For a clustered web server, put Varnish in front of two or more nginx origin nodes, declare each node as a Varnish backend, and join them with the vmod_directors VMOD. Add a probe to every backend so unhealthy nginx servers are removed automatically. If the cache tier itself must survive a node loss, put a load balancer in front of multiple Varnish instances or use Varnish Enterprise Cluster.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The configuration below covers origin load balancing, health-based failover, cache policy, invalidation, and the tests that prove the cluster works. It uses three example nginx addresses; substitute the addresses and ports used in your network.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Understand the roles in the cluster
nginx and Varnish solve different problems. nginx is the origin-facing web tier: it can serve static files, reverse-proxy application workers, or balance requests across application servers. Varnish is the HTTP cache and backend-routing tier. A request normally follows this path:
Client
|
v
Varnish cache node(s)
|
+-- nginx origin 10.0.0.11
+-- nginx origin 10.0.0.12
+-- nginx origin 10.0.0.13
|
+-- application workers or local filesVarnish documentation describes defining multiple backends and joining them into backend clusters for load balancing. nginx documentation likewise describes nginx as an HTTP load balancer for distributing traffic to several application servers and improving scalability and reliability. Keep those layers conceptually separate: a Varnish director chooses an origin for a cache miss, while an nginx upstream group chooses an application server behind one origin.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Choose how to make the cache tier highly available
Multiple nginx origins do not, by themselves, make Varnish highly available. If one Varnish process or host fails, clients still need another cache node to receive traffic.
| Design | Cache ownership | Failure behavior | Operational trade-off |
|---|---|---|---|
| One Varnish node with several nginx backends | One cache; no duplication | Origin failure is handled, but Varnish failure is an outage | Simplest and useful for a single-host cache |
| Load balancer in front of independent Varnish nodes | Each node has its own cache; objects may be duplicated | The load balancer sends new connections to surviving Varnish nodes | Easier to operate than a coordinated cluster, but invalidation must reach every node |
| Varnish Enterprise Cluster | Cluster nodes coordinate cache ownership | Node membership and health probes let traffic and cache lookups continue across nodes | Adds commercial features, TLS between nodes, and cluster-specific configuration |
Use the independent-node design when straightforward failover and simple operations matter more than eliminating duplicate objects. Use Enterprise Cluster when coordinated ownership, inter-node health, and cache-aware routing justify the additional configuration and licensing. In either design, keep the nginx origins redundant.
Prepare the network and origins
Give each origin a stable address
Reserve a stable address or DNS name for every nginx node. Varnish must be able to connect to the origin port, normally TCP 80 or 443, and the origin firewall should accept traffic from the Varnish nodes only. Do not point a backend at a client-facing load-balancer address if you need to identify and remove individual nginx nodes.
Provide a cheap health endpoint
Create an endpoint that returns HTTP 200 without a login, session cookie, database query, or other dependency that can fail independently of nginx. For example:
server {
listen 80;
server_name origin-1.example.internal;
location = /health {
access_log off;
default_type text/plain;
return 200 "okn";
}
# Static files and application proxy locations follow here.
}Install the same endpoint on every origin. A probe that depends on a database can mark an otherwise healthy web server down; keep the endpoint focused on the failure you want Varnish to detect.
Optionally balance application workers in nginx
If each nginx node fronts several application servers, define an nginx upstream group. Choose HTTP or HTTPS according to the protocol spoken by those workers:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
upstream app_workers {
server 10.0.1.21:8080;
server 10.0.1.22:8080;
}
server {
listen 80;
server_name origin-1.example.internal;
location / {
proxy_pass http://app_workers;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}nginx can distribute traffic to those application servers, while Varnish distributes cache misses among the nginx nodes. The official nginx documentation notes that its commercial edition adds application health checks, activity monitoring, and on-the-fly server-group reconfiguration; the open configuration above does not assume those features.
Define nginx nodes as Varnish backends
Create one backend block per origin
In the VCL file loaded by Varnish, define each nginx node explicitly. The timeout values below are starting points, not universal limits; set them from the response times and capacity of your application.
vcl 4.1;
import directors;
backend origin1 {
.host = "10.0.0.11";
.port = "80";
.connect_timeout = 3s;
.first_byte_timeout = 30s;
.between_bytes_timeout = 10s;
.last_byte_timeout = 30s;
.max_connections = 200;
.probe = {
.url = "/health";
.timeout = 2s;
.interval = 5s;
.window = 8;
.initial = 2;
.threshold = 3;
}
}
backend origin2 {
.host = "10.0.0.12";
.port = "80";
.connect_timeout = 3s;
.first_byte_timeout = 30s;
.between_bytes_timeout = 10s;
.last_byte_timeout = 30s;
.max_connections = 200;
.probe = {
.url = "/health";
.timeout = 2s;
.interval = 5s;
.window = 8;
.initial = 2;
.threshold = 3;
}
}
backend origin3 {
.host = "10.0.0.13";
.port = "80";
.connect_timeout = 3s;
.first_byte_timeout = 30s;
.between_bytes_timeout = 10s;
.last_byte_timeout = 30s;
.max_connections = 200;
.probe = {
.url = "/health";
.timeout = 2s;
.interval = 5s;
.window = 8;
.initial = 2;
.threshold = 3;
}
}
sub vcl_init {
new origin_pool = directors.round_robin();
origin_pool.add_backend(origin1);
origin_pool.add_backend(origin2);
origin_pool.add_backend(origin3);
}
sub vcl_recv {
set req.backend_hint = origin_pool.backend();
}connect_timeout limits connection establishment. first_byte_timeout limits the wait for the first response byte, between_bytes_timeout limits the gap between response bytes, last_byte_timeout limits completion, and max_connections caps simultaneous connections to that backend. Tune each value to the slowest legitimate request, while preventing a stalled origin from consuming all Varnish worker capacity.
Select round-robin or hash routing
Round-robin is predictable: successive eligible requests are distributed across healthy origins. It is a good default when all nodes have similar capacity and sessions are stored centrally.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHash-based routing keeps a given hash key associated with one backend while that backend remains available. That can improve cache locality and reduce repeated misses, but distribution can become uneven when keys are skewed or nodes are added. The director choice is therefore a workload decision: choose round-robin for simple even distribution, or hash when request-to-node affinity has a measurable benefit.
A hash director can replace the round-robin director in vcl_init:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
sub vcl_init {
new origin_pool = directors.hash();
origin_pool.add_backend(origin1, 1);
origin_pool.add_backend(origin2, 1);
origin_pool.add_backend(origin3, 1);
}Keep the same set req.backend_hint = origin_pool.backend(); assignment in vcl_recv. Every director considers probe state, so a sick backend is not selected for normal traffic.
Configure probes and understand failover
For each backend, Varnish sends the configured probe URL and records recent results. The documented defaults are a five-second interval, a two-second timeout, an eight-sample polling window, two successful initial polls, and three successes required to become healthy.
| Probe setting | Example value | Meaning |
|---|---|---|
.url |
/health |
Path requested on the origin |
.interval |
5s |
Time between probe attempts |
.timeout |
2s |
Maximum wait for the probe response |
.window |
8 |
Number of recent samples considered |
.initial |
2 |
Successful polls needed during startup |
.threshold |
3 |
Successful samples needed to mark a backend healthy |
When a node becomes sick, the director removes it from rotation. Existing requests may still fail if they were already connected, but new cache misses are sent to healthy nodes. After enough successful probes, the node is eligible again. Probe timing is deliberately not instant; allow for the interval, timeout, and threshold when defining an operational alert.
Check state with:
varnishadm backend.list -pThe output should show every expected backend and its probe status. If a node is sick, test the endpoint from the Varnish host, inspect nginx access and error logs, and verify firewall rules before changing VCL.
Serve stale content during an origin outage
Varnish can serve stale objects when all backends are down. Define a grace period appropriate to the freshness requirements of the site:
sub vcl_backend_response {
set beresp.grace = 5m;
}This is a resilience choice, not a replacement for fixing the origin. A five-minute grace period means an object may be older than its normal TTL while Varnish waits for a healthy backend. Do not use stale serving for responses whose correctness or authorization cannot tolerate it.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Set a safe cache policy
Load balancing is only useful if Varnish makes the right cache decisions. Start in vcl_recv by limiting caching to methods that are safe for your application and bypassing requests that carry user-specific state:
sub vcl_recv {
set req.backend_hint = origin_pool.backend();
if (req.method != "GET" && req.method != "HEAD") {
return (pass);
}
if (req.http.Authorization) {
return (pass);
}
if (req.http.Cookie ~ "(^|;)(session|cart|logged_in)=") {
return (pass);
}
}Adjust the cookie names to the application. Some public pages set harmless analytics cookies, while others embed account data; a blanket cookie bypass can destroy hit rate, and an overly permissive rule can leak personalized content.
In vcl_backend_response, mark responses that should never be stored as uncacheable and set a grace period for cacheable content:
sub vcl_backend_response {
if (beresp.http.Set-Cookie || beresp.http.Authorization) {
set beresp.uncacheable = true;
return (deliver);
}
set beresp.grace = 5m;
}Normalize URLs and headers only when the transformation is known to preserve application semantics. Keep the cache key identical across origins; otherwise the same object can be stored under different keys and appear inconsistent.
Make multiple Varnish nodes available
Independent Varnish nodes behind a load balancer
Place a front-end load balancer in front of two or more Varnish hosts. Its health check should verify that Varnish is accepting HTTP traffic, not merely that the host responds to ICMP. Each Varnish node can use the same backend director and probe definitions.
Because caches are independent, the first request for an object on each node can be a miss. More importantly, a purge sent to one node does not remove the object from its peers. Build invalidation fan-out into the deployment system or send the same ban to every cache node.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Varnish Enterprise Cluster
The Enterprise cluster documentation describes node membership, cache ownership, health probes between cluster nodes, TLS between nodes, and Helm-based deployment. In this design, configure the cluster network separately from client traffic and protect inter-node TLS keys and certificates.
Enterprise cluster validation uses a synthetic health response in vcl_recv, then checks membership with:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →varnishadm backend.list -pFor a cacheable object, use curl -I and enable X-Cluster-Trace when tracing cluster paths. Trace an uncached object first so the request path and cache owner are visible; disable tracing after diagnosis because response headers can expose internal topology.
Coordinate invalidation during deployments
A deployment that updates nginx files or application output does not automatically remove an old object from Varnish. The Varnish CLI ban mechanism marks matching objects obsolete so subsequent requests fetch fresh responses from the backend.
Use a narrowly scoped expression, such as a URL prefix or deployment version header, rather than banning the entire cache for every release. In an independent-node design, run the controlled ban on every Varnish node. In a coordinated cluster, use the cluster’s documented invalidation path and confirm that all owners received it.
After the ban, request a representative URL and inspect the origin response headers or application logs to confirm that the updated object was fetched. Repeat this check through each public load-balancer path when caches are independent.
Free tools Windows power users keep installed
One-click scans. No signup required.
Validate the finished cluster
- Run
varnishadm backend.list -pand confirm that every nginx backend appears with the expected probe state. - Request a cacheable object twice:
curl -I http://your-site.example/path. The first request should reach an origin; the second should be served from cache. Use your configured cache headers or logs to distinguish a hit from a miss. - Stop or isolate one nginx node. Wait through the probe interval and threshold, then make new requests. They should continue through healthy origins, while the failed node is shown as sick.
- Restore the node and verify that successful probes return it to rotation only after the configured recovery threshold.
- If using Enterprise Cluster, enable
X-Cluster-Trace, request an uncached object, and inspect which node owns and serves the object. - Issue a controlled ban after a deployment and verify that every cache node re-fetches the updated response.
Troubleshoot common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| All backends are sick | The probe path is missing, blocked, or returns a non-200 response | Run the health URL from each Varnish host; inspect nginx logs and firewall rules |
| Traffic concentrates on one origin | Hash keys are uneven, or other nodes fail probes | Review director choice, probe state, and request-key distribution |
| Users see stale content after a release | Only one cache node received the ban | Fan out invalidation and test through every cache path |
| Requests time out under load | Backend timeout or connection limits do not match application capacity | Compare origin latency with first_byte_timeout, between_bytes_timeout, and max_connections |
| Personalized data is cached | Authorization or session cookies were not bypassed | Inspect vcl_recv rules and response Set-Cookie handling |
| Cluster tracing shows no path | The object was already cached or tracing was not enabled | Request an uncached URL and enable X-Cluster-Trace for the diagnostic request |
Operational decisions that prevent outages
- Keep the health endpoint independent of optional downstream services, but monitor those dependencies separately.
- Apply VCL changes to all Varnish nodes from the same version-controlled source.
- Protect the Varnish administration interface; expose
varnishadmonly to authorized operators. - Use TLS for client traffic where required and for inter-node traffic in an Enterprise Cluster.
- Alert on probe state changes, backend connection saturation, cache hit ratio, ban failures, and origin latency.
- Test a single-origin loss and a complete-origin loss during a maintenance window, including the stale-content behavior users will receive.
Which configuration should you use?
For most installations, begin with one Varnish node, three probed nginx backends, and a round-robin director. Add a load balancer and a second Varnish node when cache-tier failure must not interrupt service; automate bans across both nodes. Choose hash routing only when affinity or cache locality is a demonstrated requirement. Choose Varnish Enterprise Cluster when coordinated cache ownership, inter-node health, TLS, and cluster deployment controls outweigh the extra operational and licensing complexity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
