Slide 1
Slide 1 text
Common
scenarios
in VCL
By Thijs Feryn
Slide 2
Slide 2 text
Hi, I’m Thijs
Slide 3
Slide 3 text
I’m
@ThijsFeryn
on Twitter
Slide 4
Slide 4 text
I’m an
Evangelist
At
Slide 5
Slide 5 text
I’m a
at
board member
Slide 6
Slide 6 text
149 th
talk
Slide 7
Slide 7 text
This is my first
time
in København
Slide 8
Slide 8 text
Slow websites suck
Slide 9
Slide 9 text
Varnish
Slide 10
Slide 10 text
Better end-user experience
Slide 11
Slide 11 text
Easy peasy
right?
Slide 12
Slide 12 text
Not
really
Slide 13
Slide 13 text
There are rules
Slide 14
Slide 14 text
✓Only GET & HEAD
✓No authorization headers
✓No cookies
✓No set-cookies
✓Valid cache-control/expires
headers
When does Varnish
cache? Some rules …
Slide 15
Slide 15 text
It’s all
about
state
Slide 16
Slide 16 text
Lots of
developers
don’t follow
those rules
Slide 17
Slide 17 text
Cookies
everywhere
Slide 18
Slide 18 text
Cache-control quoi?
Slide 19
Slide 19 text
Out of the box
These are the main reasons
why Varnish will not work
Slide 20
Slide 20 text
Write VCL
Slide 21
Slide 21 text
Varnish
Configuration
Language
Slide 22
Slide 22 text
Programming
the
Varnish
behaviour
Slide 23
Slide 23 text
Varnish flow
Slide 24
Slide 24 text
No content
Slide 25
Slide 25 text
Hooks
Slide 26
Slide 26 text
VCL
Recv
VCL
Hash
VCL
Miss
VCL
Hit
VCL
Backend
Response
VCL
Deliver
VCL
Purge
VCL
Error
VCL
Pipe
VCL
Pass
VCL
Synth
VCL
Backend
Error
Slide 27
Slide 27 text
✓vcl_recv: receive request
✓vcl_hash: compose cache key
✓vcl_miss: not found in cache
✓vcl_hit: found in cache
✓vcl_pass: don’t store in cache
✓vcl_pipe: bypass cache
✓vcl_backend_fetch: connect to
backend
✓vcl_backend_response: response
from backend
✓vcl_backend_error: backend fetch
failed
Slide 28
Slide 28 text
✓vcl_purge: after successful purge
✓vcl_synth: send synthetic output
✓vcl_deliver: return data to client
✓vcl_init: initialize VMODs
✓vcl_fini: discard VMODs
Slide 29
Slide 29 text
vcl 4.0;
backend default {
.host = "127.0.0.1";
.port = "8080";
}
Minimal VCL
Slide 30
Slide 30 text
vcl 4.0;
backend default {
.host = "127.0.0.1";
.port = "80";
.max_connections = 300;
.first_byte_timeout = 300s;
.connect_timeout = 5s;
.between_bytes_timeout = 2s;
}
More backend work
Slide 31
Slide 31 text
vcl 4.0;
backend default {
.host = "127.0.0.1";
.port = "80";
.max_connections = 300;
.first_byte_timeout = 300s;
.connect_timeout = 5s;
.between_bytes_timeout = 2s;
.probe = {
.url = "/";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}
Even more backend work
Slide 32
Slide 32 text
vcl 4.0;
backend default {
.host = "127.0.0.1";
.port = "80";
.max_connections = 300;
.first_byte_timeout = 300s;
.connect_timeout = 5s;
.between_bytes_timeout = 2s;
.probe = {
.request =
"HEAD / HTTP/1.1"
"Host: localhost"
"Connection: close"
"User-Agent: Varnish Health Probe";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}
Even more backend work
Slide 33
Slide 33 text
Load balancing
Slide 34
Slide 34 text
vcl 4.0;
import directors;
backend server1 {
.host = “1.2.3.4”;
.port = "80";
.max_connections = 300;
.first_byte_timeout = 300s;
.connect_timeout = 5s;
.between_bytes_timeout = 2s;
.probe = {
.request =
"HEAD / HTTP/1.1"
"Host: localhost"
"Connection: close"
"User-Agent: Varnish Health Probe";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}
Loadbalancing: server 1
Slide 35
Slide 35 text
backend server2 {
.host = “1.2.3.5”;
.port = "80";
.max_connections = 300;
.first_byte_timeout = 300s;
.connect_timeout = 5s;
.between_bytes_timeout = 2s;
.probe = {
.request =
"HEAD / HTTP/1.1"
"Host: localhost"
"Connection: close"
"User-Agent: Varnish Health Probe";
.interval = 5s;
.timeout = 1s;
.window = 5;
.threshold = 3;
}
}
Loadbalancing: server 2
Slide 36
Slide 36 text
sub vcl_init {
new vdir = directors.round_robin();
vdir.add_backend(server1);
vdir.add_backend(server2);
}
sub vcl_recv {
set req.backend_hint = vdir.backend();
}
Loadbalancing: round robin
Slide 37
Slide 37 text
sub vcl_init {
new vdir = directors.random();
vdir.add_backend(server1,2);
vdir.add_backend(server2,3);
}
sub vcl_recv {
set req.backend_hint = vdir.backend();
}
Loadbalancing: random
Slide 38
Slide 38 text
sub vcl_init {
new vdir = directors.fallback();
vdir.add_backend(server1);
vdir.add_backend(server2);
}
sub vcl_recv {
set req.backend_hint = vdir.backend();
}
Loadbalancing: fallback
Slide 39
Slide 39 text
sub vcl_init {
new vdir = directors.hash();
vdir.add_backend(server1);
vdir.add_backend(server2);
}
sub vcl_recv {
set req.backend_hint = vdir.backend(req.url);
}
Loadbalancing: URL hash
Slide 40
Slide 40 text
sub vcl_init {
new vdir = directors.hash();
vdir.add_backend(server1);
vdir.add_backend(server2);
}
sub vcl_recv {
set req.backend_hint = vdir.backend(client.identity);
}
Loadbalancing: IP hash
Slide 41
Slide 41 text
sub vcl_recv {
if(req.url ~ “^/products”) {
set req.backend_hint = server1;
} else {
set req.backend_hint = server2;
}
}
Conditional loadbalacning
Slide 42
Slide 42 text
Normalize
Slide 43
Slide 43 text
vcl 4.0;
import std;
sub vcl_recv {
set req.http.Host = regsub(req.http.Host, ":[0-9]+", "");
set req.url = std.querysort(req.url);
if (req.url ~ "\#") {
set req.url = regsub(req.url, "\#.*$", "");
}
if (req.url ~ "\?$") {
set req.url = regsub(req.url, "\?$", "");
}
if (req.restarts == 0) {
if (req.http.Accept-Encoding) {
if (req.http.User-Agent ~ "MSIE 6") {
unset req.http.Accept-Encoding;
} elsif (req.http.Accept-Encoding ~ "gzip") {
set req.http.Accept-Encoding = "gzip";
} elsif (req.http.Accept-Encoding ~ "deflate") {
set req.http.Accept-Encoding = "deflate";
} else {
unset req.http.Accept-Encoding;
}
}
}
}
Normalize
Slide 44
Slide 44 text
Static assets
Slide 45
Slide 45 text
vcl 4.0;
sub vcl_recv {
if (req.url ~ "^[^?]*\.(7z|avi|bmp|bz2|css|csv|doc|docx|eot|flac|
flv|gif|gz|ico|jpeg|jpg|js|less|mka|mkv|mov|mp3|mp4|mpeg|mpg|odt|otf|
ogg|ogm|opus|pdf|png|ppt|pptx|rar|rtf|svg|svgz|swf|tar|tbz|tgz|ttf|
txt|txz|wav|webm|webp|woff|woff2|xls|xlsx|xml|xz|zip)(\?.*)?$") {
unset req.http.Cookie;
return (hash);
}
}
sub vcl_backend_response {
if (bereq.url ~ "^[^?]*\.(7z|avi|bmp|bz2|css|csv|doc|docx|eot|flac|
flv|gif|gz|ico|jpeg|jpg|js|less|mka|mkv|mov|mp3|mp4|mpeg|mpg|odt|otf|
ogg|ogm|opus|pdf|png|ppt|pptx|rar|rtf|svg|svgz|swf|tar|tbz|tgz|ttf|
txt|txz|wav|webm|webp|woff|woff2|xls|xlsx|xml|xz|zip)(\?.*)?$") {
unset beresp.http.set-cookie;
}
if (bereq.url ~ "^[^?]*\.(7z|avi|bz2|flac|flv|gz|mka|mkv|mov|mp3|mp4|
mpeg|mpg|ogg|ogm|opus|rar|tar|tgz|tbz|txz|wav|webm|xz|zip)(\?.*)?$") {
unset beresp.http.set-cookie;
set beresp.do_stream = true;
set beresp.do_gzip = false;
}
}
Cache static assets
Slide 46
Slide 46 text
Do you really
want to cache
static assets?
Slide 47
Slide 47 text
Nginx or
Apache can
be fast
enough for
that
Slide 48
Slide 48 text
vcl 4.0;
import std;
sub vcl_recv {
if (req.url ~ "^[^?]*\.(7z|avi|bmp|bz2|css|csv|doc|docx|eot|flac|
flv|gif|gz|ico|jpeg|jpg|js|less|mka|mkv|mov|mp3|mp4|mpeg|mpg|odt|otf|
ogg|ogm|opus|pdf|png|ppt|pptx|rar|rtf|svg|svgz|swf|tar|tbz|tgz|ttf|
txt|txz|wav|webm|webp|woff|woff2|xls|xlsx|xml|xz|zip)(\?.*)?$") {
unset req.http.Cookie;
return (pass);
}
}
Don’t cache static assets
Slide 49
Slide 49 text
URL whitelist/blacklist
Slide 50
Slide 50 text
sub vcl_recv {
if (req.url ~ "^/status\.php$" ||
req.url ~ "^/update\.php$" ||
req.url ~ "^/admin$" ||
req.url ~ "^/admin/.*$" ||
req.url ~ "^/user$" ||
req.url ~ "^/user/.*$" ||
req.url ~ "^/flag/.*$" ||
req.url ~ "^.*/ajax/.*$" ||
req.url ~ "^.*/ahah/.*$") {
return (pass);
}
}
URL blacklist
Slide 51
Slide 51 text
sub vcl_recv {
if (req.url ~ "^/products/?"
return (hash);
}
}
URL whitelist
Slide 52
Slide 52 text
Those damn
cookies again!
Slide 53
Slide 53 text
vcl 4.0;
sub vcl_recv {
set req.http.Cookie = regsuball(req.http.Cookie, "has_js=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "__utm.=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "_ga=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "_gat=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "utmctr=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "utmcmd.=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "utmccn.=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "__gads=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "__qc.=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "__atuv.=[^;]+(; )?", "");
set req.http.Cookie = regsuball(req.http.Cookie, "^;\s*", "");
if (req.http.cookie ~ "^\s*$") {
unset req.http.cookie;
}
}
Remove tracking cookies
Slide 54
Slide 54 text
vcl 4.0;
sub vcl_recv {
if (req.http.Cookie) {
set req.http.Cookie = ";" + req.http.Cookie;
set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
set req.http.Cookie = regsuball(req.http.Cookie, ";(PHPSESSID)=", "; \1=");
set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");
if (req.http.cookie ~ "^\s*$") {
unset req.http.cookie;
}
}
}
Only keep session cookie
Slide 55
Slide 55 text
sub vcl_recv {
if (req.http.Cookie) {
set req.http.Cookie = ";" + req.http.Cookie;
set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
set req.http.Cookie = regsuball(req.http.Cookie, ";(language)=", "; \1=");
set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");
if (req.http.cookie ~ "^\s*$") {
unset req.http.cookie;
return(pass);
}
return(hash);
}
}
sub vcl_hash {
hash_data(regsub( req.http.Cookie, "^.*language=([^;]*);*.*$", "\1" ));
}
Language cookie cache variation
Slide 56
Slide 56 text
Alternative
language
cache
variation
Slide 57
Slide 57 text
sub vcl_hash {
hash_data(req.http.Accept-Language);
}
Language cookie cache variation
Or just send a
“Vary:Accept-Language”
header
Slide 58
Slide 58 text
sub vcl_hash {
hash_data(req.http.Cookie);
}
Hash all cookies
Slide 59
Slide 59 text
Edge Side Includes
Slide 60
Slide 60 text
sub vcl_recv {
set req.http.Surrogate-Capability = "key=ESI/1.0";
}
sub vcl_backend_response {
if (beresp.http.Surrogate-Control ~ "ESI/1.0") {
unset beresp.http.Surrogate-Control;
set beresp.do_esi = true;
}
}
Edge Side Includes
Slide 61
Slide 61 text
';
'.PHP_EOL;
echo "Date in the main page: ".date('Y-m-d H:i:s').'
'; Main page ESI frame: esi.php Cached for 10 seconds Not cached
'; Main page ESI frame: esi.php Cached for 10 seconds Not cached
Slide 62
Slide 62 text
ESI_xmlerror No ESI processing, first char
not '<'. (See feature esi_disable_xml_check)
Expects HTML/
XML tags
Slide 63
Slide 63 text
-p feature=+esi_disable_xml_check
Add as
startup option
Slide 64
Slide 64 text
Control
Time
To
Live
Slide 65
Slide 65 text
sub vcl_backend_response {
set beresp.ttl = 3h;
}
Control Time To Live
Slide 66
Slide 66 text
sub vcl_backend_response {
if (beresp.ttl <= 0s || beresp.http.Set-Cookie ||
beresp.http.Vary == "*") {
set beresp.ttl = 120s;
set beresp.uncacheable = true;
return (deliver);
}
}
Control Time To Live
Slide 67
Slide 67 text
Debugging
Slide 68
Slide 68 text
sub vcl_deliver {
if (obj.hits > 0) {
set resp.http.X-Cache = "HIT";
} else {
set resp.http.X-Cache = "MISS";
}
}
Debugging
Slide 69
Slide 69 text
Anonymize
Slide 70
Slide 70 text
sub vcl_deliver {
unset resp.http.X-Powered-By;
unset resp.http.Server;
unset resp.http.X-Drupal-Cache;
unset resp.http.X-Varnish;
unset resp.http.Via;
unset resp.http.Link;
unset resp.http.X-Generator;
}
Anonymize
Slide 71
Slide 71 text
Purging
Slide 72
Slide 72 text
acl purge {
"localhost";
"127.0.0.1";
"::1";
}
sub vcl_recv {
if (req.method == "PURGE") {
if (!client.ip ~ purge) {
return (synth(405, “Not allowed.”));
}
return (purge);
}
}
Purging
Slide 73
Slide 73 text
acl purge {
"localhost";
"127.0.0.1";
"::1";
}
sub vcl_backend_response {
set beresp.http.x-url = bereq.url;
set beresp.http.x-host = bereq.http.host;
}
sub vcl_deliver {
unset resp.http.x-url;
unset resp.http.x-host;
}
sub vcl_recv {
if (req.method == "PURGE") {
if (!client.ip ~ purge) {
return (synth(405, "Not allowed"));
}
if(req.http.x-purge-regex) {
ban("obj.http.x-host == " + req.http.host + " && obj.http.x-url ~ " +
req.http.x-purge-regex);
} else {
ban("obj.http.x-host == " + req.http.host + " && obj.http.x-url == " +
req.url);
}
return (synth(200, "Purged"));
}
}
Banning
Slide 74
Slide 74 text
Banning
curl -XPURGE -H "x-purge-regex:/products"
"http://example.com"
curl -XPURGE "http://example.com/products"
Slide 75
Slide 75 text
Grace mode
Slide 76
Slide 76 text
sub vcl_backend_response {
set beresp.grace = 6h;
}
Grace mode
Slide 77
Slide 77 text
Cheers, hope
this helps!
Slide 78
Slide 78 text
No content