So 'tis the season to stand up a new e-commerce site, or so it seems. In the last week, I've setup two separate Magento instances for two different friends in the industry.

If you haven't heard of Magento, it's a dual-licensed open-source e-commerce platform used by quite a few of the top storefronts in that market space (e.g. Nike, Rovio, Oylmpus, Fiji Water, Office Max, Volcom, etc). It's regularly audited for bugs and security holes, and overall functions fairly well. Unfortunately, it was also written specifically against Apache, and therefore relies heavily on Apache-specific behavior (lots of rewrites, .htaccess hacks, direct interaction with certain Apache modules via PHP, etc). Thus, it frankly scales like crap without a decent load balancer, it's trivial to DoS, and requires many hours of tuning and tinkering to be ready for real customer traffic.

   Thankfully, in the wake of Heartbleed people have been much more receptive to looking beyond "safe" technologies like Apache and OpenSSL, thus leaving the door open to alternative stacks. 

    With #Hiawatha 's new-ish ReverseProxy functionality, I was able to support 10x the traffic of vanilla Apache, 30% more simultaneous TLS handshakes, and make it completely immune to SlowLoris/slowheaders style DoS (mirroring the results Hugo Leisink published last month: I was also able to make Apache's memory footprint much more predictable, forcing it to spawn a specific number of static forks instead of allowing the normal balloon behavior which fragments memory and eats precious CPU time. So while it's not quite as fast as Hiawatha + php5-fpm would be, it's not too far off. Add to this Hiawatha's ability to cache up to 100M of proxied static content and it's lower-latency than vanilla Apache as well, giving users a snappier, more professional feeling interface.
Shared publiclyView activity