6 ms·

Vinyl Cache and Varnish Cache

54 points by Foxboron 5mo ago

wmf 5mo ago
What's the deal with Antirez and PHK refusing to add TLS support?
- lofaszvanitt 5mo ago
  Varnish Enterprise has https support.
  - perbu 5mo ago
    the whole point of varnish software keeping a public version of "vinyl cache" as "varnish cache" with TLS is to give people a way to access a FOSS version with native TLS. I think TLS is table-stakes now, and has been for the last 10 years, at least.
    - lofaszvanitt 5mo ago
      Terminate tls and you have your cache.
    - time4tea 5mo ago
      just use the tool that does the job. TLS in -> hitch or caddy Cache -> varnish/vinyl TLS out -> haproxy Connect them up with Unix sockets, if you like.
      - slink_vinyl 5mo ago
        because the topic keeps coming up, I now wrote the tutorial which we should have had years ago: https://vinyl-cache.org/tutorials/tls_haproxy.html https://vinyl-cache.org/tutorials/tls_haproxy.html
        time4tea 5mo ago
        Thanks for this. You dont mention hitch though. Is that now deprecated/discouraged? It hasn't seen much action in a while, but maybe thats cos it works?
        perbu 5mo ago
        fwiw; Varnish Software still maintains and supports hitch, but we can't say we see a bright future for it. Both the ergonomics and the performance of not being integrated into Varnish are pretty bad. It was the crutch we leaned as it was the best thing we could make available. I would recommend migrating off within a year or two.
        time4tea 5mo ago
        Thanks for the info, but I'm a bit confused, sorry. The reason for hitch was that tls and caching are a different concern, and the current recommendation is to use haproxy, which also isnt integrated into varnish/vinyl. But you say that the reason to migrate off hitch is that its not integrated? But what happend to separation of concerns, then? Is the plan to integrate tls termination into vinyl? Is this a change of policy/outlook? Thanks!
        perbu 5mo ago
        Varnish Software released hitch to facilitate TLS for varnish-cache. Now that Varnish has been renamed, Varnish Software will keep what has been referred to as a downstream version or a fork, which has TLS built in, basically taking the TLS support from Varnish Enterprise. This makes Hitch a moot point. So, I assume it'll receive security updates, but not much more. Wrt. separation of concerns. Varnish with in-core TLS can push terabits per second (synthetic load, but still). Sure, for my blog, that isn't gonna matter, but having a single component to run/update is still valuable. In particular using hitch/haproxy/nginx for backend is cumbersome. TLS is a primary concern on the internet today.
        5mo ago
      - perbu 5mo ago
        in my experience this has a lot more moving parts than it should.
- phkamp 5mo ago
  I'm not "refusing to add TLS support" I insist that the certificate is safely isolated in a separate process for security reasons. There are many ways to skin that cat.
  - captn3m0 5mo ago
    Aside: Loved your bit talking about money and varnish in Gift Community[1]. And thanks for the Beerware License, I've started using it! [1]: https://www.youtube.com/watch?v=tOn-L3tGKw0 https://www.youtube.com/watch?v=tOn-L3tGKw0
geerlingguy 5mo ago
This is the first I've actually heard of the name change... I used to use Varnish quite a bit, and had a decent grasp of VCL, for Drupal deployments. But I think Varnish 6 or 7 was when I started dropping off managing the caching layer as almost every project chose to offload caching to Cloudflare.
hannibalhorn 5mo ago
Did not know this had happened, but does seem PHK (the original author of Varnish) is now with of the Vinyl Cache project, so this is not just a typical fork.
willjp 5mo ago
I appreciate the mysql/mariadb comparison.
- nesarkvechnep 5mo ago
  It finally made it click for me.
captn3m0 5mo ago
This is helpful, but it is yet to be seen how downstream picks it up. Wikidata[0] has renamed it and marked the Vinyl repo as the preferred one. Gentoo[1] renamed the package and switched to Vinyl. Homebrew[2] is now tracking Varnish Software (downstream of Vinyl). Fedora[3] has switched to Varnish Software as well. At endoflife.date[5], we renamed to vinyl and switched tracking as well. Wikipedia[6] has renamed Varnish (Software) -> Vinyl Cache. [0]: https://www.wikidata.org/wiki/Q1602447 https://www.wikidata.org/wiki/Q1602447 [1]: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=679937b4f62cf2943ea2d7da87e75a657b1007b9 https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=679937b... [2]: https://github.com/Homebrew/homebrew-core/pull/273280 https://github.com/Homebrew/homebrew-core/pull/273280 [3]: https://src.fedoraproject.org/rpms/varnish/c/59f403810b746e084e0bf9e63a8edadce0898603?branch=rawhide https://src.fedoraproject.org/rpms/varnish/c/59f403810b746e0... [4]: https://repology.org/project/varnish/packages https://repology.org/project/varnish/packages [5]: https://github.com/endoflife-date/endoflife.date/pull/9792 https://github.com/endoflife-date/endoflife.date/pull/9792 [6]: https://en.wikipedia.org/wiki/Vinyl_Cache https://en.wikipedia.org/wiki/Vinyl_Cache

54 points by Foxboron 5mo ago

wmf 5mo ago

What's the deal with Antirez and PHK refusing to add TLS support?

lofaszvanitt 5mo ago
Varnish Enterprise has https support.
- perbu 5mo ago
  the whole point of varnish software keeping a public version of "vinyl cache" as "varnish cache" with TLS is to give people a way to access a FOSS version with native TLS. I think TLS is table-stakes now, and has been for the last 10 years, at least.
  - lofaszvanitt 5mo ago
    Terminate tls and you have your cache.
  - time4tea 5mo ago
    just use the tool that does the job. TLS in -> hitch or caddy Cache -> varnish/vinyl TLS out -> haproxy Connect them up with Unix sockets, if you like.
    - slink_vinyl 5mo ago
      because the topic keeps coming up, I now wrote the tutorial which we should have had years ago: https://vinyl-cache.org/tutorials/tls_haproxy.html https://vinyl-cache.org/tutorials/tls_haproxy.html
      - time4tea 5mo ago
        Thanks for this. You dont mention hitch though. Is that now deprecated/discouraged? It hasn't seen much action in a while, but maybe thats cos it works?
        perbu 5mo ago
        fwiw; Varnish Software still maintains and supports hitch, but we can't say we see a bright future for it. Both the ergonomics and the performance of not being integrated into Varnish are pretty bad. It was the crutch we leaned as it was the best thing we could make available. I would recommend migrating off within a year or two.
        time4tea 5mo ago
        Thanks for the info, but I'm a bit confused, sorry. The reason for hitch was that tls and caching are a different concern, and the current recommendation is to use haproxy, which also isnt integrated into varnish/vinyl. But you say that the reason to migrate off hitch is that its not integrated? But what happend to separation of concerns, then? Is the plan to integrate tls termination into vinyl? Is this a change of policy/outlook? Thanks!
        perbu 5mo ago
        Varnish Software released hitch to facilitate TLS for varnish-cache. Now that Varnish has been renamed, Varnish Software will keep what has been referred to as a downstream version or a fork, which has TLS built in, basically taking the TLS support from Varnish Enterprise. This makes Hitch a moot point. So, I assume it'll receive security updates, but not much more. Wrt. separation of concerns. Varnish with in-core TLS can push terabits per second (synthetic load, but still). Sure, for my blog, that isn't gonna matter, but having a single component to run/update is still valuable. In particular using hitch/haproxy/nginx for backend is cumbersome. TLS is a primary concern on the internet today.
        5mo ago
    - perbu 5mo ago
      in my experience this has a lot more moving parts than it should.
phkamp 5mo ago
I'm not "refusing to add TLS support" I insist that the certificate is safely isolated in a separate process for security reasons. There are many ways to skin that cat.
- captn3m0 5mo ago
  Aside: Loved your bit talking about money and varnish in Gift Community[1]. And thanks for the Beerware License, I've started using it! [1]: https://www.youtube.com/watch?v=tOn-L3tGKw0 https://www.youtube.com/watch?v=tOn-L3tGKw0

geerlingguy 5mo ago

This is the first I've actually heard of the name change... I used to use Varnish quite a bit, and had a decent grasp of VCL, for Drupal deployments. But I think Varnish 6 or 7 was when I started dropping off managing the caching layer as almost every project chose to offload caching to Cloudflare.

hannibalhorn 5mo ago

Did not know this had happened, but does seem PHK (the original author of Varnish) is now with of the Vinyl Cache project, so this is not just a typical fork.

willjp 5mo ago

I appreciate the mysql/mariadb comparison.

nesarkvechnep 5mo ago
It finally made it click for me.

captn3m0 5mo ago

This is helpful, but it is yet to be seen how downstream picks it up. Wikidata[0] has renamed it and marked the Vinyl repo as the preferred one. Gentoo[1] renamed the package and switched to Vinyl. Homebrew[2] is now tracking Varnish Software (downstream of Vinyl). Fedora[3] has switched to Varnish Software as well. At endoflife.date[5], we renamed to vinyl and switched tracking as well. Wikipedia[6] has renamed Varnish (Software) -> Vinyl Cache. [0]: https://www.wikidata.org/wiki/Q1602447 https://www.wikidata.org/wiki/Q1602447 [1]: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=679937b4f62cf2943ea2d7da87e75a657b1007b9 https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=679937b... [2]: https://github.com/Homebrew/homebrew-core/pull/273280 https://github.com/Homebrew/homebrew-core/pull/273280 [3]: https://src.fedoraproject.org/rpms/varnish/c/59f403810b746e084e0bf9e63a8edadce0898603?branch=rawhide https://src.fedoraproject.org/rpms/varnish/c/59f403810b746e0... [4]: https://repology.org/project/varnish/packages https://repology.org/project/varnish/packages [5]: https://github.com/endoflife-date/endoflife.date/pull/9792 https://github.com/endoflife-date/endoflife.date/pull/9792 [6]: https://en.wikipedia.org/wiki/Vinyl_Cache https://en.wikipedia.org/wiki/Vinyl_Cache