The official Amplify app is now on iPhone
by Danila Vershinin, September 27, 2026
Technical Briefing: GetPageSpeed Amplify iPhone App The Problem F5’s hosted NGINX Amplify reached end of life on January 31, 2026. Users of that service needed a continuing path for the familiar agent-based monitoring of NGINX and related services. The Fix GetPageSpeed Amplify continues to run the familiar agent and a compatible API, with a modern dashboard for monitoring NGINX, Varnish, PHP-FPM, MySQL, and websites. The official iPhone app for GetPageSpeed Amplify is now available. What the Ap…
Read More... NGINX Accept-Language Redirects: No Lua Required
by Danila Vershinin, September 26, 2026
Technical Briefing: NGINX Accept-Language Module — Header-Based Language Detection The Problem Stock NGINX cannot parse the Accept-Language header. Language-based redirects therefore typically require a map block full of regexes, an njs script, or a full OpenResty/Lua layer. Real headers are messy: fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, ;q=0.5 They include regional subtags, quality values, spaces, and wildcards — all painful to match correctly. The Fix The NGINX Accept-Language module provides a…
Read More... NGINX Variables: Scope, Handlers, and Common Pitfalls
by Danila Vershinin, September 25, 2026
Technical Briefing: NGINX Variables — Semantics, Caching, and Scope The Problem NGINX variables look like scripting variables but do not behave like them. Three rules govern their behavior, and violating any of them produces either a startup failure or a silent, hard-to-diagnose bug: A variable must be introduced by a directive (set, map, geo) or exported by a module. Referencing anything else causes NGINX to refuse to start with nginx: [emerg] unknown “foo” variable. The name is global to the…
Read More... Serve WP Rocket Cache Directly from Nginx Without PHP
by Danila Vershinin, September 24, 2026
Technical Briefing: WP Rocket Nginx Plugin — Direct Static Cache Delivery The Problem On a self-managed Nginx server running WP Rocket, a cached request still travels the long way around: Nginx → PHP-FPM → PHP cache loader → cached HTML file. The HTML file already exists on disk, but PHP-FPM is still involved in handing it back. That occupies a limited PHP-FPM worker for work Nginx is better suited to do. The cost is most visible during traffic bursts: every direct cache hit that consumes a PHP…
Read More... NGINX ESI: Replace Varnish for Magento 2
by Danila Vershinin, September 22, 2026
Technical Briefing: NGINX ESI as a Varnish Replacement for Magento 2 The Problem Running Magento 2 behind Varnish means operating a second proxy, a second configuration language (VCL), and a second cache lifecycle in the request path — all sitting between NGINX and the application. The question this work addresses is whether NGINX can own the entire edge path itself: proxy, cache, TLS, and ESI fragment assembly, without Varnish. The Implementation nginx-module-esi was built for exactly this pur…
Read More... Encrypted Client Hello in NGINX: Now Shipping in Our RPMs and DEBs
by Danila Vershinin, September 21, 2026
Technical Briefing: Encrypted Client Hello (ECH) in GetPageSpeed NGINX Packages The Problem: The Last Plaintext Leak in TLS 1.3 TLS 1.3 encrypts nearly everything in the handshake except one field: the SNI (Server Name Indication). Even with a fully modern TLS 1.3 deployment, an on-path observer can read exactly which hostname a client is requesting. For multi-tenant hosting, CDNs, and shared front ends, this is a meaningful privacy gap — the observer learns which site among many on the same se…
Read More... NGINX Post-Quantum TLS: X25519MLKEM768 with OpenSSL 3.5
by Danila Vershinin, September 20, 2026
Technical Briefing: NGINX Post-Quantum TLS — X25519MLKEM768 with OpenSSL 3.5 The Problem: Harvest Now, Decrypt Later The threat model is not a quantum computer breaking TLS today — it is an attacker recording encrypted traffic now and decrypting it once a cryptographically relevant quantum computer exists. Session cookies expire in hours, but health records, contracts, source trees, and private keys remain sensitive for a decade or more. The precise vulnerability matters: Shor’s algorithm break…
Read More... Parallel ESI for Varnish 6.0 LTS: vmod-pesi Now Packaged
by Danila Vershinin, September 19, 2026
Technical Briefing: Parallel ESI for Varnish 6.0 LTS via vmod-pesi The Problem: Sequential ESI Fragment Assembly Stock open-source Varnish processes ESI includes sequentially. A page containing two uncached fragments that each take 2 seconds to render therefore takes over 4 seconds to assemble — the total is the sum of fragment latencies, not the maximum. This is a structural limitation of the open-source daemon, not a configuration issue. The Implementation: A Backport of libvdp-pesi GetPageSp…
Read More... NGINX QUIC reuseport: HTTP/3 Silently Breaks Without It
by Danila Vershinin, September 18, 2026
Technical Briefing: NGINX HTTP/3 reuseport, quicbpf, and SELinux The Problem: HTTP/3 Silently Fails Without reuseport With workerprocesses greater than 1, a QUIC listener configured without reuseport shares a single UDP socket across all workers. Because QUIC has no accept() step, every datagram arrives on that one socket, and whichever worker wakes first grabs it — even if it does not own that connection. The owning worker then receives mid-connection datagrams it cannot handle, producing H3RE…
Read More... NGINX Certificate Compression: RFC 8879 for Every Browser
by Danila Vershinin, September 15, 2026
Technical Briefing: RFC 8879 Certificate Compression in NGINX Problem Statement The TLS 1.3 certificate chain dominates the server’s first flight and competes with the initial congestion window and QUIC’s 3x amplification limit. RFC 8879 certificate compression shrinks that chain on every fresh handshake — a tested production chain dropped from 4735 to 3750 bytes (20.8% saving). NGINX supports this via a single directive: nginx sslcertificatecompression on; It is valid in http, server, and stre…
Read More...Recommended Web Hosting
