Loading...

PODCAST

Scalable Stories

Welcome to Scalable Stories—the podcast where our hosts explore the nuances of web performance, security, and scalable infrastructures. Learn how to optimize your servers with tools like NGINX modules by GetPageSpeed, Varnish Cache, and leverage platforms like RHEL and Rocky Linux for robust deployments. Each episode offers insights into enhancing server efficiency, speeding up websites, and fortifying against security threats. Whether you’re a developer, sysadmin, or tech enthusiast, join us to

technology

All Episodes

00:13:53

aws-lc NGINX in 2026: Why we still ship quictls

Scalable Stories ·

2026/10/09

Technical Briefing: NGINX TLS Backends — aws-lc Support, quictls Backports, and the OpenSSL 3.5 LTS Migration The Problem NGINX's TLS backend options have been constrained by two separate issues: compile-time incompatibilities with aws-lc, and the end-of-life status of the quictls fork that NGINX-MOD has historically shipped against. aws-lc header collisions. aws-lc and NGINX's old QUIC shim collided at compile time in 2024. This has now been resolved: NGINX upstream added aws-lc support in 1.2…

en-US

00:11:28

NGINX Dynamic TLS Records: An Honest Benchmark in 2026

Scalable Stories ·

2026/10/08

Technical Briefing: NGINX Dynamic TLS Records — An Honest Benchmark in 2026 The Problem NGINX's default sslbuffersize is 16 KB, and each TLS record of that size straddles roughly 12 TCP segments. On a lossy link, if a single segment drops, the receiver cannot deliver any byte of that record until retransmission completes — adding at least one full RTT to TTFB on a connection mid-slow-start. Cloudflare's 2015 ngxhttptlsdynsize patch (shipped in nginx-mod) was built to address this by ramping rec…

en-US

00:08:02

NGINX limit_req Per Hour, Day, Week, Month with...

Scalable Stories ·

2026/10/06

Technical Briefing: Sub-Hourly NGINX Rate Limits with NGINX-MOD The Problem Stock NGINX limitreqzone accepts only two rate units: r/s and r/m. A directive like rate=10r/h fails nginx -t with invalid rate, because the parser matches only those two suffixes and then attempts ngxatoi on the remainder. There is a second, quieter defect. Internally, upstream stores the rate as milli-requests-per-second: ctx->rate = rate 1000 / scale This silently truncates rates slower than roughly 4r/h to zero, so…

en-US

00:07:55

Whitelist OpenAI IP Ranges in NGINX and fail2ban

Scalable Stories ·

2026/10/05

Technical Briefing: Keeping OpenAI Crawlers Unblocked — IP Feeds, NGINX Rate-Limit Bypass, and fail2ban Exemptions The Problem OpenAI publishes three crawler IP feeds — GPTBot, ChatGPT-User, and OAI-SearchBot — as JSON, each with a creationTime field and a prefixes array of ipv4Prefix entries. These ranges live in Microsoft Azure space and rotate, so any hard-coded list goes stale quickly. The practical failure mode is silent: robots.txt alone is insufficient. Rate limiting (limitreq/limitconn)…

en-US

00:07:57

NGINX Microcaching: Full-Page Caching Without Varnish

Scalable Stories ·

2026/10/04

Technical Briefing: NGINX Microcaching — Varnish-Style Full-Page Caching with Stock Directives The Problem Full-page caching typically means standing up a second daemon (Varnish), a second port, and a second configuration language alongside NGINX. That operational overhead is real: an extra process to monitor, an extra config surface to maintain, and an extra hop in the request path. The question this technique answers is whether the common case — serving mostly-anonymous pages fast and shieldi…

en-US

00:13:54

zlib-ng vs zlib in NGINX: Benchmark and Methodology

Scalable Stories ·

2026/10/03

Technical Briefing: zlib-ng vs Stock zlib Under NGINX — Measured, Not Assumed The Problem Vendor benchmarks for zlib-ng typically compress one big buffer in a single call against a synthetic corpus. NGINX does not work that way. It feeds the compressor in small chunks, opens a fresh deflate stream per response, and wraps output in a gzip header. The question this evaluation answers is whether zlib-ng actually beats stock zlib under NGINX's real compression pattern — and the answer required buil…

en-US

00:14:59

NGINX Abuse Guard Module: Auto-Ban Scanners and Bots

Scalable Stories ·

2026/10/02

Technical Briefing: NGINX Abuse Guard — Banning Scanners by Response Status, Inside the Worker The Problem Public-facing NGINX servers are continuously probed. Scanners request paths like /wp-login.php, /.env, and /phpmyadmin, producing walls of 404s. Bots hitting locked-down admin endpoints generate 403s. Credential-stuffing runs produce failed logins. The signal is asymmetry: legitimate visitors almost never burst errors, while abusive clients do. Existing tools address this imperfectly: limi…

en-US

00:11:07

NGINX Module Version Mismatch: When APT Lets It Through

Scalable Stories ·

2026/10/01

Technical Briefing: NGINX Dynamic Module ABI Mismatch — Why apt-get upgrade Can Wedge Your Server The Problem NGINX dynamic modules are validated at load time, not install time. The loader in src/core/ngxmodule.c performs two checks in order: An exact version match: module->version != nginxversion (e.g. 1029008 = 1.29.8 vs 1031005 = 1.31.5). A signature string comparison against NGXMODULESIGNATURE. The signature encodes pointer/type sizes and feature bits (epoll, threads, file AIO, QUIC, SSL) b…

en-US

00:08:30

NGINX ACME Module: Let’s Encrypt SSL Without Certbot

Scalable Stories ·

2026/09/30

Technical Briefing: Native ACME Support in NGINX via nginx-module-acme The Problem SSL certificate renewal for NGINX has traditionally depended on external tooling — Certbot, cron jobs, Python dependencies, and deploy hooks. That pipeline is a separate moving part from the web server itself, and it has to be maintained alongside it. The Fix NGINX now has a native ACME module (nginx-module-acme) that lets NGINX itself speak ACMEv2 to Let's Encrypt. Certbot, cron jobs, Python dependencies, and de…

en-US

00:11:37

Trusted IP Lists for FirewallD, NGINX and fail2ban

Scalable Stories ·

2026/09/29

Technical Briefing: Trusted IP List Packages for FirewallD, NGINX, and fail2ban The Problem Hardcoded allowlists for services like Stripe webhooks, Cloudflare, and Googlebot go stale silently. When vendors rotate their published IP ranges, existing allowlists stop matching — breaking integrations or blocking legitimate traffic without any obvious failure signal. The Fix The GetPageSpeed trusted-lists project packages current, officially published IP ranges for 30+ services as RPM packages. A dn…

en-US

00:10:49

Migrate From the ondrej nginx PPA to GetPageSpeed

Scalable Stories ·

2026/09/28

Technical Briefing: Migrating Off the Deprecated ondrej/nginx Module Packages The Problem At NGINX 1.28 (stable, announced April 2025), the maintainer of the ondrej nginx PPA dropped the mainline module packages. The stated reasons: recompiling every external module for each upstream patch release is unsustainable, and mainline adoption was low. Separately, Ubuntu's nginx-extras stopped accepting new third-party modules long ago. The practical consequence is that configs relying on loadmodule l…

en-US

00:08:29

The official Amplify app is now on iPhone

Scalable Stories ·

2026/09/27

Technical Briefing: GetPageSpeed Amplify iPhone App The Problem F5's hosted NGINX Amplify reached end of life on January 31, 2026. Users of that service needed a continuing path for the familiar agent-based monitoring of NGINX and related services. The Fix GetPageSpeed Amplify continues to run the familiar agent and a compatible API, with a modern dashboard for monitoring NGINX, Varnish, PHP-FPM, MySQL, and websites. The official iPhone app for GetPageSpeed Amplify is now available. What the Ap…

en-US

00:11:38

NGINX Accept-Language Redirects: No Lua Required

Scalable Stories ·

2026/09/26

Technical Briefing: NGINX Accept-Language Module — Header-Based Language Detection The Problem Stock NGINX cannot parse the Accept-Language header. Language-based redirects therefore typically require a map block full of regexes, an njs script, or a full OpenResty/Lua layer. Real headers are messy: fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, ;q=0.5 They include regional subtags, quality values, spaces, and wildcards — all painful to match correctly. The Fix The NGINX Accept-Language module provides a…

en-US

00:10:40

NGINX Variables: Scope, Handlers, and Common Pitfalls

Scalable Stories ·

2026/09/25

Technical Briefing: NGINX Variables — Semantics, Caching, and Scope The Problem NGINX variables look like scripting variables but do not behave like them. Three rules govern their behavior, and violating any of them produces either a startup failure or a silent, hard-to-diagnose bug: A variable must be introduced by a directive (set, map, geo) or exported by a module. Referencing anything else causes NGINX to refuse to start with nginx: [emerg] unknown "foo" variable. The name is global to the…

en-US

00:11:58

Serve WP Rocket Cache Directly from Nginx Without PHP

Scalable Stories ·

2026/09/24

Technical Briefing: WP Rocket Nginx Plugin — Direct Static Cache Delivery The Problem On a self-managed Nginx server running WP Rocket, a cached request still travels the long way around: Nginx → PHP-FPM → PHP cache loader → cached HTML file. The HTML file already exists on disk, but PHP-FPM is still involved in handing it back. That occupies a limited PHP-FPM worker for work Nginx is better suited to do. The cost is most visible during traffic bursts: every direct cache hit that consumes a PHP…

en-US

00:14:04

NGINX ESI: Replace Varnish for Magento 2

Scalable Stories ·

2026/09/22

Technical Briefing: NGINX ESI as a Varnish Replacement for Magento 2 The Problem Running Magento 2 behind Varnish means operating a second proxy, a second configuration language (VCL), and a second cache lifecycle in the request path — all sitting between NGINX and the application. The question this work addresses is whether NGINX can own the entire edge path itself: proxy, cache, TLS, and ESI fragment assembly, without Varnish. The Implementation nginx-module-esi was built for exactly this pur…

en-US

00:11:33

Encrypted Client Hello in NGINX: Now Shipping in Our...

Scalable Stories ·

2026/09/21

Technical Briefing: Encrypted Client Hello (ECH) in GetPageSpeed NGINX Packages The Problem: The Last Plaintext Leak in TLS 1.3 TLS 1.3 encrypts nearly everything in the handshake except one field: the SNI (Server Name Indication). Even with a fully modern TLS 1.3 deployment, an on-path observer can read exactly which hostname a client is requesting. For multi-tenant hosting, CDNs, and shared front ends, this is a meaningful privacy gap — the observer learns which site among many on the same se…

en-US

00:19:28

NGINX Post-Quantum TLS: X25519MLKEM768 with OpenSSL 3.5

Scalable Stories ·

2026/09/20

Technical Briefing: NGINX Post-Quantum TLS — X25519MLKEM768 with OpenSSL 3.5 The Problem: Harvest Now, Decrypt Later The threat model is not a quantum computer breaking TLS today — it is an attacker recording encrypted traffic now and decrypting it once a cryptographically relevant quantum computer exists. Session cookies expire in hours, but health records, contracts, source trees, and private keys remain sensitive for a decade or more. The precise vulnerability matters: Shor's algorithm break…

en-US

00:10:05

Parallel ESI for Varnish 6.0 LTS: vmod-pesi Now Packaged

Scalable Stories ·

2026/09/19

Technical Briefing: Parallel ESI for Varnish 6.0 LTS via vmod-pesi The Problem: Sequential ESI Fragment Assembly Stock open-source Varnish processes ESI includes sequentially. A page containing two uncached fragments that each take 2 seconds to render therefore takes over 4 seconds to assemble — the total is the sum of fragment latencies, not the maximum. This is a structural limitation of the open-source daemon, not a configuration issue. The Implementation: A Backport of libvdp-pesi GetPageSp…

en-US

00:09:32

NGINX QUIC reuseport: HTTP/3 Silently Breaks Without It

Scalable Stories ·

2026/09/18

Technical Briefing: NGINX HTTP/3 reuseport, quicbpf, and SELinux The Problem: HTTP/3 Silently Fails Without reuseport With workerprocesses greater than 1, a QUIC listener configured without reuseport shares a single UDP socket across all workers. Because QUIC has no accept() step, every datagram arrives on that one socket, and whichever worker wakes first grabs it — even if it does not own that connection. The owning worker then receives mid-connection datagrams it cannot handle, producing H3RE…

en-US

34 results

Similar Podcasts

Lead With AI

Tamara Nall

ev.news

Martyn Lee

Life and Technology with Charlie Brown

Tapt Media

Reflections

Livewire Labs

SuperToast

Instinct