Brotli Compression for Varnish 6.0 LTS: vmod-brotli Now Packaged
by Danila Vershinin, October 13, 2026
Technical Briefing: Brotli Compression for Varnish 6.0 LTS with vmod-brotli The Problem Open-source Varnish only supports gzip. Brotli is a paid feature in Varnish Enterprise. Uplex’s open-source fetch processor, libvfp-brotli, only targets Varnish 6.2 and newer. That excludes the 6.0 LTS line, which Magento 2 and similar stacks standardize on. The new option: the processor has been backported to 6.0 LTS and packaged as vmod-brotli in the getpagespeed-extras-varnish60 repository channel. This i…
Read More... How to Enable NGINX HTTP/3 on Ubuntu and Debian
by Danila Vershinin, October 12, 2026
Technical Briefing: Enabling HTTP/3 in NGINX on Ubuntu and Debian The Problem Stock binaries can’t do HTTP/3 Stock nginx from the Debian and Ubuntu archives is built without –with-httpv3module. The ondrej/nginx PPA also lacks it on current LTS releases. If your binary was built without the module, no configuration will enable HTTP/3. Check with: nginx -V 2>&1 | grep httpv3 If this returns nothing, setting http3 on; will either: throw unknown directive “http3”, or leave Chrome negotiating HTTP/…
Read More... NGINX Immutable Module: Far-Future Cache-Control Headers
by Danila Vershinin,
Technical Briefing: Far-Future Cache-Control for Versioned Assets with the NGINX Immutable Module The Problem Cache-busted assets such as /assets/app.a3f2c9.css carry a content hash in the URL, so a given URL’s content cannot change. Browsers still revalidate them with If-None-Match requests. Each revalidation costs: a TCP round-trip (or TLS resume), a stat() syscall, log I/O, a 304 response write. That cost repeats for every asset and every return visitor. The Fix Add one directive to a locati…
Read More... NGINX slow_start: Gradual Upstream Ramp-Up Without Plus
by Danila Vershinin, October 10, 2026
Technical Briefing: slowstart Comes to Open-Source NGINX The Problem NGINX Plus has shipped a server slowstart parameter since 2015. It ramps traffic to a freshly-live upstream from zero to full weight over a configurable window. Open-source NGINX never got the behavior: it declares the slowstart field in its upstream peer structs, but there are zero references to it in any .c file — the data model was stubbed, the scheduler logic was never wired up. That gap matters because every rolling resta…
Read More... aws-lc NGINX in 2026: Why we still ship quictls
by Danila Vershinin, October 9, 2026
Technical Briefing: NGINX TLS Backends — aws-lc Support, quictls Backports, and the OpenSSL 3.5 LTS Migration The Problem NGINX’s TLS backend options have been constrained by two separate issues: compile-time incompatibilities with aws-lc, and the end-of-life status of the quictls fork that NGINX-MOD has historically shipped against. aws-lc header collisions. aws-lc and NGINX’s old QUIC shim collided at compile time in 2024. This has now been resolved: NGINX upstream added aws-lc support in 1.2…
Read More... NGINX Dynamic TLS Records: An Honest Benchmark in 2026
by Danila Vershinin, October 8, 2026
Technical Briefing: NGINX Dynamic TLS Records — An Honest Benchmark in 2026 The Problem NGINX’s default sslbuffersize is 16 KB, and each TLS record of that size straddles roughly 12 TCP segments. On a lossy link, if a single segment drops, the receiver cannot deliver any byte of that record until retransmission completes — adding at least one full RTT to TTFB on a connection mid-slow-start. Cloudflare’s 2015 ngxhttptlsdynsize patch (shipped in nginx-mod) was built to address this by ramping rec…
Read More... NGINX limit_req Per Hour, Day, Week, Month with NGINX-MOD
by Danila Vershinin, October 6, 2026
Technical Briefing: Sub-Hourly NGINX Rate Limits with NGINX-MOD The Problem Stock NGINX limitreqzone accepts only two rate units: r/s and r/m. A directive like rate=10r/h fails nginx -t with invalid rate, because the parser matches only those two suffixes and then attempts ngxatoi on the remainder. There is a second, quieter defect. Internally, upstream stores the rate as milli-requests-per-second: ctx->rate = rate 1000 / scale This silently truncates rates slower than roughly 4r/h to zero, so…
Read More... Whitelist OpenAI IP Ranges in NGINX and fail2ban
by Danila Vershinin, October 5, 2026
Technical Briefing: Keeping OpenAI Crawlers Unblocked — IP Feeds, NGINX Rate-Limit Bypass, and fail2ban Exemptions The Problem OpenAI publishes three crawler IP feeds — GPTBot, ChatGPT-User, and OAI-SearchBot — as JSON, each with a creationTime field and a prefixes array of ipv4Prefix entries. These ranges live in Microsoft Azure space and rotate, so any hard-coded list goes stale quickly. The practical failure mode is silent: robots.txt alone is insufficient. Rate limiting (limitreq/limitconn)…
Read More... NGINX Microcaching: Full-Page Caching Without Varnish
by Danila Vershinin, October 4, 2026
Technical Briefing: NGINX Microcaching — Varnish-Style Full-Page Caching with Stock Directives The Problem Full-page caching typically means standing up a second daemon (Varnish), a second port, and a second configuration language alongside NGINX. That operational overhead is real: an extra process to monitor, an extra config surface to maintain, and an extra hop in the request path. The question this technique answers is whether the common case — serving mostly-anonymous pages fast and shieldi…
Read More... zlib-ng vs zlib in NGINX: Benchmark and Methodology
by Danila Vershinin, October 3, 2026
Technical Briefing: zlib-ng vs Stock zlib Under NGINX — Measured, Not Assumed The Problem Vendor benchmarks for zlib-ng typically compress one big buffer in a single call against a synthetic corpus. NGINX does not work that way. It feeds the compressor in small chunks, opens a fresh deflate stream per response, and wraps output in a gzip header. The question this evaluation answers is whether zlib-ng actually beats stock zlib under NGINX’s real compression pattern — and the answer required buil…
Read More...Recommended Web Hosting
