.add_backend(…); vdir.add_backend(…); } VMOD

Slide 226

Slide 226 text

vmod_std

Slide 227

Slide 227 text

sub vcl_recv { if(std.file_exists("/etc/varnish/file.txt")) { return(synth(200,std.fileread("/etc/varnish/file.txt"))); } else { return(synth(200,"File does not exist")); } } std.fileread

Slide 228

Slide 228 text

sub vcl_recv { return(synth(200,"FOO: " + std.getenv("FOO"))); } std.getenv

Slide 229

Slide 229 text

vcl 4.0; import std; backend default { .host = "nginx"; .port = "80"; .probe = { .url = "/"; .interval = 1s; .timeout = 1s; .window = 5; .threshold = 3; } } sub vcl_recv { if(std.healthy(req.backend_hint)) { return(synth(200,"Backend is healthy")); } else { return(synth(200,"Backend is unhealthy")); } } std.healthy

Slide 230

Slide 230 text

sub vcl_recv { std.timestamp("Before std.log"); std.log("This should appear in the Shared Memory Log"); std.timestamp("After std.log"); std.syslog(9,"This should appear in the Syslog"); std.timestamp("After std.syslog"); return(synth(200,"OK")); } Logging

Slide 231

Slide 231 text

sub vcl_recv { return(synth(200,"Client port: " + std.port(client.ip) + ", server port: " + std.port(server.ip))); } std.port

Slide 232

Slide 232 text

sub vcl_recv { return(synth(200,"Unsorted: " + regsub(req.url,"\?(.+)$","\1") + ", sorted: " + regsub(std.querysort(req.url),"\?(.+)$","\1"))); } std.querysort

Slide 233

Slide 233 text

sub vcl_recv { return(synth(200,std.real2integer(std.random(1,10),0))); } std.random & std.real2integer

Slide 234

Slide 234 text

sub vcl_recv { return(synth(200,std.toupper("yes") + " " + std.tolower("YES"))); } std.toupper & std.tolower

Slide 235

Slide 235 text

https://varnish-cache.org/docs/5.2/ reference/vmod_std.generated.html

Slide 236

Slide 236 text

Load balancing

Slide 237

Slide 237 text

vcl 4.0; import directors; backend server1 { .host = “1.2.3.4”; .port = "80"; .max_connections = 300; .first_byte_timeout = 300s; .connect_timeout = 5s; .between_bytes_timeout = 2s; .probe = { .request = "HEAD / HTTP/1.1" "Host: localhost" "Connection: close" "User-Agent: Varnish Health Probe"; .interval = 5s; .timeout = 1s; .window = 5; .threshold = 3; } } Loadbalancing: server 1

Slide 238

Slide 238 text

backend server2 { .host = “1.2.3.5”; .port = "80"; .max_connections = 300; .first_byte_timeout = 300s; .connect_timeout = 5s; .between_bytes_timeout = 2s; .probe = { .request = "HEAD / HTTP/1.1" "Host: localhost" "Connection: close" "User-Agent: Varnish Health Probe"; .interval = 5s; .timeout = 1s; .window = 5; .threshold = 3; } } Loadbalancing: server 2

Slide 239

Slide 239 text

sub vcl_init { new vdir = directors.round_robin(); vdir.add_backend(server1); vdir.add_backend(server2); } sub vcl_recv { set req.backend_hint = vdir.backend(); } Loadbalancing: round robin

Slide 240

Slide 240 text

sub vcl_init { new vdir = directors.random(); vdir.add_backend(server1,2); vdir.add_backend(server2,3); } sub vcl_recv { set req.backend_hint = vdir.backend(); } Loadbalancing: random

Slide 241

Slide 241 text

sub vcl_init { new vdir = directors.fallback(); vdir.add_backend(server1); vdir.add_backend(server2); } sub vcl_recv { set req.backend_hint = vdir.backend(); } Loadbalancing: fallback

Slide 242

Slide 242 text

sub vcl_init { new vdir = directors.hash(); vdir.add_backend(server1); vdir.add_backend(server2); } sub vcl_recv { set req.backend_hint = vdir.backend(req.url); } Loadbalancing: URL hash

Slide 243

Slide 243 text

sub vcl_init { new vdir = directors.hash(); vdir.add_backend(server1); vdir.add_backend(server2); } sub vcl_recv { set req.backend_hint = vdir.backend(client.identity); } Loadbalancing: IP hash

Slide 244

Slide 244 text

sub vcl_recv { if(req.url ~ “^/products”) { set req.backend_hint = server1; } else { set req.backend_hint = server2; } } Conditional loadbalancing

Slide 245

Slide 245 text

Install other VMODs

Slide 246

Slide 246 text

apt-get install -y varnish varnish-dev build-essential curl -O https://download.varnish-software.com/varnish- modules/varnish-modules-0.12.1.tar.gz tar xvzf varnish-modules-0.12.1.tar.gz cd varnish-modules-0.12.1 ./configure make make install Install official VMODs

Slide 247

Slide 247 text

apt-get install -y varnish varnish-modules Install basic VMODs If you install Varnish 5.0.0 via Debian repo

Slide 248

Slide 248 text

vmod_cookie

Slide 249

Slide 249 text

vcl 4.0; sub vcl_recv { if (req.http.Cookie) { set req.http.Cookie = ";" + req.http.Cookie; set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";"); set req.http.Cookie = regsuball(req.http.Cookie, ";(PHPSESSID)=", "; \1="); set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", ""); set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", ""); if (req.http.cookie ~ "^\s*$") { unset req.http.cookie; } } } Without vmod_cookie

Slide 250

Slide 250 text

vcl 4.0; import cookie; sub vcl_recv { if (req.http.cookie) { cookie.parse(req.http.cookie); cookie.filter_except("PHPSESSID"); set req.http.cookie = cookie.get_string(); if (req.http.cookie ~ "^\s*$") { unset req.http.cookie; } } } With vmod_cookie

Slide 251

Slide 251 text

vcl 4.0; import cookie; sub vcl_recv { cookie.parse(req.http.cookie); if(cookie.isset("PHPSESSID")) { return(synth(200,"PHPSESSID is set and contains the following value: " + cookie.get("PHPSESSID") + "")); } } Other vmod_cookie examples

Slide 252

Slide 252 text

vcl 4.0; import cookie; sub vcl_recv { cookie.parse(req.http.cookie); if(cookie.isset(“PHPSESSID") && req.url ~ "^/products/[0-9]+$") { cookie.delete("PHPSESSID"); } set req.http.cookie = cookie.get_string(); } Other vmod_cookie examples

Slide 253

Slide 253 text

https://github.com/varnish/varnish- modules/blob/master/docs/ vmod_cookie.rst

Slide 254

Slide 254 text

vmod_accept

Slide 255

Slide 255 text

https://github.com/gquintard/libvmod-accept

Slide 256

Slide 256 text

vcl 4.0; import accept; backend default { .host = "nginx"; .port = "80"; } sub vcl_init { new rule = accept.rule("en"); rule.add("nl"); } sub vcl_recv { set req.http.x-old-accept-language= req.http.Accept-Language; set req.http.Accept-Language = rule.filter(req.http.Accept-Language); return(synth(200,"

Raw Accept-Language: "+req.http.x-old-accept- language+"
Filtered Accept-Language: "+req.http.Accept-Language+"

Slide 257

Slide 257 text

• Raw Accept-Language: nl,en-US;q=0.8,en;q=0.6 • Filtered Accept-Language: nl vmod_accept output

Slide 258

Slide 258 text

vcl 4.0; import accept; backend default { .host = "nginx"; .port = "80"; } sub vcl_init { new language = accept.rule("en"); language.add("nl"); new encoding = accept.rule("deflate"); language.add("gzip"); new contenttype = accept.rule("text/plain"); contenttype.add("text/html"); contenttype.add("application/json"); } sub vcl_recv { set req.http.Accept-Language = language.filter(req.http.Accept-Language); set req.http.Accept-Encoding = encoding.filter(req.http.Accept-Encoding); set req.http.Accept = contenttype.filter(req.http.Accept); } vmod_accept

Slide 259

Slide 259 text

Why is this useful?

Slide 260

Slide 260 text

Accept-Language: nl,en-US;q=0.8,en;q=0.6 Too many variations Impacts hit rate Why is vmod_accept useful? Accept-Language: nl Less variations

Slide 261

Slide 261 text

More VMODs coming up later

Slide 262

Slide 262 text

In an ideal world

Slide 263

Slide 263 text

HTTP best practices > custom VCL

Slide 264

Slide 264 text

Reality sucks

Slide 265

Slide 265 text

No content

Slide 266

Slide 266 text

No content

Slide 267

Slide 267 text

Don’t trust the end-user

Slide 268

Slide 268 text

Cache-control ?

Slide 269

Slide 269 text

Legacy

Slide 270

Slide 270 text

Write VCL

Slide 271

Slide 271 text

Normalize

Slide 272

Slide 272 text

vcl 4.0; import accept; import std; backend default { .host = "nginx"; .port = "80"; } sub vcl_init { new language = accept.rule("en"); language.add("nl"); new encoding = accept.rule(""); language.add("deflate"); language.add("gzip"); new contenttype = accept.rule("text/plain"); contenttype.add("text/html"); contenttype.add("application/json"); } sub vcl_recv { set req.http.Accept-Language = language.filter(req.http.Accept-Language); set req.http.Accept-Encoding = encoding.filter(req.http.Accept-Encoding); set req.http.Accept = contenttype.filter(req.http.Accept); if (req.http.User-Agent ~ "MSIE 6" || req.http.Accept-Encoding ~ "^\s*$") { unset req.http.Accept-Encoding; } set req.http.Host = regsub(req.http.Host, ":[0-9]+", ""); set req.url = std.querysort(req.url); Normalize

Slide 273

Slide 273 text

if (req.url ~ "(\?|&)(utm_source|utm_medium|utm_campaign|utm_content|gclid|cx|ie|cof|siteurl)=") { set req.url = regsuball(req.url, "&(utm_source|utm_medium|utm_campaign|utm_content|gclid|cx|ie|cof| siteurl)=([A-z0-9_\-\.%25]+)", ""); set req.url = regsuball(req.url, "\?(utm_source|utm_medium|utm_campaign|utm_content|gclid|cx|ie|cof| siteurl)=([A-z0-9_\-\.%25]+)", "?"); set req.url = regsub(req.url, "\?&", "?"); set req.url = regsub(req.url, "\?$", ""); } if (req.url ~ "\#") { set req.url = regsub(req.url, "\#.*$", ""); } if (req.url ~ "\?$") { set req.url = regsub(req.url, "\?$", ""); } } Normalize

Slide 274

Slide 274 text

Static assets

Slide 275

Slide 275 text

vcl 4.0; sub vcl_recv { if (req.url ~ "^[^?]*\.(7z|avi|bmp|bz2|css|csv|doc|docx|eot|flac|flv| gif|gz|ico|jpeg|jpg|js|less|mka|mkv|mov|mp3|mp4|mpeg|mpg|odt|otf|ogg| ogm|opus|pdf|png|ppt|pptx|rar|rtf|svg|svgz|swf|tar|tbz|tgz|ttf|txt|txz| wav|webm|webp|woff|woff2|xls|xlsx|xml|xz|zip)(\?.*)?$") { unset req.http.Cookie; return (hash); } } sub vcl_backend_response { if (bereq.url ~ "^[^?]*\.(7z|avi|bmp|bz2|css|csv|doc|docx|eot|flac| flv|gif|gz|ico|jpeg|jpg|js|less|mka|mkv|mov|mp3|mp4|mpeg|mpg|odt|otf| ogg|ogm|opus|pdf|png|ppt|pptx|rar|rtf|svg|svgz|swf|tar|tbz|tgz|ttf|txt| txz|wav|webm|webp|woff|woff2|xls|xlsx|xml|xz|zip)(\?.*)?$") { unset beresp.http.set-cookie; } if (bereq.url ~ "^[^?]*\.(7z|avi|bz2|flac|flv|gz|mka|mkv|mov|mp3|mp4| mpeg|mpg|ogg|ogm|opus|rar|tar|tgz|tbz|txz|wav|webm|xz|zip)(\?.*)?$") { unset beresp.http.set-cookie; set beresp.do_stream = true; set beresp.do_gzip = false; } } Cache static assets

Slide 276

Slide 276 text

Do you really want to cache static assets?

Slide 277

Slide 277 text

Nginx or Apache can be fast enough for that

Slide 278

Slide 278 text

vcl 4.0; import std; sub vcl_recv { if (req.url ~ "^[^?]*\.(7z|avi|bmp|bz2|css|csv|doc|docx|eot|flac|flv| gif|gz|ico|jpeg|jpg|js|less|mka|mkv|mov|mp3|mp4|mpeg|mpg|odt|otf|ogg| ogm|opus|pdf|png|ppt|pptx|rar|rtf|svg|svgz|swf|tar|tbz|tgz|ttf|txt|txz| wav|webm|webp|woff|woff2|xls|xlsx|xml|xz|zip)(\?.*)?$") { unset req.http.Cookie; return (pass); } } Don’t cache static assets

Slide 279

Slide 279 text

URL whitelist/blacklist

Slide 280

Slide 280 text

sub vcl_recv { if (req.url ~ "^/status\.php$" || req.url ~ "^/update\.php$" || req.url ~ "^/admin$" || req.url ~ "^/admin/.*$" || req.url ~ "^/user$" || req.url ~ "^/user/.*$" || req.url ~ "^/flag/.*$" || req.url ~ "^.*/ajax/.*$" || req.url ~ "^.*/ahah/.*$") { return (pass); } } URL blacklist

Slide 281

Slide 281 text

sub vcl_recv { if (req.url ~ "^/products/?" return (hash); } } URL whitelist

Slide 282

Slide 282 text

Those damn cookies again!

Slide 283

Slide 283 text

vcl 4.0; sub vcl_recv { set req.http.Cookie = regsuball(req.http.Cookie, "has_js=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "__utm.=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "_ga=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "_gat=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "utmctr=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "utmcmd.=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "utmccn.=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "__gads=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "__qc.=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "__atuv.=[^;]+(; )?", ""); set req.http.Cookie = regsuball(req.http.Cookie, "^;\s*", ""); if (req.http.cookie ~ "^\s*$") { unset req.http.cookie; } } Remove tracking cookies

Slide 284

Slide 284 text

Slide 285

Slide 285 text

vcl 4.0; sub vcl_recv { if (req.http.cookie) { cookie.parse(req.http.cookie); cookie.filter_except("PHPSESSID"); set req.http.cookie = cookie.get_string(); if (req.http.cookie ~ "^\s*$") { unset req.http.cookie; } } } The VMOD way

Slide 286

Slide 286 text

sub vcl_recv { if (req.http.Cookie) { set req.http.Cookie = ";" + req.http.Cookie; set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";"); set req.http.Cookie = regsuball(req.http.Cookie, ";(language)=", "; \1="); set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", ""); set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", ""); if (req.http.cookie ~ "^\s*$") { unset req.http.cookie; return(pass); } return(hash); } } sub vcl_hash { hash_data(regsub( req.http.Cookie, "^.*language=([^;]*);*.*$", "\1" )); } Language cookie cache variation

Slide 287

Slide 287 text

vcl 4.0; import cookie; backend default { .host = "nginx"; .port = "80"; } sub vcl_recv { if (req.http.cookie) { cookie.parse(req.http.cookie); cookie.filter_except("language"); set req.http.cookie = cookie.get_string(); if (req.http.cookie ~ "^\s*$") { unset req.http.cookie; } return(hash); } } sub vcl_hash { hash_data(cookie.get("language")); } The VMOD way

Slide 288

Slide 288 text

Alternative language cache variation

Slide 289

Slide 289 text

sub vcl_hash { hash_data(req.http.Accept-Language); } Language cookie cache variation Or just send a “Vary:Accept-Language” header

Slide 290

Slide 290 text

sub vcl_recv { return(hash); } Cache, even with cookies

Slide 291

Slide 291 text

sub vcl_hash { hash_data(req.http.Cookie); } Hash all cookies

Slide 292

Slide 292 text

Block caching

Slide 293

Slide 293 text

No content

Slide 294

Slide 294 text

Code renders single HTTP response

Slide 295

Slide 295 text

Lowest denominator: no cache

Slide 296

Slide 296 text

Edge Side Includes ✓Placeholder ✓Parsed by Varnish ✓Output is a composition of blocks ✓State per block ✓TTL per block

Slide 297

Slide 297 text

sub vcl_recv { set req.http.Surrogate-Capability = "key=ESI/1.0"; } sub vcl_backend_response { if (beresp.http.Surrogate-Control ~ "ESI/1.0") { unset beresp.http.Surrogate-Control; set beresp.do_esi = true; } } Edge Side Includes

Slide 298

Slide 298 text

'; '.PHP_EOL; echo "Date in the main page: ".date('Y-m-d H:i:s').'
'; Main page ESI frame: esi.php Cached for 10 seconds Not cached

Slide 299

Slide 299 text

ESI_xmlerror No ESI processing, first char not '<'. (See feature esi_disable_xml_check) Expects HTML/ XML tags

Slide 300

Slide 300 text

-p feature=+esi_disable_xml_check Add as startup option

Slide 301

Slide 301 text

req_top Get information about parent request in an ESI call

Slide 302

Slide 302 text

vcl 4.0; backend default { .host = "nginx"; .port = "80"; } sub vcl_recv { if (req.esi_level > 0) { set req.http.x-parent-url = req_top.url; } } sub vcl_backend_response { if (beresp.http.Surrogate-Control ~ "ESI/1.0") { unset beresp.http.Surrogate-Control; set beresp.do_esi = true; } } Get parent URL

Slide 303

Slide 303 text

ESI vs AJAX

Slide 304

Slide 304 text

✓ Server-side ✓ Standardized ✓ Processed on the “edge”, no in the browser ✓ Generally faster Edge-Side Includes - Sequential - One fails, all fail - Limited implementation in Varnish

Slide 305

Slide 305 text

✓ Client-side ✓ Common knowledge ✓ Parallel processing ✓ Graceful degradation AJAX - Processed by the browser - Extra roundtrips - Somewhat slower

Slide 306

Slide 306 text

Choose wisely

Slide 307

Slide 307 text

Assemble at the view layer

Slide 308

Slide 308 text

{{ render_esi(controller('AppBundle:News:latest', { 'maxPerPage': 5 })) }} {{ render_esi(url('latest_news', { 'maxPerPage': 5 })) }} In your Twig templates Silex or Symfony Falls back to internal subrequests on failure Does ESI

Slide 309

Slide 309 text

{{ render_hinclude(controller('AppBundle:News:latest', { 'maxPerPage': 5 })) }} {{ render_hinclude(url(‘latest_news', { 'maxPerPage': 5 })) }} In your Twig templates Silex or Symfony Requires hinclude.js Does AJAX

Slide 310

Slide 310 text

ESI vs HInclude Extra parameters

Slide 311

Slide 311 text

Silex example

Slide 312

Slide 312 text

register(new Silex\Provider\TwigServiceProvider(), [ 'twig.path' => dirname(__DIR__).'/views' ]); $app->register(new Silex\Provider\HttpCacheServiceProvider()); $app->register(new Silex\Provider\HttpFragmentServiceProvider()); $app->get('/', function() use($app) { $response = new Response($app['twig']->render('index.twig')); $response->setSharedMaxAge(10); return $response; }); $app->get('/header', function() use($app) { $response = new Response($app['twig']->render('header.twig')); $response->setPrivate(); return $response; })->bind('header'); $app->get('/footer', function() use($app) { $response = new Response($app['twig']->render('footer.twig')); $response->setSharedMaxAge(3); return $response; })->bind('footer'); $app->run();

Slide 313

Slide 313 text

Main content

Date and time: {{ "now"|date("m/d/Y H:i:s") }}

{{ render_hinclude(url('footer')) }} script> </body> </html> index.twig

Slide 314

Slide 314 text

Header

Date and time: {{ "now"|date("m/d/Y H:i:s") }}

header.twig

Slide 315

Slide 315 text

Footer

Date and time: {{ "now"|date("m/d/Y H:i:s") }}

footer.twig

Slide 316

Slide 316 text

Control Time To Live

Slide 317

Slide 317 text

sub vcl_backend_response { set beresp.ttl = 3h; } Control Time To Live

Slide 318

Slide 318 text

sub vcl_backend_response { if (beresp.ttl <= 0s || beresp.http.Set-Cookie || beresp.http.Vary == "*") { set beresp.ttl = 120s; set beresp.uncacheable = true; return (deliver); } } Control Time To Live

Slide 319

Slide 319 text

Debugging

Slide 320

Slide 320 text

sub vcl_deliver { if (obj.hits > 0) { set resp.http.X-Cache = "HIT"; } else { set resp.http.X-Cache = "MISS"; } } Debugging

Slide 321

Slide 321 text

Anonymize

Slide 322

Slide 322 text

sub vcl_deliver { unset resp.http.X-Powered-By; unset resp.http.Server; unset resp.http.X-Drupal-Cache; unset resp.http.X-Varnish; unset resp.http.Via; unset resp.http.Link; unset resp.http.X-Generator; } Anonymize

Slide 323

Slide 323 text

Breaking news isn't breaking

Slide 324

Slide 324 text

Purging

Slide 325

Slide 325 text

acl purgers { "localhost"; "127.0.0.1"; "::1"; } sub vcl_recv { if (req.method == "PURGE") { if (client.ip !~ purgers) { return (synth(405, "Method not allowed")); } return (purge); } } Purging

Slide 326

Slide 326 text

Purging curl -XPURGE "http://example.com/products" Immediately remove from memory

Slide 327

Slide 327 text

true, CURLOPT_CUSTOMREQUEST => 'PURGE' ]); echo curl_exec($curl).PHP_EOL; Purging

Slide 328

Slide 328 text

'http://localhost:6081/']); $response = $client->request('PURGE', '/'); if($response->getStatusCode() == 200) { echo "PURGED".PHP_EOL; } else { echo $response->getBody(); } Purging

Slide 329

Slide 329 text

Slide 330

Slide 330 text

Banning curl -XPURGE "http://example.com/products" curl -XPURGE -H "x-purge-regex:/products" "http://example.com" Add to ban list, remove on next request Remove patterns via “X-PURGE-REGEX”

Slide 331

Slide 331 text

Lurker-friendly bans

Slide 332

Slide 332 text

Ban lurker Object User Varnish Server Sends HTTP response Response stored in object Sends BAN to Varnish Ban lurker thread Ban list Reads ban list Removes object ban req.http.host == localhost && req.url ~ /products

Slide 333

Slide 333 text

Ban lurker ban req.http.host == localhost && req.url ~ /products Lurker can’t match request info Lurker can only match what’s in the object Next visitor triggers cache remove

Slide 334

Slide 334 text

acl purge { "localhost"; "127.0.0.1"; "::1"; } sub vcl_recv { if (req.method == "PURGE") { if (client.ip !~ purgers) { return (synth(405, "Method not allowed")); } if(req.http.x-purge-regex) { ban("obj.http.x-host == " + req.http.host + " && obj.http.x-url ~ " + req.http.x-purge-regex); } else { ban("obj.http.host == " + req.http.host + " && obj.http.x-url == " + req.url); } return (synth(200, "Purged")); } } sub vcl_backend_response { set beresp.http.x-url = bereq.url; set beresp.http.x-host = bereq.http.host; } sub vcl_deliver { unset resp.http.x-url; unset resp.http.x-host; } Lurker-friendly bans Store request info in response object

Slide 335

Slide 335 text

Lurker-friendly bans ban obj.http.x-host == localhost && obj.http.x-url ~ /products Lurker can match response info Ban lurker removes item from cache async

Slide 336

Slide 336 text

varnish> param.show ban_lurker_age 200 ban_lurker_age Value is: 60.000 [seconds] (default) Minimum is: 0.000 The ban lurker will ignore bans until they are this old. When a ban is added, the active traffic will be tested against it as part of object lookup. Because many applications issue bans in bursts, this parameter holds the ban-lurker off until the rush is over. This should be set to the approximate time which a ban-burst takes.

Slide 337

Slide 337 text

Banning through Varnishadm

Slide 338

Slide 338 text

varnishadm> ban obj.http.x-host == localhost && obj.http.x-url ~ /products Varnishadm banning

Slide 339

Slide 339 text

Banning through socket

Slide 340

Slide 340 text

Varnishadm is a binary on top of the socket

Slide 341

Slide 341 text

Varnishadm uses the secret file to authenticate automatically

Slide 342

Slide 342 text

$ telnet varnish 6082 Connected to localhost. Escape character is '^]'. 107 59 cohvooigdtqvkpwewhdxkqiwkfkpwsly Authentication required. auth 5a9c5722f31cc3c92f0e4616571624df7bddde2f8e42aaffe795dc80fb8c91dd 200 240 ----------------------------- Varnish Cache CLI 1.0 ----------------------------- Linux,4.9.49-moby,x86_64,-junix,-smalloc,-smalloc,-hcritbit varnish-5.2.0 revision 4c4875cbf Type 'help' for command list. Type 'quit' to close CLI session. ban obj.http.x-host == localhost && obj.http.x-url ~ /products 200 0

Slide 343

Slide 343 text

Slide 344

Slide 344 text

Slide 345

Slide 345 text

Secure your access the the admin socket

Slide 346

Slide 346 text

Slide 347

Slide 347 text

Admin socket does more than banning

Slide 348

Slide 348 text

----------------------------- Varnish Cache CLI 1.0 ----------------------------- Linux,4.9.49-moby,x86_64,-junix,-smalloc,-smalloc,-hcritbit varnish-5.2.0 revision 4c4875cbf Type 'help' for command list. Type 'quit' to close CLI session. help 200 613 auth backend.list [-p] [] backend.set_health [auto|healthy|sick] ban [&& ...] ban.list banner help [] panic.clear [-z] panic.show param.set param.show [-l] [] ping [] quit start status stop storage.list vcl.discard vcl.inline [auto|cold|warm] vcl.label vcl.list vcl.load [auto|cold|warm] vcl.show [-v] vcl.state [auto|cold|warm] vcl.use

Slide 349

Slide 349 text

Refresh content

Slide 350

Slide 350 text

vcl 4.0; acl refreshers { "172.18.0.0"/24; "localhost"; } backend default { .host = "nginx"; .port = "80"; } sub vcl_recv { if (req.method == "REFRESH") { if (client.ip !~ refreshers) { return (synth(405, "Method not allowed")); } set req.method = "GET"; set req.hash_always_miss = true; } } Refresh content Perform miss, fetch content, overwrite object

Slide 351

Slide 351 text

Refresh content curl -XREFRESH "http://example.com/products"

Slide 352

Slide 352 text

Tag-base invalidation

Slide 353

Slide 353 text

vmod_xkey

Slide 354

Slide 354 text

vcl 4.0; import xkey; acl purgers { "172.18.0.0"/24; } backend default { .host = "nginx"; .port = "80"; } sub vcl_recv { if (req.method == "PURGE") { if (client.ip !~ purgers) { return (synth(405, "Method now allowed")); } set req.http.n-gone = xkey.purge(req.http.key); return (synth(200, "Invalidated "+req.http.n-gone+" objects for key "+ req.http.key)); } if (req.method == "SOFTPURGE") { if (client.ip !~ purgers) { return (synth(405, "Method not allowed")); } set req.http.n-gone = xkey.softpurge(req.http.key); return (synth(200, "Invalidated "+req.http.n-gone+" objects via softpurge for key "+ req.http.key)); } }

Slide 355

Slide 355 text

'.PHP_EOL; Add “xkey” headers Register tags

Slide 356

Slide 356 text

Invalidate tags curl -XPURGE -H"key: b" "http://example.com/" PURGE / HTTP/1.1 Host: localhost User-Agent: curl/7.55.1 Accept: */* key:b

Slide 357

Slide 357 text

Header-based invalidation

Slide 358

Slide 358 text

Header-based invalidation If-Modified-Since: Tue, 14 Jun 2016 11:49:18 GMT Last-Modified: Tue, 14 Jun 2016 11:49:32 GMT Cache-Control: max-age=10 HTTP 200: OK HTTP 304: Not modified

Slide 359

Slide 359 text

Header-based invalidation If-None-Match: 57601698ae1e2 Etag: 57601698ae1e2 Cache-Control: max-age=10 HTTP 200: OK HTTP 304: Not modified

Slide 360

Slide 360 text

Grace mode

Slide 361

Slide 361 text

beresp.grace Keep servering stale object while fetching data from backend Avoid excessive request queueing

Slide 362

Slide 362 text

sub vcl_backend_response { set beresp.grace = 2h; } Grace

Slide 363

Slide 363 text

Cache-Control: public, max-age=100, s-maxage=3600, stale-while-revalidate=7200 Stale-While-Revalidate

Slide 364

Slide 364 text

sub vcl_backend_response { set beresp.grace = 6h; } Grace mode Monitoring & logging

Slide 365

Slide 365 text

Varnishstat Realtime statistics

Slide 366

Slide 366 text

No content

Slide 367

Slide 367 text

usage: varnishstat [-1lV] [-f field] [-t seconds|] [-n varnish_name] [-N filename] -1 # Print the statistics to stdout. -f field # Field inclusion glob # If it starts with '^' it is used as an exclusion list. -l # Lists the available fields to use with the -f option. -n varnish_name # The varnishd instance to get logs from. -N filename # Filename of a stale VSM instance. -t seconds| # Timeout before returning error on initial VSM connection. -V # Display the version number and exit. -x # Print statistics to stdout as XML. -j # Print statistics to stdout as JSON. Varnishstat usage

Slide 368

Slide 368 text

~# varnishstat -f MAIN.cache_hit -1 MAIN.cache_hit 13049135 5.39 Cache hits Varnishstat usage ~# varnishstat -f MAIN.cache_hit -j -1 { "timestamp": "2016-06-14T16:10:32", "MAIN.cache_hit": { "description": "Cache hits", "type": "MAIN", "flag": "c", "format": "i", "value": 13050992 } }

Slide 369

Slide 369 text

Varnishstat usage ~# varnishstat -f MAIN.n_object -f MAIN.n_lru_nuked -j { "timestamp": "2016-06-14T16:14:49", "MAIN.n_object": { "description": "object structs made", "type": "MAIN", "flag": "g", "format": "i", "value": 46295 }, "MAIN.n_lru_nuked": { "description": "Number of LRU nuked objects", "type": "MAIN", "flag": "g", "format": "i", "value": 0 } }

Slide 370

Slide 370 text

varnishstat -f MAIN.cache*

Slide 371

Slide 371 text

✓ Session ✓ Client ✓ Uptime ✓ Hit/miss ✓ Backend ✓ Fetch ✓ Threading ✓ Cache objects ✓ Memory ✓ Invalidation Varnishstat counters

Slide 372

Slide 372 text

VSL

Slide 373

Slide 373 text

Varnish Shared memory Logging

Slide 374

Slide 374 text

✓ In-memory logs ✓ Generated by varnishd ✓ 81 MB by default ✓ Customize with “-l” setting ✓ Varnishlog command ✓ Varnishtop command VSL

Slide 375

Slide 375 text

* << Request >> 10973258 - Begin req 10973257 rxreq - Timestamp Start: 1501507281.942533 0.000000 0.000000 - Timestamp Req: 1501507281.942533 0.000000 0.000000 - ReqStart 127.0.0.1 59753 - ReqMethod GET - ReqURL / - ReqProtocol HTTP/1.1 - ReqHeader Host: feryn.eu

Slide 376

Slide 376 text

Transactions

Slide 377

Slide 377 text

✓ Items of work ✓ Identified by VXID ✓ 2 kinds: ✓ Sessions ✓ Requests Transactions

Slide 378

Slide 378 text

✓ Identifies TCP connection ✓ Contains multiple requests Transactions ✓ Client request ✓ Backend request ✓ ESI subrequest Session Request

Slide 379

Slide 379 text

No content

Slide 380

Slide 380 text

✓ VXID (default) ✓ Session ✓ Request ✓ Raw Transactions grouping

Slide 381

Slide 381 text

Example composition that will be monitored

Slide 382

Slide 382 text

varnishlog -i Begin,ReqUrl,Link,BereqURL

Slide 383

Slide 383 text

* << BeReq >> 98318 - Begin bereq 98317 fetch - BereqURL / * << BeReq >> 98320 - Begin bereq 98319 fetch - BereqURL /header * << Request >> 98319 - Begin req 98317 esi - ReqURL /header - Link bereq 98320 fetch * << BeReq >> 98322 - Begin bereq 98321 fetch - BereqURL /nav * << Request >> 98321 - Begin req 98317 esi - ReqURL /nav - Link bereq 98322 fetch * << Request >> 98317 - Begin req 98316 rxreq - ReqURL / - Link bereq 98318 fetch - Link req 98319 esi - Link req 98321 esi * << BeReq >> 98324 - Begin bereq 98323 fetch - BereqURL /footer * << Request >> 98323 - Begin req 98316 rxreq - ReqURL /footer - Link bereq 98324 fetch * << Session >> 98316 - Begin sess 0 HTTP/1 - Link req 98317 rxreq - Link req 98323 rxreq

Slide 384

Slide 384 text

varnishlog -i Begin,ReqUrl,Link,BereqURL -g session

Slide 385

Slide 385 text

* << Session >> 14 - Begin sess 0 HTTP/1 - Link req 65539 rxreq - Link req 65545 rxreq ** << Request >> 65539 -- Begin req 14 rxreq -- ReqURL / -- Link bereq 65540 fetch -- Link req 65541 esi -- Link req 65543 esi ** << Request >> 65545 -- Begin req 14 rxreq -- ReqURL /footer -- Link bereq 65546 fetch *** << BeReq >> 65540 --- Begin bereq 65539 fetch --- BereqURL / *** << Request >> 65541 --- Begin req 65539 esi --- ReqURL /header --- Link bereq 65542 fetch *** << Request >> 65543 --- Begin req 65539 esi --- ReqURL /nav --- Link bereq 65544 fetch *** << BeReq >> 65546 --- Begin bereq 65545 fetch --- BereqURL /footer **** << BeReq >> 65542 ---- Begin bereq 65541 fetch ---- BereqURL /header **** << BeReq >> 65544 ---- Begin bereq 65543 fetch ---- BereqURL /nav

Slide 386

Slide 386 text

No content

Slide 387

Slide 387 text

Slide 388

Slide 388 text

Request tags

Slide 389

Slide 389 text

✓ ReqMethod ✓ ReqUrl ✓ ReqProtocol ✓ ReqHeader Request tags

Slide 390

Slide 390 text

- ReqStart 127.0.0.1 56312 - ReqMethod GET - ReqURL / - ReqProtocol HTTP/1.1 - ReqHeader Host: localhost - ReqHeader Connection: keep-alive - ReqHeader Upgrade-Insecure-Requests: 1 - ReqHeader User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 59.0.3071.115 Safari/537.36 - ReqHeader Accept: text/html,application/xhtml+xml,application/ xml;q=0.9,image/webp,image/apng,*/*;q=0.8 - ReqHeader Accept-Encoding: gzip, deflate, br - ReqHeader Accept-Language: nl,en-US;q=0.8,en;q=0.6 - ReqHeader X-Forwarded-For: 127.0.0.1

Slide 391

Slide 391 text

Response tags

Slide 392

Slide 392 text

✓ RespProtocol ✓ RespStatus ✓ RespReason ✓ RespHeader Response tags

Slide 393

Slide 393 text

- RespProtocol HTTP/1.1 - RespStatus 200 - RespReason OK - RespHeader Host: localhost - RespHeader Cache-Control: public, s-maxage=500 - RespHeader Date: Tue, 01 Aug 2017 08:56:44 GMT - RespHeader ETag: "c5afddc587599a72d467caca23e980bf" - RespHeader Vary: Accept-Language - RespHeader Content-Length: 3098 - RespHeader Content-Type: text/html; charset=UTF-8 - RespHeader X-Varnish: 32770 - RespHeader Age: 10

Slide 394

Slide 394 text

Backend tags

Slide 395

Slide 395 text

- BackendOpen 19 boot.default 127.0.0.1 8080 127.0.0.1 62552 - BackendClose 19 boot.default

Slide 396

Slide 396 text

Backend request tags

Slide 397

Slide 397 text

✓ BereqMethod ✓ BereqUrl ✓ BereqProtocol ✓ BereqHeader Backend request tags

Slide 398

Slide 398 text

Backend response tags

Slide 399

Slide 399 text

✓ BerespProtocol ✓ BerespStatus ✓ BerespReason ✓ BerespHeader Backens response tags

Slide 400

Slide 400 text

Object tags

Slide 401

Slide 401 text

✓ ObjProtocol ✓ ObjStatus ✓ ObjReason ✓ ObjHeader Object tags

Slide 402

Slide 402 text

VCL tags

Slide 403

Slide 403 text

✓ VCL_Call ✓ VCL_Return ✓ VCL_Error ✓ VCL_Log ✓ VCL_Acl VCL tags

Slide 404

Slide 404 text

* << Request >> 5 - ReqURL / - VCL_call RECV - VCL_return hash - VCL_call HASH - VCL_return lookup - VCL_call MISS - VCL_return fetch - VCL_call DELIVER - VCL_return deliver ** << BeReq >> 6 -- BereqURL / -- VCL_call BACKEND_FETCH -- VCL_return fetch -- VCL_call BACKEND_RESPONSE -- VCL_return deliver

Slide 405

Slide 405 text

* << Request >> 6 - ReqURL / - VCL_call RECV - ReqURL / - VCL_return hash - VCL_call HASH - VCL_return lookup - VCL_call HIT - VCL_return deliver - VCL_call DELIVER - VCL_return deliver

Slide 406

Slide 406 text

* << Request >> 32789 - ReqURL /header - ExpBan 98355 banned lookup ExpBan tag

Slide 407

Slide 407 text

* << Request >> 98369 - ReqURL /footer - Hit 65597 Hit tag varnishlog -i "ReqUrl,Hit"

Slide 408

Slide 408 text

** << Request >> 6 -- ReqURL /footer -- HitPass 3 HitPass tag

Slide 409

Slide 409 text

TTL tag

Slide 410

Slide 410 text

Slide 411

Slide 411 text

-- TTL VCL 120 10 0 1501597242 ✓ TTL decided by the VCL ✓ 120 seconds cached ✓ 10 seconds grace time ✓ 0 seconds keep time ✓ Reference time: 1501597242  (2017-08-01 14:20:42)

Slide 412

Slide 412 text

-- RFC 500 10 -1 1501598872 1501598872 1501598872 0 500 ✓ 500 seconds TTL (via headers) ✓ 10 seconds grace ✓ No keep value ✓ 2017-08-01 14:47:52 date, age & reference time ✓ Cache-control headers sets 500 second TTL

Slide 413

Slide 413 text

-- RFC 500 10 -1 1501598872 1501598869 1501598872 0 500 ✓ Don’t screw with the age header ✓ Only 497 second effective TTL ✓ Custom Age header (3 seconds off)

Slide 414

Slide 414 text

Begin tag

Slide 415

Slide 415 text

- Begin bereq 98317 fetch - Begin req 98317 esi - Begin req 98316 rxreq - Begin sess 0 HTTP/1

Slide 416

Slide 416 text

Link tag

Slide 417

Slide 417 text

- Link bereq 98312 fetch - Link req 98311 rxreq - Link req 98318 esi

Slide 418

Slide 418 text

Timestamp tag

Slide 419

Slide 419 text

Slide 420

Slide 420 text

* << Request >> 65539 - Timestamp Start: 1501601912.758662 0.000000 0.000000 - Timestamp Req: 1501601912.758662 0.000000 0.000000 - Timestamp Fetch: 1501601912.806733 0.048071 0.048071 - Timestamp Process: 1501601912.806750 0.048088 0.000017 - Timestamp Resp: 1501601912.806787 0.048125 0.000037 ** << BeReq >> 65540 -- Timestamp Start: 1501601912.758753 0.000000 0.000000 -- Timestamp Bereq: 1501601912.758952 0.000199 0.000199 -- Timestamp Beresp: 1501601912.806677 0.047924 0.047725 -- Timestamp BerespBody: 1501601912.806749 0.047996 0.000072

Slide 421

Slide 421 text

Filtering output

Slide 422

Slide 422 text

✓ -i: include tags ✓ -I: include tags by regex ✓ -x: exclude tags ✓ -X: exclude by regex Filtering output

Slide 423

Slide 423 text

Include tags

Slide 424

Slide 424 text

varnishlog -i ReqUrl,VCL_call,VCL_return -g session varnishlog -i "ReqUrl,VCL_*" -g session

Slide 425

Slide 425 text

* << Session >> 252394 ** << Request >> 252395 -- ReqURL / -- VCL_call RECV -- VCL_return hash -- VCL_call HASH -- VCL_return lookup -- VCL_call HIT -- VCL_return deliver -- VCL_call DELIVER -- VCL_return deliver *** << Request >> 252397 --- ReqURL /header --- VCL_call RECV --- VCL_return hash --- VCL_call HASH --- VCL_return lookup --- VCL_call HIT --- VCL_return deliver --- VCL_call DELIVER --- VCL_return deliver *** << Request >> 252399 --- ReqURL /nav --- VCL_call RECV --- VCL_return hash --- VCL_call HASH --- VCL_return lookup --- VCL_call HIT --- VCL_return deliver --- VCL_call DELIVER --- VCL_return deliver *** << BeReq >> 252396 --- VCL_call BACKEND_FETCH --- VCL_return fetch --- VCL_call BACKEND_RESPONSE --- VCL_return deliver **** << BeReq >> 252398 ---- VCL_call BACKEND_FETCH ---- VCL_return fetch ---- VCL_call BACKEND_RESPONSE ---- VCL_return deliver **** << BeReq >> 252400 ---- VCL_call BACKEND_FETCH ---- VCL_return fetch ---- VCL_call BACKEND_RESPONSE ---- VCL_return deliver

Slide 426

Slide 426 text

Exclude tags

Slide 427

Slide 427 text

varnishlog -i "Req*" -x ReqHeader,ReqUnset

Slide 428

Slide 428 text

* << Request >> 314125 - ReqStart 127.0.0.1 64585 - ReqMethod GET - ReqURL / - ReqProtocol HTTP/1.1 - ReqAcct 476 0 476 311 0 311 * << Request >> 314126 - ReqStart 127.0.0.1 64585 - ReqMethod GET - ReqURL /footer - ReqProtocol HTTP/1.1 - ReqAcct 370 0 370 309 0 309

Slide 429

Slide 429 text

Include tags by regex

Slide 430

Slide 430 text

varnishlog -I "reqheader:Accept-Language" -i requrl

Slide 431

Slide 431 text

* << Request >> 374378 - ReqURL / - ReqHeader Accept-Language: nl,en-US;q=0.8,en;q=0.6 * << Request >> 374379 - ReqURL /footer - ReqHeader Accept-Language: nl,en-US;q=0.8,en;q=0.6

Slide 432

Slide 432 text

Exclude tags by regex

Slide 433

Slide 433 text

* << Request >> 374384 - ReqURL /footer - RespHeader Host: localhost - RespHeader X-Powered-By: PHP/7.0.15 - RespHeader Cache-Control: public, s-maxage=500 - RespHeader Date: Wed, 02 Aug 2017 11:27:21 GMT - RespHeader ETag: "d47ac09f5351f8f4c97c99ef5b3d2ecd" - RespHeader Vary: Accept-Language - RespHeader Content-Length: 80 - RespHeader Content-Type: text/html; charset=UTF-8 - RespHeader X-Varnish: 374384 15367 - RespHeader Age: 334 - RespHeader Via: 1.1 varnish-v4 - RespHeader Connection: keep-alive

Slide 434

Slide 434 text

varnishlog -i RespHeader,ReqUrl -X "RespHeader:(x|X)-"

Slide 435

Slide 435 text

* << Request >> 374384 - ReqURL /footer - RespHeader Host: localhost - RespHeader Cache-Control: public, s-maxage=500 - RespHeader Date: Wed, 02 Aug 2017 11:27:21 GMT - RespHeader ETag: "d47ac09f5351f8f4c97c99ef5b3d2ecd" - RespHeader Vary: Accept-Language - RespHeader Content-Length: 80 - RespHeader Content-Type: text/html; charset=UTF-8 - RespHeader Age: 334 - RespHeader Via: 1.1 varnish-v4 - RespHeader Connection: keep-alive

Slide 436

Slide 436 text

All-in-one

Slide 437

Slide 437 text

varnishlog -i "RespHeader,Req*" -X "RespHeader:(x|X)-" -I "timestamp:Resp" -x reqprotocol,reqacct -g request

Slide 438

Slide 438 text

* << Request >> 59383 - ReqStart 127.0.0.1 53195 - ReqMethod GET - ReqURL / - ReqHeader Host: localhost - ReqHeader Connection: keep-alive - ReqHeader Cache-Control: max-age=0 - ReqHeader Upgrade-Insecure-Requests: 1 - ReqHeader User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 - ReqHeader Accept: text/ html,application/ xhtml+xml,application/xml;q=0.9,image/ webp,image/apng,*/*;q=0.8 - ReqHeader Accept-Encoding: gzip, deflate, br - ReqHeader Accept-Language: nl,en- US;q=0.8,en;q=0.6 - ReqHeader If-None-Match: W/"27f341f8e459dd35f1087c55351cacda" - ReqHeader X-Forwarded-For: 127.0.0.1 - ReqUnset Accept-Language: nl,en- US;q=0.8,en;q=0.6 - ReqHeader accept-language: nl - ReqHeader Surrogate-Capability: key=ESI/1.0 - ReqUnset Accept-Encoding: gzip, deflate, br - ReqHeader Accept-Encoding: gzip - RespHeader Host: localhost - RespHeader Cache-Control: public, s- maxage=500 - RespHeader Date: Wed, 02 Aug 2017 11:46:49 GMT - RespHeader ETag: "27f341f8e459dd35f1087c55351cacda" - RespHeader Vary: Accept-Language - RespHeader Content-Length: 3098 - RespHeader Content-Type: text/html; charset=UTF-8 - RespHeader Age: 152 - RespHeader Via: 1.1 varnish-v4 - RespHeader ETag: W/"27f341f8e459dd35f1087c55351cacda" - RespHeader Connection: keep-alive - Timestamp Resp: 1501674561.472358 0.000068 0.000020

Slide 439

Slide 439 text

✓ All response headers ✓ All tags that start with “Req” ✓ Exclude “x-“ response headers ✓ Include “response time” timestamp ✓ Exclude request protocol log lines, and the request accountancy log lines All-in-one

Slide 440

Slide 440 text

VSL queries

Slide 441

Slide 441 text

Filtering fields from all transactions Filtering transactions

Slide 442

Slide 442 text

{level}taglist:record-prefix[field]

Slide 443

Slide 443 text

ReqUrl eq ‘/‘ {level}taglist:record-prefix[field]

Slide 444

Slide 444 text

Timestamp:Resp[2] > 1.0 {level}taglist:record-prefix[field]

Slide 445

Slide 445 text

{2}Timestamp:Resp[2] > 1.0 {level}taglist:record-prefix[field]

Slide 446

Slide 446 text

varnishlog -i VCL_call,VCL_return -g request -q "ReqURL eq '/'"

Slide 447

Slide 447 text

* << Request >> 374400 - VCL_call RECV - VCL_return hash - VCL_call HASH - VCL_return lookup - VCL_call HIT - VCL_return deliver - VCL_call DELIVER - VCL_return deliver

Slide 448

Slide 448 text

varnishlog -i ReqUrl -q "VCL_call eq 'MISS' or VCL_call eq 'PASS'" varnishlog -i ReqUrl -I "Timestamp:Resp" -q "Timestamp:Resp[2] > 1.0"

Slide 449

Slide 449 text

Other options

Slide 450

Slide 450 text

varnishlog -n myVarnishInstance varnishlog -d varnishlog -w file varnishlog -r file varnishlog -A -a -w file varnishlog -i "ReqUrl,VCL_*" -D -a -A -w /var/log/varnish/custom.log - P /var/run/custom_varnishlog.pid

Slide 451

Slide 451 text

Varnishtop

Slide 452

Slide 452 text

Same syntax as varnishlog. Output is incremental

Slide 453

Slide 453 text

$ varnishtop -I reqheader:Accept-Language -q "ReqUrl eq '/'" list length 4 0.86 ReqHeader Accept-Language: en-US 0.80 ReqHeader Accept-Language: nl-NL,nl;q=0.8,en- US;q=0.6,en;q=0.4 0.54 ReqHeader Accept-Language: nl,en-US;q=0.8,en;q=0.6 0.39 ReqHeader Accept-Language: nl-BE

Slide 454

Slide 454 text

Common Varnishlog scenarios

Slide 455

Slide 455 text

Why didn’t Varnish serve this request from cache?

Slide 456

Slide 456 text

Request not cacheable

Slide 457

Slide 457 text

varnishlog -i "Req*,VCL*" -x ReqAcct,ReqStart -q "VCL_call eq 'PASS'"

Slide 458

Slide 458 text

* << Request >> 12 - ReqMethod GET - ReqURL / - ReqProtocol HTTP/1.1 - ReqHeader Host: localhost - ReqHeader User-Agent: curl/7.48.0 - ReqHeader Accept: */* - ReqHeader Cookie: myCookie=bla - ReqHeader X-Forwarded-For: 127.0.0.1 - VCL_call RECV - VCL_return pass - VCL_call HASH - VCL_return lookup - VCL_call PASS - VCL_return fetch - VCL_call DELIVER - VCL_return deliver

Slide 459

Slide 459 text

<< Request >> 32779 - ReqMethod POST - ReqURL / - ReqProtocol HTTP/1.1 - ReqHeader Host: localhost - ReqHeader User-Agent: curl/7.48.0 - ReqHeader Accept: */* - ReqHeader X-Forwarded-For: 127.0.0.1 - VCL_call RECV - VCL_return pass - VCL_call HASH - VCL_return lookup - VCL_call PASS - VCL_return fetch - VCL_call DELIVER - VCL_return deliver

Slide 460

Slide 460 text

* << Request >> 15 - ReqMethod GET - ReqURL / - ReqProtocol HTTP/1.1 - ReqHeader Host: localhost - ReqHeader Authorization: Basic dGhpanM6ZmVyeW4= - ReqHeader User-Agent: curl/7.48.0 - ReqHeader Accept: */* - ReqHeader X-Forwarded-For: 127.0.0.1 - VCL_call RECV - VCL_return pass - VCL_call HASH - VCL_return lookup - VCL_call PASS - VCL_return fetch - VCL_call DELIVER - VCL_return deliver

Slide 461

Slide 461 text

Response not cacheable

Slide 462

Slide 462 text

varnishlog -i ReqUrl,VCL_*,Beresp*,TTL -q "HitPass" -g request

Slide 463

Slide 463 text

* << Request >> 19010384 - ReqURL /my-url - VCL_call RECV - VCL_return hash - VCL_call HASH - VCL_return lookup - VCL_call PASS - VCL_return fetch - VCL_call DELIVER - VCL_return deliver ** << BeReq >> 19010385 -- VCL_call BACKEND_FETCH -- VCL_return fetch -- BerespProtocol HTTP/1.1 -- BerespStatus 200 -- BerespReason OK -- BerespHeader Date: Thu, 03 Aug 2017 08:15:22 GMT -- BerespHeader Server: Apache/ 2.4.10 (Debian) -- BerespHeader Last-Modified: Tue, 01 Aug 2017 07:21:00 GMT -- BerespHeader ETag: "5c0d-555abfd3f422f-gzip" -- BerespHeader Vary: Accept- Encoding -- BerespHeader Content-Encoding: gzip -- BerespHeader Cache-Control: maxage=0 -- BerespHeader Expires: Thu, 03 Aug 2017 08:15:22 GMT -- BerespHeader Content-Length: 7686 -- BerespHeader Content-Type: application/json -- TTL RFC 0 10 -1 1501748123 1501748123 1501748122 1501748122 0 -- VCL_call BACKEND_RESPONSE -- TTL VCL 120 10 0 1501748123 -- VCL_return deliver

Slide 464

Slide 464 text

* << Request >> 65551 - ReqURL /set-cookie - VCL_call RECV - VCL_return hash - VCL_call HASH - VCL_return lookup - VCL_call PASS - VCL_return fetch - VCL_call DELIVER - VCL_return deliver ** << BeReq >> 65552 -- VCL_call BACKEND_FETCH -- VCL_return fetch -- BerespProtocol HTTP/1.1 -- BerespStatus 200 -- BerespReason OK -- BerespHeader Cache-control: s-maxage=10 -- BerespHeader Set-Cookie: myCookie=bla -- BerespHeader Content-type: text/html; charset=UTF-8 -- BerespHeader Date: Thu, 03 Aug 2017 08:39:04 GMT -- TTL RFC 10 10 -1 1501749545 1501749545 1501749544 0 10 -- VCL_call BACKEND_RESPONSE -- TTL VCL 120 10 0 1501749545 -- VCL_return deliver

Slide 465

Slide 465 text

Authentication

Slide 466

Slide 466 text

Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l

Slide 467

Slide 467 text

PHPSESSID: laken37oumlkrndoo91k3trlv5

Slide 468

Slide 468 text

Slide 469

Slide 469 text

No content

Slide 470

Slide 470 text

What if we could create cache variations for logged-in users?

Slide 471

Slide 471 text

How do you identify a logged-in user without accessing the backend every time?

Slide 472

Slide 472 text

Push session information from the server to the client

Slide 473

Slide 473 text

JSON Web Tokens

Slide 474

Slide 474 text

Marco Pivetta introduced me to JWT https://twitter.com/ocramius

Slide 475

Slide 475 text

JWT eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOi JodHRwOlwvXC9sb2NhbGhvc3RcLyIsImlhdCI6MTUwODc0N zM2MywiZXhwIjoxNTA4NzUwOTYzLCJ1aWQiOjEsInVzZXJu YW1lIjoiVGhpanMifQ.EPemqBaH74Sbs0bZqAaR8i7uVYO3 89VOlJvWC3ocL7g ✓3 parts ✓Dot separated ✓Base64 encoded JSON ✓Header ✓Payload ✓Signature (HMAC with secret)

Slide 476

Slide 476 text

eyJpc3MiOiJodHRwOlwvXC 9sb2NhbGhvc3RcLyIsImlh dCI6MTUwODc0NzM2MywiZX hwIjoxNTA4NzUwOTYzLCJ1 aWQiOjEsInVzZXJuYW1lIj oiVGhpanMifQ { "alg": "HS256", "typ": "JWT" } { "iss": "http://localhost/", "iat": 1508746861, "exp": 1508750461, "uid": 1, "username": "Thijs" } HMACSHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload), secret ) eyJ0eXAiOiJKV1QiLCJhb GciOiJIUzI1NiJ9 EPemqBaH74Sbs0bZqAaR8i 7uVYO389VOlJvWC3ocL7g

Slide 477

Slide 477 text

https://jwt.io

Slide 478

Slide 478 text

No content

Slide 479

Slide 479 text

JWT Cookie:jwt_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9. eyJpc3MiOiJodHRwOlwvXC9sb2NhbGhvc3RcLyIsImlhdCI6MTUwOD c0NzM2MywiZXhwIjoxNTA4NzUwOTYzLCJ1aWQiOjEsInVzZXJuYW1l IjoiVGhpanMifQ.EPemqBaH74Sbs0bZqAaR8i7uVYO389VOlJvWC3o cL7g ✓Stored in a cookie ✓Can be validated by Varnish ✓Payload can be processed by any language (e.g. Javascript)

Slide 480

Slide 480 text

Application creates JWT alongside the regular session

Slide 481

Slide 481 text

Template loads stateful data from JWT in Javascript

Slide 482

Slide 482 text

{ "iss": "http://localhost/", "iat": 1508746861, "exp": 1508750461, "uid": 1, "username": "Thijs" } Issuer

Slide 483

Slide 483 text

{ "iss": "http://localhost/", "iat": 1508746861, "exp": 1508750461, "uid": 1, "username": "Thijs" } Issued at

Slide 484

Slide 484 text

{ "iss": "http://localhost/", "iat": 1508746861, "exp": 1508750461, "uid": 1, "username": "Thijs" } Expires at

Slide 485

Slide 485 text

{ "iss": "http://localhost/", "iat": 1508746861, "exp": 1508750461, "uid": 1, "username": "Thijs" } User ID

Slide 486

Slide 486 text

{ "iss": "http://localhost/", "iat": 1508746861, "exp": 1508750461, "uid": 1, "username": "Thijs" } Username

Slide 487

Slide 487 text

{ "iss": "http://localhost/", "iat": 1508746861, "exp": 1508750461, "uid": 1, "username": "Thijs" } Let Javascript parse this one

Slide 488

Slide 488 text

User Varnish Server Issues JWT Validates JWT Reads JWT Knows secret key Knows secret key Does not know secret key

Slide 489

Slide 489 text

Using vmod_digest for HMAC & base64

Slide 490

Slide 490 text

vcl 4.0; import std; import var; import cookie; import digest; backend default { .host = "nginx"; .port = "80"; } sub vcl_recv { if (req.http.Cookie) { cookie.parse(req.http.cookie); cookie.filter_except("jwt_cookie"); set req.http.cookie = cookie.get_string(); if (req.http.Cookie ~ "^\s*$") { unset req.http.Cookie; } } if ((req.method != "GET" && req.method != "HEAD") || req.http.Authorization) { return (pass); } call jwt; return(hash); }

Slide 491

Slide 491 text

Slide 492

Slide 492 text

Slide 493

Slide 493 text

Slide 494

Slide 494 text

Slide 495

Slide 495 text

sub vcl_synth { #301 & 302 synths should be actual redirects if (resp.status == 301 || resp.status == 302) { set resp.http.location = resp.reason; set resp.reason = "Moved"; return (deliver); } }

Slide 496

Slide 496 text

sub jwt { var.set("key",std.fileread("/etc/varnish/jwt.key")); std.log("Ready to perform some JWT magic"); if(cookie.isset("jwt_cookie")) { var.set("token", cookie.get("jwt_cookie")); var.set("header", regsub(var.get("token"),"([^\.]+)\.[^\.]+\.[^\.]+","\1")); var.set("type", regsub(digest.base64url_decode(var.get("header")),{"^.*?"typ"\s*: \s*"(\w+)".*?$"},"\1")); var.set("algorithm", regsub(digest.base64url_decode(var.get("header")), {"^.*?"alg"\s*:\s*"(\w+)".*?$"},"\1")); if(var.get("type") == "JWT" && var.get("algorithm") == "HS256") { var.set("rawPayload",regsub(var.get("token"),"[^\.]+\.([^\.]+)\.[^\.]+$","\1")); var.set("signature",regsub(var.get("token"),"^[^\.]+\.[^\.]+\.([^\.]+)$","\1")); var.set("currentSignature",digest.base64url_nopad_hex(digest.hmac_sha256(var.get("key"), var.get("header") + "." + var.get("rawPayload")))); var.set("payload", digest.base64url_decode(var.get("rawPayload"))); var.set("exp",regsub(var.get("payload"),{"^.*?"exp"\s*:\s*([0-9]+).*?$"},"\1")); var.set("userId",regsub(var.get("payload"),{"^.*?"uid"\s*:\s*([0-9]+).*? $"},"\1")); if(var.get("userId") ~ "^\d+$") { if(std.time(var.get("exp"),now) >= now) { if(var.get("signature") == var.get("currentSignature")) { set req.http.X-Login="true"; } else { std.log("JWT: signature doesn't match. Received: " + var.get("signature") + ", expected: " + var.get("currentSignature"));

Slide 497

Slide 497 text

Slide 498

Slide 498 text

var.set("header", regsub(var.get("token"),"([^\.]+)\.[^\.]+\.[^\.]+","\1")); First chunk contains the header

Slide 499

Slide 499 text

var.set("type", regsub(digest.base64url_decode(var.get("header")), {"^.*?"typ"\s*:\s*"(\w+)".*?$"},"\1")); Get type field from header

Slide 500

Slide 500 text

var.set("algorithm", regsub(digest.base64url_decode(var.get("header")), {"^.*?"alg"\s*:\s*"(\w+)".*?$"},"\1")); Get algorithm field from header

Slide 501

Slide 501 text

Slide 502

Slide 502 text

var.set(“rawPayload",regsub(var.get("token"),"[^\.]+\.([^\.]+)\.[^\.]+ $","\1")); var.set("payload", digest.base64url_decode(var.get("rawPayload"))); Second chunk contains the raw payload Base64 decode to get JSON payload

Slide 503

Slide 503 text

var.set("signature",regsub(var.get("token"),"^[^\.]+\.[^\.]+\.([^\.]+) $","\1")); var.set("currentSignature",digest.base64url_nopad_hex(digest.hmac_sha256(var .get("key"),var.get("header") + "." + var.get("rawPayload")))); Third chunk contains the raw signature Build signature using key, header & payload

Slide 504

Slide 504 text

var.set("exp",regsub(var.get("payload"),{"^.*?"exp"\s*:\s*([0-9]+).*? $"},"\1")); var.set("userId",regsub(var.get("payload"),{"^.*?"uid"\s*:\s*([0-9]+).*? $"},"\1")); Extract expiration time from JSON payload Extract user ID from JSON payload

Slide 505

Slide 505 text

var.get("header") + "." + var.get("rawPayload")))); var.set("payload", digest.base64url_decode(var.get("rawPayload"))); var.set("exp",regsub(var.get("payload"),{"^.*?"exp"\s*:\s*([0-9]+).*?$"},"\1")); var.set("userId",regsub(var.get("payload"),{"^.*?"uid"\s*:\s*([0-9]+).*? $"},"\1")); if(var.get("userId") ~ "^\d+$") { if(std.time(var.get("exp"),now) >= now) { if(var.get("signature") == var.get("currentSignature")) { set req.http.X-Login="true"; } else { std.log("JWT: signature doesn't match. Received: " + var.get("signature") + ", expected: " + var.get("currentSignature")); } } else { std.log("JWT: token has expired"); } } else { std.log("UserId '"+ var.get("userId") +"', is not numeric"); } } else { std.log("JWT: type is not JWT or algorithm is not HS256"); } std.log("JWT processing finished. UserId: " + var.get("userId") + ". X-Login: " + req.http.X-login); } if(req.url ~ "^/(\?[^\?]+)?$" && req.http.X-Login != "true") { return(synth(302,"/post.php")); } }

Slide 506

Slide 506 text

Slide 507

Slide 507 text

Cache variations

Slide 508

Slide 508 text

Vary: X-Login Vary header sent by application X-Login header set by Varnish Creates cache variations in Varnish

Slide 509

Slide 509 text

Write cacheable applications

Slide 510

Slide 510 text

✓ Cache-control ✓ Content negotiation ✓ Cache variations ✓ Conditional requests ✓ Content composition ✓ JWT authentication Checklist

Slide 511

Slide 511 text

Let’s build a cacheable Symfony app

Slide 512

Slide 512 text

No content

Slide 513

Slide 513 text

https://feryn.eu https://twitter.com/ThijsFeryn https://instagram.com/ThijsFeryn

Slide 514

Slide 514 text

No content