Scalable Stories

Technical Briefing: ngxcachepurge 2.7.0 Speeds Up Purges of Vary'd Cache Entries Today's source is a GetPageSpeed article about version 2.7.0 of the ngxcachepurge NGINX module, which is already in use. The release adds a shared-memory variant index. It makes repeat exact purges of Vary'd cache keys up to roughly 1000× faster than the full-zone scan introduced in 2.6.2. The Problem: One Cache Key, Many Files When an upstream sends Vary: Accept-Encoding, or when gzipvary is enabled, NGINX stores…

Technical Briefing: ngxpagespeed on Modern NGINX (Operational Reference) The 2026-10-16 and 2026-10-17 briefings covered why the classic build fails and walked through the packaged fix. Today's source is the same GetPageSpeed article with no new developments. This edition is a condensed operational reference. It focuses on channel behavior, version-locking, licensing, and fleet-level drift, which matter when running the module long-term. Recap: Why the Classic Build Fails The classic PSOL + ./c…

Technical Briefing: Brotli Compression for Varnish 6.0 LTS with vmod-brotli The Problem Open-source Varnish only supports gzip. Brotli is a paid feature in Varnish Enterprise. Uplex's open-source fetch processor, libvfp-brotli, only targets Varnish 6.2 and newer. That excludes the 6.0 LTS line, which Magento 2 and similar stacks standardize on. The new option: the processor has been backported to 6.0 LTS and packaged as vmod-brotli in the getpagespeed-extras-varnish60 repository channel. This i…

Technical Briefing: Enabling HTTP/3 in NGINX on Ubuntu and Debian The Problem Stock binaries can't do HTTP/3 Stock nginx from the Debian and Ubuntu archives is built without --with-httpv3module. The ondrej/nginx PPA also lacks it on current LTS releases. If your binary was built without the module, no configuration will enable HTTP/3. Check with: nginx -V 2>&1 | grep httpv3 If this returns nothing, setting http3 on; will either: throw unknown directive "http3", or leave Chrome negotiating HTTP/…

Technical Briefing: Far-Future Cache-Control for Versioned Assets with the NGINX Immutable Module The Problem Cache-busted assets such as /assets/app.a3f2c9.css carry a content hash in the URL, so a given URL's content cannot change. Browsers still revalidate them with If-None-Match requests. Each revalidation costs: a TCP round-trip (or TLS resume), a stat() syscall, log I/O, a 304 response write. That cost repeats for every asset and every return visitor. The Fix Add one directive to a locati…

Technical Briefing: slowstart Comes to Open-Source NGINX The Problem NGINX Plus has shipped a server slowstart parameter since 2015. It ramps traffic to a freshly-live upstream from zero to full weight over a configurable window. Open-source NGINX never got the behavior: it declares the slowstart field in its upstream peer structs, but there are zero references to it in any .c file — the data model was stubbed, the scheduler logic was never wired up. That gap matters because every rolling resta…

Technical Briefing: NGINX TLS Backends — aws-lc Support, quictls Backports, and the OpenSSL 3.5 LTS Migration The Problem NGINX's TLS backend options have been constrained by two separate issues: compile-time incompatibilities with aws-lc, and the end-of-life status of the quictls fork that NGINX-MOD has historically shipped against. aws-lc header collisions. aws-lc and NGINX's old QUIC shim collided at compile time in 2024. This has now been resolved: NGINX upstream added aws-lc support in 1.2…

Technical Briefing: NGINX Dynamic TLS Records — An Honest Benchmark in 2026 The Problem NGINX's default sslbuffersize is 16 KB, and each TLS record of that size straddles roughly 12 TCP segments. On a lossy link, if a single segment drops, the receiver cannot deliver any byte of that record until retransmission completes — adding at least one full RTT to TTFB on a connection mid-slow-start. Cloudflare's 2015 ngxhttptlsdynsize patch (shipped in nginx-mod) was built to address this by ramping rec…

Technical Briefing: Sub-Hourly NGINX Rate Limits with NGINX-MOD The Problem Stock NGINX limitreqzone accepts only two rate units: r/s and r/m. A directive like rate=10r/h fails nginx -t with invalid rate, because the parser matches only those two suffixes and then attempts ngxatoi on the remainder. There is a second, quieter defect. Internally, upstream stores the rate as milli-requests-per-second: ctx->rate = rate 1000 / scale This silently truncates rates slower than roughly 4r/h to zero, so…

Technical Briefing: Keeping OpenAI Crawlers Unblocked — IP Feeds, NGINX Rate-Limit Bypass, and fail2ban Exemptions The Problem OpenAI publishes three crawler IP feeds — GPTBot, ChatGPT-User, and OAI-SearchBot — as JSON, each with a creationTime field and a prefixes array of ipv4Prefix entries. These ranges live in Microsoft Azure space and rotate, so any hard-coded list goes stale quickly. The practical failure mode is silent: robots.txt alone is insufficient. Rate limiting (limitreq/limitconn)…