关于varnish使用心得

前言：

       接触varnish也是4月份吧，之前对公司的平台架构不是很了解。这个varnish是个web加速器，是一个cache server。公司现在的平台架构配置是将varnish作为电信前端，而后端是另外一台主机（所有的重要的程序和数据库都放在这里），在dnspod域名解析那边，将varnish前端主机的ip解析为后端主机的域名，当然这里需要在varnish上配置default.vcl。这样做的目的，其实也是为了隐藏真正的主机。（可以起到防范作用，防止别人直接攻击目标主机）

原理解析：

我也很想知道原理啊。但是目前还不知道

安装方法：

分两种啦，一种源码编译安装；一种快速安装（通过yum或apt-get install varnish）

使用方法：

1.配置文件：这个varnish有一个配置文件很重要，目前公司的路径为：/usr/local/varnish/etc/varnish/default.vcl。这里配置了所有通过前端主机访问后端的ip和域名以及一些需要缓存的文件等等详细配置。那就把文件贴出来看一下：backend backup1 { .host = "后端主机ip地址"; .port = "6088";#端口号。注意这里必须要和nginx那边的conf文件的监听端口一致 } backend sucai { #.host = "183.61.16."; .host = "后端主机ip地址"; .port = "6088"; } backend cps { .host = "后端主机ip地址"; .port = "12789"; } backend bbs { .host = "后端主机ip地址"; .port = "13568"; } backend uc { .host = "后端主机ip地址"; .port = "8097"; } sub vcl_recv { set req.grace = 30s; if(req.http.host ~"^(www)|(web)|(game)|(user)|(boss)|(lyl)|(passport)|(wy)|(cp)|(test)|(image).example.com") { if(req.restarts < 3) { set req.backend = backup1 ; } else { error 200 "welcome to example.com"; } } elsif (req.http.host ~"^(t).example.com") { if(req.restarts < 3 ) { set req.backend = sucai; } else { error 200 "welcome to example.com"; } } elsif (req.http.host ~"^(uc).example.com") { if(req.restarts < 3 ) { set req.backend = uc; } else { error 200 "welcome to example.com"; } } elsif (req.http.host ~"^(bbs).example.com") { if(req.restarts < 3 ) { set req.backend = bbs; } else { error 200 "welcome to example.com"; } } elsif (req.http.host ~"^(u).example.com") { if(req.restarts < 3 ) { set req.backend = cps; } else { error 200 "welcome to example.com"; } } elsif (req.http.host ~"^example.com") { if(req.restarts < 3 ){ set req.backend = backup1; } else { error 200 "welcome to example.com"; } }elseif(req.http.host ~"^(www).986.com"){ if(req.restarts < 3) { set req.backend = backup1 ; } else { error 200 "welcome to example.com"; } } else { error 200 "welcome to example.com"; } #if ( req.request == "GET" && req.url ~"^/(js)|(js/)$" ){ # error 200 "error visit"; # } if( req.request == "PURGE" ){ return(lookup); } #if (req.http.Accept-Encoding) { # if (req.url ~ "\.(jpg|png|gif|gz|tgz|bz2|tbz|mp3|ogg)$") { # # No point in compressing these # remove req.http.Accept-Encoding; # } elsif (req.http.Accept-Encoding ~ "gzip") { # set req.http.Accept-Encoding = "gzip"; # } elsif (req.http.Accept-Encoding ~ "deflate") { # set req.http.Accept-Encoding = "deflate"; # } else { # # unkown algorithm # remove req.http.Accept-Encoding; # } #} # if (req.restarts == 0) { if (req.http.x-forwarded-for) { set req.http.X-Forwarded-For = req.http.X-Forwarded-For + ", " + client.ip; } else { set req.http.X-Forwarded-For = client.ip; } # } if (req.request == "GET" && req.url ~ "\.(jpg|png|gif|swf|flv|jpeg|ico|bmp|mov|avi|3gp|mp4)$") { unset req.http.cookie; } if (req.request != "GET" && req.request != "HEAD" && req.request != "PUT" && req.request != "POST" && req.request != "TRACE" && req.request != "OPTIONS" && req.request != "DELETE") { /* Non-RFC2616 or CONNECT which is weird. */ return (pipe); } if (req.request != "GET" && req.request != "HEAD") { /* We only deal with GET and HEAD by default */ return (pipe); } if (req.request == "GET" && req.url ~ "\.(php)($|\?)") { return (pass); } if (req.http.Authorization || req.http.Cookie) { /* Not cacheable by default */ return (pass); } #if (req.backend.healthy) { # set req.grace = 20s; /* Only enable if you don't mind slightly stale content */ #} else { # set req.grace = 1h; #} return (lookup);# 除了以上的访问以外，都在varnish缓存里查找 # set bereq.http.connection = "close"; # here. It is not set by default as it might break some broken web # applications, like IIS with NTLM authentication. return (pipe); } sub vcl_pass { return (pass); } sub vcl_hash { hash_data(req.url); if (req.http.host) { hash_data(req.http.host); } else { hash_data(server.ip); } return (hash); } sub vcl_hit { if( req.request == "PURGE" ) { set obj.ttl = 0s; #purge; error 200 "Purged."; } return (deliver); } sub vcl_miss { return (fetch); } sub vcl_fetch { if( beresp.status == 501 || beresp.status == 502 || beresp.status == 503 || beresp.status == 504 ){ return(restart); } if( beresp.http.Content-Length && beresp.http.Content-Length ~ "[0-9]{7,}"){ return (hit_for_pass); } #set beresp.ttl = 1800s; #set beresp.http.Cache-Control = "max-age=1800"; # if (req.http.host == "test.example.com") { # unset beresp.http.Cache-Control; # unset beresp.http.expires; # return (deliver); # } # if (req.http.host ~"^boss.example.com") { # unset beresp.http.Cache-Control; # unset beresp.http.expires; # return (deliver); # } # if (req.url ~"^/(payment)") { # unset beresp.http.Cache-Control; # unset beresp.http.expires; # return (deliver); # } if (req.url ~"^/(article|kefu|news)") { set beresp.ttl = 1800s; set beresp.http.Cache-Control = "max-age=1800"; } if (beresp.ttl <= 0s || beresp.http.Set-Cookie || beresp.http.Vary == "*") { /* * Mark as "Hit-For-Pass" for the next 2 minutes */ set beresp.ttl = 120s; return (hit_for_pass); } ##对访问中get有包含jpg,png等格式的文件进行缓存，缓存时间为7天，s为秒 if (req.url ~ "\.(png|gif|jpg|swf|flv|jpeg|bmp|mov|3gp|avi|mp4)$") { #unset beresp.http.set-cookie; set beresp.ttl = 7d; set beresp.http.Cache-Control = "max-age=604800"; #set beresp.http.X-Files = "png|gif|jpg|swf|flv|css|js"; } if (req.url ~ "\.(css|js)$") { #unset beresp.http.set-cookie; set beresp.ttl = 1d; set beresp.http.Cache-Control = "max-age=86400"; #set beresp.http.X-Files = "png|gif|jpg|swf|css|js"; } ##对访问get中包含html等静态页面，缓存300秒 if (req.url ~ "\.(html|htm|txt)$") { #unset beresp.http.set-cookie; set beresp.ttl = 1800s; set beresp.http.Cache-Control = "max-age=1800"; } if (beresp.http.Pragma ~"no-cache" || beresp.http.Cache-Control ~"no-cache" || beresp.http.Cache-Control ~"private") { return (deliver); } } sub vcl_deliver { set resp.http.x-hits = obj.hits ; if (obj.hits > 0) { set resp.http.X-Cache = "HIT Cache"; } else { set resp.http.X-Cache = "MISS Cache"; } return (deliver); } sub vcl_error { if ((req.http.host ~"^(www.)?example.com") && obj.status == 503 && req.restarts < 4) { return (restart); } set obj.http.Content-Type = "text/html; charset=utf-8"; set obj.http.Retry-After = "5"; synthetic {" <?xml version="1.0" encoding="utf-8"?> ###这里加入错误时的显示界面 "}; return (deliver); } sub vcl_init { return (ok); } sub vcl_fini { return (ok); }

上面的配置只是例子。具体详细的配置文件还看我备份在网盘上的吧。这里贴代码老是有问题。csdn的这个编辑器也不是很好用啊

tips:1）上面的配置项中后端主机ip什么的一定要写对。还有一个很容易忽略的细节就是对应的端口一定要成和nginx的虚拟主机的conf文件中的端口号一致。切记，要不然会找不到域名的。页面提示404错误

2）在nginx那边配置完conf文件后。记得平滑重启下，让其生效nginx -s reload

2.启动和关闭进程

关闭进程的命令为：pkill   varnishd

启动进程的命令为：/usr/local/varnish/sbin/varnishd -f /usr/local/varnish/etc/varnish/default.vcl -a 0.0.0.0:80 -s malloc,2G -t 3600 -T 0.0.0.0:3500 -p thread_pools=8 -p thread_pool_max=8000 -p thread_pool_min=100 -p http_resp_hdr_len=8192 -p http_max_hdr=256 -p thread_pool_timeout=10 -p listen_depth=4096 -p nuke_limit=512 -w 1024,65535,10

tips:要想知道这个启动命令到底是什么意思。还得看文档才能知道，上面会有详细的解释。

下图为参数解释：

3.添加开机自启动varnish

      varnish缓存前端-80口,为了在启动时启动varnish服务,我们在/etc/rc.local中增加了启动代码,从启动代码可以知道varnish的规则配置文件和日志位置信息等

配置信息代码如下：

#!/bin/sh # # This script will be executed *after* all the other init scripts. # You can put your own initialization stuff in here if you don't # want to do the full Sys V style init stuff. touch /var/lock/subsys/local ulimit -HSn 655350 ulimit -HSc unlimited /usr/local/varnish/sbin/varnishd -f /usr/local/varnish/etc/varnish/default.vcl -a 0.0.0.0:80 -s malloc,2G -t 3600 -T 0.0.0.0:3500 -p thread_pools=8 -p thread_pool_max=8000 -p thread_pool_min=100 -p http_resp_hdr_len=8192 -p http_max_hdr=256 -p thread_pool_timeout=10 -p listen_depth=4096 -p nuke_limit=512 -w 1024,65535,10 /usr/local/varnish/bin/varnishncsa -w /data/varnish/log & /home/jianghan/monitor-jh &