Varnish Cache is an HTTP reverse proxy that stores eligible responses in memory and serves later requests without contacting your application each time. On a Linux VPS, the reliable setup is to place Varnish on the public HTTP port, move Nginx, Apache, or your application to an internal port, define that origin in /etc/varnish/default.vcl, and manage the daemon with systemd. The example values used in the official documentation—listener port 6081, public port 80, backend port 8080, and malloc,2g storage—are examples, not universal requirements.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What Varnish does on a VPS
Varnish sits between clients and an origin server. The origin may be Nginx, Apache, a framework application, or another HTTP service. For a cacheable response, Varnish stores the response object and can answer subsequent requests directly from memory. Requests that are personalized, unsafe, explicitly bypassed, or otherwise unsuitable for caching are passed to the origin instead.
As an Amazon Associate I earn from qualifying purchases.
This arrangement can reduce repeated work for the origin, but it does not automatically make every site faster. Results depend on cache policy, traffic patterns, response headers, available memory, and how much content is personalized. The installation guide and service examples provide configuration values, not benchmarked speed-ups or cache-hit percentages.
Request flow
- A client connects to Varnish on the public HTTP listener.
- Varnish evaluates the request in VCL (Varnish Configuration Language).
- On a cache hit, it returns the stored object without contacting the backend.
- On a miss, pass, or fetch, it contacts the backend defined in
default.vcl. - The response is stored only when the VCL policy and response headers permit it.
Why the origin must be protected
If Nginx, Apache, or the application remains reachable from the Internet on its own public address and port, clients can bypass Varnish and defeat your cache and security rules. Bind the origin to localhost or a private interface where practical, and expose only the Varnish listener through the firewall.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Before you install
- A VPS with root or
sudoaccess. - A supported Debian/Ubuntu release or a Red Hat Enterprise Linux-compatible distribution.
- An existing HTTP origin and its actual listening address and port.
- Enough RAM for the operating system, Varnish, and the origin. Cache storage is only one consumer.
- A maintenance window if you must change the existing web server’s public port.
Identify the distribution and release first. Varnish’s official installation index separates Debian/Ubuntu instructions from Red Hat Enterprise Linux-compatible, Docker, and Kubernetes procedures. Package versions, repository URLs, signing-key commands, supported releases, and packaged unit files change over time, so use the current instructions for your exact distribution before adding a repository.
Install Varnish on Debian or Ubuntu
1. Add the official repository and signing key
Follow the current Debian/Ubuntu path in the official Varnish installation documentation to register the repository and its signing key for your release. Do not copy a repository entry for a different Ubuntu or Debian version. A repository that does not match the operating-system release can produce dependency failures or install an unsupported package.
2. Refresh package metadata
sudo apt-get updateRead any signature or release-file errors rather than proceeding. A missing or invalid signing key should be corrected using the current vendor instructions; do not disable APT signature verification.
3. Install the package
sudo apt-get install varnishThe package installs the varnishd daemon, systemd integration, a default VCL file, and distribution-specific configuration paths. The quick-start guidance advises Varnish Cache 6.0 LTS as a stable, supported version; confirm which LTS or current supported branch your repository offers today.
Red Hat Enterprise Linux-compatible systems
Use the separate official repository path for your RHEL-compatible distribution rather than applying Debian commands. The package manager and unit-file defaults differ, although the concepts—listener, storage, backend, VCL, and systemd—remain the same.
Understand the systemd service
On Debian and Ubuntu, the packaged unit is commonly /lib/systemd/system/varnish.service. Treat that file as vendor-managed: package upgrades can replace it. Put local changes in a systemd override or an edited full copy under /etc/systemd/system.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Inspect the effective unit
systemctl cat varnish
systemctl status varnishLook for the ExecStart command. It determines the listening address and port, VCL file, and storage arguments. Inspecting the unit before editing prevents you from configuring one file while systemd starts another command.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Choose an override method
For a focused change, create a drop-in:
sudo systemctl edit varnishFor a complete replacement of the packaged unit, use:
sudo systemctl edit --full varnishDrop-ins are normally stored below /etc/systemd/system/varnish.service.d/; a full local unit is stored under /etc/systemd/system/. Keep a record of local changes so a later package upgrade can be reviewed safely.
Set the listener and cache storage
Listener ports
The conservative example in the documentation listens on port 6081. A reverse-proxy deployment commonly changes the listener to port 80 so browsers and upstream TLS termination reach Varnish on the normal HTTP port. If another service already owns port 80, stop it, move it to an internal port, or use a different architecture. Only one process can bind the same address and port.
Varnish does not terminate TLS by itself in the usual deployment. Keep HTTPS termination in a TLS-capable frontend and forward HTTP to Varnish, or use a supported TLS proxy arrangement. Do not advertise an HTTPS endpoint that is actually serving unencrypted traffic.
Memory storage
The documented example uses -s malloc,2g. This allocates a 2 GB in-memory storage area; it is not a claim that every VPS needs 2 GB or that the cache will improve performance by a fixed amount. Select a size that leaves headroom for the kernel, Varnish overhead, the origin, logs, and other services. Excessive allocation can trigger swapping or an out-of-memory kill.
A representative ExecStart command may look like this, but retain the other arguments from your packaged unit and adapt paths and ports to your system:
/usr/sbin/varnishd -a :80 -T localhost:6082 -f /etc/varnish/default.vcl -s malloc,2gThe management interface address and port in a vendor unit may differ. Do not expose the management interface publicly.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Apply unit changes
sudo systemctl daemon-reload
sudo systemctl enable varnish
sudo systemctl restart varnish
sudo systemctl status varnishdaemon-reload makes systemd reread unit files. enable makes the service start at boot; it does not start it immediately. restart applies the listener, storage, and VCL command-line changes. If the service fails, inspect the status output and journal before changing more settings.
Point Varnish at Nginx, Apache, or an application
Edit /etc/varnish/default.vcl. The standard sample backend points to 127.0.0.1 on port 8080. That works only when your origin really listens there.
vcl 4.1;
backend default {
.host = "127.0.0.1";
.port = "8080";
}Replace .host and .port with the address and port used by your Nginx, Apache, application server, or other origin. Verify the origin independently before involving Varnish:
curl -I http://127.0.0.1:8080/If the origin binds only to a Unix socket, configure an HTTP listener on a local TCP address or use a Varnish version and integration that supports your socket arrangement. A DNS name in a backend is resolved when VCL is compiled. If the name’s address changes, reload or restart Varnish so the VCL is compiled again with the new resolution.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteMove the origin off the public port
Configure Nginx or Apache to listen on the internal port selected for the backend, such as 8080, and reload that service. Keep its virtual-host configuration, document root, application proxying, and TLS behavior consistent with the new listener. Then restrict the firewall and service bindings so clients cannot reach the origin directly.
Build a safe, useful VCL policy
The default VCL supplies sensible baseline behavior, but production sites usually add explicit rules for authentication, administration, cookies, methods, and invalidation. Make one policy decision at a time and validate the file before restarting.
Bypass personalized and administrative requests
Logged-in pages, carts, account screens, preview URLs, and administration paths commonly contain user-specific data. They should normally pass to the backend rather than enter a shared cache. A simple pattern is:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sub vcl_recv {
if (req.method != "GET" && req.method != "HEAD") {
return (pass);
}
if (req.url ~ "^/admin/" || req.url ~ "^/login") {
return (pass);
}
if (req.http.Authorization) {
return (pass);
}
}Adjust paths to your application. A blanket cookie bypass is safer for an unknown application but can eliminate most cache opportunities; inspect which cookies actually identify a session before writing a narrower rule.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Control response caching
Origin response headers such as Cache-Control: private, no-cache, or no-store carry important freshness and privacy signals. Do not strip them simply to increase hit rates. If you intentionally override an origin policy, document the reason and test authenticated and anonymous requests separately.
Preserve useful client information
Ensure the origin receives the original host and client context required by the application. Varnish commonly forwards the host header by default, but custom VCL should not overwrite it accidentally. If your application needs the original client IP, configure and trust the forwarding chain deliberately; never trust an arbitrary client-supplied forwarding header.
Reload after VCL edits
Compile and load the VCL through the service’s normal restart or reload procedure. A syntax error prevents the new configuration from loading. Keep the last known-good VCL available so you can restore service quickly.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Purge and invalidate cached objects safely
Purging removes cached content before its normal lifetime. It is useful after publishing or correcting content, but an unrestricted purge endpoint lets anyone flush the cache or use the proxy as an administrative target.
Restrict PURGE with an ACL
The security guidance strongly recommends restricting administrative HTTP requests such as PURGE to trusted IP addresses or networks with a VCL access-control list. Define the trusted addresses and reject everyone else:
acl purge {
"127.0.0.1";
"203.0.113.10";
}
sub vcl_recv {
if (req.method == "PURGE") {
if (!client.ip ~ purge) {
return (synth(403, "Not allowed"));
}
return (purge);
}
}The address 203.0.113.10 is documentation-only; replace it with the real trusted management address or remove it. Keep purge access private, log its use, and avoid accepting purge requests from the public Internet.
Choose a purge strategy
- URL purge: remove one known object after a content change.
- Tag or surrogate-key purge: useful when your application emits cache tags and your VCL implements matching invalidation.
- Broad purge or restart: simple during emergency recovery but causes a cold cache and increased origin load.
Use the narrowest invalidation that makes the content correct. A restart is not a substitute for a designed purge workflow.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Verify that the proxy works
Check the public response
curl -I http://your-domain.example/Confirm that the request reaches Varnish and that the status code and headers match the expected origin response. Send the request twice and examine your configured cache indicators or logs; the first request may fetch from the origin while the second can be a hit if the response is cacheable.
Check the origin separately
curl -I http://127.0.0.1:8080/If the direct request fails, fix the origin before troubleshooting Varnish. If the direct request works but the public request fails, inspect the listener address, firewall, backend definition, and service logs.
Observe service and request behavior
systemctl status varnish
journalctl -u varnish -eUse your distribution’s Varnish logging tools to distinguish hits, misses, passes, backend errors, and purges. Watch memory and swap usage while warming the cache; a cache that forces the VPS into swap is counterproductive.
Common failures and fixes
“Address already in use”
Another process owns the configured listener, often Nginx or Apache on port 80. Identify the owner, move the origin to its internal port, or select a different Varnish listener. Do not run two services on the same address and port.
Recommended Free Tools
502 or backend connection errors
Check that the backend host and port in default.vcl match the origin, that the origin is running, and that local firewall rules permit the connection. Test the backend with curl from the VPS.
Every request is a miss
Look for Set-Cookie, authorization headers, private or no-store cache directives, query-string variations, and VCL rules returning pass. Personalized traffic should remain a pass; do not force it into a shared cache merely to increase a counter.
Stale content remains after a deployment
Use the authenticated purge workflow, or wait for the configured freshness lifetime if that is acceptable. Confirm that the purge request originates from an ACL-approved address and that VCL reloads after changes.
VCL compiles before DNS changes take effect
Because a backend hostname is resolved when VCL is compiled, reload Varnish after changing that hostname’s DNS address. Also verify that local DNS resolution on the VPS returns the intended address.
Varnish will not start after an edit
Read systemctl status varnish and journalctl -u varnish for the exact parse or command-line error. Restore the previous working unit or VCL, run a configuration validation appropriate to your installed version, and then reapply changes incrementally.
Quick Recap
Distribution and policy decisions
| Decision | What to evaluate | Operational consequence |
|---|---|---|
| Distribution package path | Package freshness, vendor support, repository signing, and compatibility with the VPS release | Use the repository instructions that match the exact operating-system release; do not mix distribution commands |
| Listener port | Whether a TLS frontend or origin already owns the address | Port 80 is a common reverse-proxy choice; 6081 is a documented conservative example |
| Backend endpoint | The actual local address and port used by Nginx, Apache, or the application | The documented 127.0.0.1:8080 value works only when the origin listens there |
| Storage size | Available RAM after the OS and origin are accounted for | malloc,2g is an example; oversized storage can cause swapping or out-of-memory failures |
| Cache policy | Hit ratio versus freshness, personalized traffic, and invalidation needs | More caching can reduce origin work, but unsafe caching can expose private data or stale content |
Security and maintenance checklist
- Install from a signed, current repository path for the exact VPS distribution.
- Keep the Varnish management interface bound to a trusted local address.
- Expose Varnish publicly, not the origin, unless a deliberate architecture requires otherwise.
- Bypass authentication, administration, and other personalized traffic.
- Protect
PURGEand other administrative methods with VCL ACLs. - Choose cache storage only after reserving memory for the OS and origin.
- Reload VCL after backend DNS changes.
- Review the packaged systemd unit after upgrades; keep local overrides under
/etc/systemd/system. - Monitor origin errors, cache behavior, memory, swap, and disk space used by logs.
- Test anonymous, authenticated, uncached, purged, and origin-error requests before declaring the deployment complete.
A practical deployment sequence
- Record the VPS distribution, release, origin listener, firewall rules, and available memory.
- Follow the current official repository and signing-key instructions for that distribution.
- Run
sudo apt-get updateandsudo apt-get install varnishon Debian or Ubuntu, or the equivalent commands for a RHEL-compatible system. - Inspect
systemctl cat varnishand decide whether to use a drop-in or full unit override. - Move the origin to an internal address and verify it with a direct
curlrequest. - Set the Varnish listener and memory storage, adapting the documented 80/6081 and
malloc,2gexamples to the VPS. - Edit
/etc/varnish/default.vclwith the real backend host and port and explicit bypass rules. - Add an ACL-protected purge policy if your publishing workflow requires invalidation.
- Run
sudo systemctl daemon-reload, enable the service, and restart it. - Verify direct-origin and public-proxy requests, then monitor logs and memory while traffic warms the cache.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
