Scalable Stories

Technical Briefing: WP Rocket Nginx Plugin — Direct Static Cache Delivery The Problem On a self-managed Nginx server running WP Rocket, a cached request still travels the long way around: Nginx → PHP-FPM → PHP cache loader → cached HTML file. The HTML file already exists on disk, but PHP-FPM is still involved in handing it back. That occupies a limited PHP-FPM worker for work Nginx is better suited to do. The cost is most visible during traffic bursts: every direct cache hit that consumes a PHP…

Technical Briefing: NGINX ESI as a Varnish Replacement for Magento 2 The Problem Running Magento 2 behind Varnish means operating a second proxy, a second configuration language (VCL), and a second cache lifecycle in the request path — all sitting between NGINX and the application. The question this work addresses is whether NGINX can own the entire edge path itself: proxy, cache, TLS, and ESI fragment assembly, without Varnish. The Implementation nginx-module-esi was built for exactly this pur…

Technical Briefing: Encrypted Client Hello (ECH) in GetPageSpeed NGINX Packages The Problem: The Last Plaintext Leak in TLS 1.3 TLS 1.3 encrypts nearly everything in the handshake except one field: the SNI (Server Name Indication). Even with a fully modern TLS 1.3 deployment, an on-path observer can read exactly which hostname a client is requesting. For multi-tenant hosting, CDNs, and shared front ends, this is a meaningful privacy gap — the observer learns which site among many on the same se…

Technical Briefing: NGINX Post-Quantum TLS — X25519MLKEM768 with OpenSSL 3.5 The Problem: Harvest Now, Decrypt Later The threat model is not a quantum computer breaking TLS today — it is an attacker recording encrypted traffic now and decrypting it once a cryptographically relevant quantum computer exists. Session cookies expire in hours, but health records, contracts, source trees, and private keys remain sensitive for a decade or more. The precise vulnerability matters: Shor's algorithm break…

Technical Briefing: Parallel ESI for Varnish 6.0 LTS via vmod-pesi The Problem: Sequential ESI Fragment Assembly Stock open-source Varnish processes ESI includes sequentially. A page containing two uncached fragments that each take 2 seconds to render therefore takes over 4 seconds to assemble — the total is the sum of fragment latencies, not the maximum. This is a structural limitation of the open-source daemon, not a configuration issue. The Implementation: A Backport of libvdp-pesi GetPageSp…

Technical Briefing: NGINX HTTP/3 reuseport, quicbpf, and SELinux The Problem: HTTP/3 Silently Fails Without reuseport With workerprocesses greater than 1, a QUIC listener configured without reuseport shares a single UDP socket across all workers. Because QUIC has no accept() step, every datagram arrives on that one socket, and whichever worker wakes first grabs it — even if it does not own that connection. The owning worker then receives mid-connection datagrams it cannot handle, producing H3RE…

Technical Briefing: RFC 8879 Certificate Compression in NGINX Problem Statement The TLS 1.3 certificate chain dominates the server's first flight and competes with the initial congestion window and QUIC's 3x amplification limit. RFC 8879 certificate compression shrinks that chain on every fresh handshake — a tested production chain dropped from 4735 to 3750 bytes (20.8% saving). NGINX supports this via a single directive: nginx sslcertificatecompression on; It is valid in http, server, and stre…

Technical Briefing: Post-Quantum NGINX with OpenSSL 3.5 on Debian and Ubuntu Problem Statement NGINX packages on Debian and Ubuntu previously linked against each distribution's system OpenSSL. On Ubuntu 20.04 (focal), that meant OpenSSL 1.1.1, which reached upstream end-of-life on 11 September 2023. This also constrained which TLS features were available depending on the suite, and left DEB and RPM builds as separate stacks. Implementation NGINX packages on Debian and Ubuntu now link against an…

Technical Briefing: OpenSSL 3.5 LTS vs. 4.0 for NGINX Packaging Problem Statement The decision between OpenSSL 3.5 and 4.0 for an NGINX fleet is a question of support windows and migration cost, not feature parity. OpenSSL 4.0 shipped in April 2026 but is explicitly not an LTS release. Under the project's policy, non-LTS branches receive only 13 months of support. OpenSSL 3.5 is the current LTS, supported until April 2030. Moving an NGINX fleet from 3.5 to 4.0 today would cut the support window…

Technical Briefing: Maintained zstd Module for NGINX — Streaming Fixes, Packaging, and Audit Response Problem Statement The original tokers/zstd-nginx-module (by Alex Zhang) has not seen a release since 2023 and carries bugs in its streaming path that silently truncate large responses. Over the buffer size, the filter could close the zstd frame over unconsumed input, delivering a valid but short file with no error and no log line — a failure mode that passes header assertions and is invisible w…