Overview
This guide is for my VPS 1024M with InMotionHosting.
Credit for this goes to David Dunn
root ~]#: cat /etc/redhat-release
CentOS release 5.7 (Final)
Varnish Cache is a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 – 1000x, depending on your architecture.
Like many other caching systems, the increase in speed (and decrease in CPU) does come at the expense of memory. For practicality purposes, it can be installed on any VPS, but is best suited to a high-end VPS (512M or higher) or Dedicated server.
Installation
Much like installing a third-party webserver or apache module, cPanel won’t be able to directly control or manage Varnish. This doesn’t mean that it can’t be installed in such a way as to preserve all the existing cPanel functionality.
Changing the non-ssl port on apache
While you can use the “default” varnish settings, this won’t respond to port 80, so you won’t see any benefit unless you wish to simply perform benchmarking. First, things first, you’ll want to change the default apache port from 80 to something else (so Varnish can listen on port 80). This doesn’t have to be the first step in the process, but please make certain that its done before you attempt to run Varnish.
# Open WHM as root on the target server and go to Server Configuration -> Tweak Settings# Scroll down to the System section(or use the "find" option on the right to search for port) and change the default Apache non-SSL IP/port from 0.0.0.0:80 to the IP/Port of your choosing# If you only want apache to listen on a specific IP (not recommended) change 0.0.0.0 to that IP, it won't matter what you change the port to (but give it a number that won't conflict with any other service and keep a record of what you choose)
For this example I’m setting the apache port to 1985, so the option would read 0.0.0.0:1985.
Installing Varnish
You’ll need to add the appropriate repository to install Varnish with yum. Since varnish can proxy _any_ server (not just apache) apache is not a prerequisite and you should be able to install it without needing to uncomment any restricted packages in /etc/yum.conf
Add the repository with:
rpm --nosignature -i http://repo.varnish-cache.org/redhat/varnish-3.0/el5/noarch/varnish-release-3.0-1.noarch.rpm
then install varnish with
yum install varnish
Since its registered with yum, this means that varnish should update like any other system service during updates.
Configuring Varnish
Once Varnish is installed you’ll want to edit the configuration file located at /etc/sysconfig/varnish
If you’d like to make the most minimal edits (and use the simplest configuration settings) you can add the following to the bottom of this file (based off the simple “Alternative 1″ configuration settings)
DAEMON_OPTS="-a :80 \-T localhost:6082 \-b localhost:1985 \-u varnish -g varnish \-s file,/var/lib/varnish/varnish_storage.bin,1G"
boiled down, this effectively is telling Varnish to:
listen on all IP addresses on port 80
set the administrative interface on port 6082 (the default)
forward requests to localhost on port 1985 (our apache server)
set the user/group for child processes to varnish:varnish
use the file storage mechanism at /var/lib/varnish/varnish_storage,bin and use only 1GB for the file.
restart varnish and apache with
service varnish restartservice httpd restart
and confirm that this is working. Please note that in subsequent changes you’ll only need to restart Varnish (not apache).
modifying the DAEMON_OPTS
If you notice that the Varnish Cache isn’t responding properly (or is giving you the generic cPanel page) you may need to specify your rules via a vcl file. There’s an example one provided. Simply modify your DAEMON_OPTS section like so:
DAEMON_OPTS="-a :80 \-T localhost:6082 \-f /etc/varnish/oursettings.vcl \-u varnish -g varnish \-s file,/var/lib/varnish/varnish_storage.bin,2G"
Note that we’re no longer defining the port apache is stored on. We’ll get to that in the VCL rules section below.
Setting the VCL rules
Navigate to the /etc/varnish/ directory and copy the default.vcl file to oursettings.vcl.
Open oursettings.vcl in your editor of choice to this file:
backend b127_0_0_1{.host = "127.0.0.1";.port = "1985";}acl a127_0_0_1{"127.0.0.1";}sub vcl_recv{set req.http.X-Forwarded-For = client.ip;if(server.ip ~ a127_0_0_1){set req.backend = b127_0_0_1;}}
The above example rules are based off a single IP configuration for the address “127.0.0.1″ you’ll need to adjust appropriately (adding different backends for different IPS and adding them in the sub vcl_recv section
Correcting Apache Logs
Apache will log all IP addresses with the server’s own (since the request will be coming from Varnish and not the client). To adjust this, you will need to edit /usr/local/apache/conf/httpd.conf and distill the following changes.
First, update the logging format. Most sites should default to “combined” so make change that line in the <IfModule log_config_module> section from:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
to:
LogFormat "%{X-Forwarded-for}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
You’ll need to distill this and restart httpd
/usr/local/cpanel/bin/apache_conf_distiller --update service httpd restart
If everything goes well you should be able to confirm that access logs are reflecting the correct IP by tailing them.
If you have sites that are using https (SSL) this could potentially break secure logs. If you need to avoid this, simply change the logging back and add a new LogFormat entry (called cached) and set the userdata entry to use this. Please note that this may not properly persist between updates.
WHAT WON’T WORK -
Since clients are no longer making requests directly to varnish certain IP-dependent features may not work (or may not work as expected)
Hotlink Protection: will no longer work since Apache isn't directly receiving the request. (see this page for an alternate solution) PHP logging IP addresses: mailerscripts/forums/comment functions will record the IP of the varnish server and not the visitor (there is a solution for this by replacing references for "REMOTE_ADDR" with "X_FORWARED_FOR". See this page for more information, alternatively you can place these forms behind a secure address where apache will process the request directly). Exim logging IP addresses: similar to the above issue, mailer scripts triggered via PHP scripts will show the varnish address instead of the originating request. No fix at this time, though you can recommend applying a similar fix Blocking IP via .htaccess: similar to the last two issues, since apache is not directly recieving the request it cannot block IPs. While varnish will certainly help with load related to large amounts of hits, this won't address abuse in the form of spammers or robots that you simply don't want to access your site. IPs can be blocked directly via apf, or by adding a "forbidden" acl in the varnish configuration see this page for more information. Please keep in mind that unlike a normal .htaccess block, this will completely block traffic for http connections to all sites (but not https since apache still handles those).
ALTERNATE FIX FOR CMS/CARTS AND MAILER SCRIPTS
You can manually override the PHP variables by adding the following line to the top of the affected PHP script (or the configuration file for the CMS/Cart/Blog)
if($_SERVER['HTTPS'] !="on"){$_SERVER["REMOTE_ADDR"]=$_SERVER["HTTP_X_FORWARDED_FOR"];}
