6 ms·
the whole point of varnish software keeping a public version of "vinyl cache" as "varnish cache" with TLS is to give people a way to access a FOSS version with
by perbu 5mo ago
the whole point of varnish software keeping a public version of "vinyl cache" as "varnish cache" with TLS is to give people a way to access a FOSS version with native TLS.
I think TLS is table-stakes now, and has been for the last 10 years, at least.
- lofaszvanitt 5mo agoTerminate tls and you have your cache.
- time4tea 5mo agojust use the tool that does the job. TLS in -> hitch or caddy Cache -> varnish/vinyl TLS out -> haproxy Connect them up with Unix sockets, if you like.
- slink_vinyl 5mo agobecause the topic keeps coming up, I now wrote the tutorial which we should have had years ago: https://vinyl-cache.org/tutorials/tls_haproxy.html https://vinyl-cache.org/tutorials/tls_haproxy.html
- time4tea 5mo agoThanks for this. You dont mention hitch though. Is that now deprecated/discouraged? It hasn't seen much action in a while, but maybe thats cos it works?
- perbu 5mo agofwiw; Varnish Software still maintains and supports hitch, but we can't say we see a bright future for it. Both the ergonomics and the performance of not being integrated into Varnish are pretty bad. It was the crutch we leaned as it was the best thing we could make available. I would recommend migrating off within a year or two.
- time4tea 5mo agoThanks for the info, but I'm a bit confused, sorry. The reason for hitch was that tls and caching are a different concern, and the current recommendation is to use haproxy, which also isnt integrated into varnish/vinyl. But you say that the reason to migrate off hitch is that its not integrated? But what happend to separation of concerns, then? Is the plan to integrate tls termination into vinyl? Is this a change of policy/outlook? Thanks!
- perbu 5mo agoVarnish Software released hitch to facilitate TLS for varnish-cache. Now that Varnish has been renamed, Varnish Software will keep what has been referred to as a downstream version or a fork, which has TLS built in, basically taking the TLS support from Varnish Enterprise. This makes Hitch a moot point. So, I assume it'll receive security updates, but not much more. Wrt. separation of concerns. Varnish with in-core TLS can push terabits per second (synthetic load, but still). Sure, for my blog, that isn't gonna matter, but having a single component to run/update is still valuable. In particular using hitch/haproxy/nginx for backend is cumbersome. TLS is a primary concern on the internet today.
- time4tea 5mo agoTotally agree. But, if i may, the docs on varnish and tls are hella confusing. I just re-read the varnish v9 docs, and its not clear at all that/if it supports tls termination. Literally every doc, from the install guide to the "beef in the sandwich" talks about it NOT supporting tls termination... then one teeny para in "extra features in v9.0" mentions 'use -A flag'... This is cool! But also, worth mentioning. Sure I know its an open source project so you don't owe anyone anything, but also one with a huge company behind it - and this is a huge change of stance and also, sounds cool.
- perbu 5mo agowe're not at all a huge company. we're 80 people with a lot on our plates trying to juggle this on top of everything else. but I truly appreciate the feedback. I'll reach our to the team working on this and see if I can make this a bit clearer.
- slink_vinyl 5mo agohaproxy supports both the offload (client) and onload (backend) use case. This is the main reason for why I personally prefer it. I can not comment on how well hitch works in comparison, because I have not used it for years.
- perbu 5mo agoin my experience this has a lot more moving parts than it should.