2

I'm using a HTTPS connection for my webshop to have a secure connection for my users, but now I would like to add Varnish for faster pageloads but which doesn't support SSL.

So the idea to still implement Varnish is this setup:enter image description here

Well except for User A cause I redirect all users to use the https:// webaddress. So the user connects to the server with a HTTPS connection, Nginx terminates HTTPS so varnish can be used.

But my question: What is a save connection between my Varnish server and my actual Back-end server (the LAMP server in this case, which is a LEMP server in my case)? Cause I was thinking of private networking at Digital Ocean (where my current servers are hosted). But their servers with 4GB of RAM (which I would like to use for Varnish) are quite expensive!

So I was thinking of getting a bit more affordable server with 4GB of RAM somewhere else as my Varnish server, in a different datacenter, and connect to my back-end server at Digital Ocean. But in that case I cannot use private networking. But is this OK or not that safe?

Is it safe to have a non-https connection between my varnish server and back-end server? I suppose it's just OK, but to be sure, I hope someone over here can give me some advice.

Improve this question
1
  • Worth reading about Cloud Flare Flexible SSL and the criticisms of it.
    – paj28
    Jul 29, 2016 at 11:08

1 Answer 1

Reset to default
0

If Varnish_VPS and LAMP_VPS are not in the same trusted network, you need encryption (and authentication) between both. If you don't, other users on the network of either cloud provider can sniff or manipulate your data.

There are a couple of ways you can do this:

  • HTTPS - could be self-signed, because you have full control over the client (Varnish).
  • VPN - this makes it seem that the servers are both in the same network, which is useful for other data besides HTTP.
  • SSH tunnel - a poor man's VPN. This could be fragile because it is not really meant for permanent use.
Improve this answer
3
  • Thanks Sjoerd! HTTPS is a no-go cause Varnish doesn't support that. Guess VPN would be a nice solution. I'll think about it, maybe I'll still move both servers to the same datacenter, who knows. But good to know VPN would be a solution. Thanks again.
    – Erik van de Ven
    Jul 29, 2016 at 9:26
  • You can use stunnel between Varnish and LAMP_VPS to make an HTTPS connection even when Varnish doesn't support it.
    – Sjoerd
    Jul 29, 2016 at 9:31
  • Ah didn't knew that! I'll definitely look into that, thanks!
    – Erik van de Ven
    Jul 29, 2016 at 9:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .