VayuPress Benchmarks

All numbers below are reproducible on commodity hardware and were measured on:

• CPU: 4-vCPU Intel Xeon @ 2.80 GHz
• RAM: 16 GB
• Storage: NVMe-backed container filesystem
• DB: SQLite in WAL mode (go-sqlite3, CGO)
• Go: the toolchain pinned in go.mod at the time (now go1.27.2)

Honesty note: the figures in this file were produced by actually running the harnesses described below. The cross-engine comparison table (vs. WordPress/Ghost/Hugo) is intentionally omitted until those engines are run on identical hardware — publishing unverified competitor numbers would be marketing, not measurement. Run make bench and the commands below to reproduce everything here.

0. In production: johal.in

The numbers that matter most are the ones a live install serves. johal.in runs 234,727 posts, fourteen sites and its mail server on one Contabo VPS 10 (read from its API, 16 October 2026).

0.1 A large archive, cold

A topic page not yet cached, on a local install of 235,000 posts with real post bodies (16 October 2026):

A cached page is served from disk in single-digit milliseconds. The difference is why the warmer builds cards before visitors ask (fillMissingCards).

1. End-to-end load (built-in harness)

The server ships a real load benchmark at POST /admin/benchmark: it writes a batch of articles through the async write queue, then drives concurrent reads against the cached render path and records a latency histogram.

curl -X POST -H "X-API-Key: $API_KEY" -H "X-CSRF-Token: $CSRF" \
     http://localhost:8080/admin/benchmark

2. Micro-benchmarks (go test -bench)

go test -bench=. -benchmem -run=^$ ./...

Zero-allocation hot paths: input validation, slug validation and all metrics recording allocate nothing per call — they impose no GC pressure under sustained load.

2.1 Analytics at scale

internal/analytics/bench_test.go writes a store through the ingest path itself and times the reads the console makes of it: fourteen sites over thirty days, a few sites taking most of the traffic and a few pages most of each site's views, visits of one to six views, one event in ten a custom event (24 October 2026, 4 vCPU Xeon @ 2.10 GHz).

A million events in thirty days is about ten times johal.in's rate. The overview reads grow a little faster than the events in their range (3.4 to 4.2 times for three times the events), most of it the exact count of distinct visitors; realtime reads only its five minutes and does not grow. This is why the Analytics pages are counted in a background cache and never on the request: the page is served from the last count while the next one runs. Ten million events was not run (the store would not fit the disk of the host measured on); growing as from 1M to 3M, it would put one site's overview near 0.7 s and every site's near 18 s, both in the background. That is an extrapolation, not a measurement.

2.2 VayuShield under load

internal/vayushield/load_test.go drives the shield's middleware at a fixed rate with recording on, rate limits, the jail and twenty operator rules, over a mix of readers on two thousand addresses, crawlers, scripts, scanners and a few flooding addresses. The time is the middleware's own, per request.

The costliest rule set the shield accepts, 100 rules of 16 conditions with every condition tested and none matching, costs 15 µs a request (BenchmarkMatchTheCostliestSetThatMisses, internal/vayushield/oprules).

3. Reproducing

# Micro-benchmarks
make bench

# Full sweep with allocation accounting
go test -bench=. -benchmem -run=^$ ./...

# Analytics at a million events (VP_BENCH_EVENTS, default 200,000)
VP_BENCH_EVENTS=1000000 go test -run '^$' -bench . -benchtime 20x ./internal/analytics/

# The shield under load (VP_SHIELD_RATES and VP_SHIELD_SECONDS to change the runs)
VP_SHIELD_LOAD=1 go test -run TestTheShieldUnderLoad -v ./internal/vayushield/

# Live end-to-end load against a running server
API_KEY=... DB_PATH=/tmp/bench.db ./vayupress &
curl -X POST -H "X-API-Key: $API_KEY" -H "X-CSRF-Token: $CSRF" \
     http://localhost:8080/admin/benchmark

4. Methodology & caveats

• Numbers are single-run on a shared container host; expect ±15% variance.
• The end-to-end read path is the application's cached render path; in production nginx proxies to the same path.
• Micro-benchmarks use Go's testing.B with -benchmem; each is run to a stable iteration count by the framework.
• Nothing cryptographic is on the article read path: pages are served from the page cache, and TLS is nginx's.