15 ms·
A Poor Man's API
- brianjacobs 4y agoNot to be mean, but from my reading this needs Heroku free tier which no longer exists? I am very sorry if I got that wrong.
- quickthrower2 4y agoNKOTB: https://neon.tech/ https://neon.tech/ Free Tier includes: compute up to 1 vCPU / 256 MB storage up to 10 GiB 3 projects per user
- judge2020 4y agoDoesn't look like you're the owner, but are there any notable clients using this service? With Heroku it was legit enough that you knew enough enterprise users were subsidizing the free tier to where it won't just disappear overnight.
- quickthrower2 4y agoNo idea. This is an early stage startup so who knows. But if you need guarantees (it ain’t a hobby project) then best to just pay for the service from any of the big or small clouds.
- boomskats 4y agoNeon is fresh out of private beta (or should be soon). I can't wait to play with it. However they're all about Hasura lately rather than PostgREST, which this article talks about. Nikita, their CEO, was a guest on the Changelog[0] podcast a month or so ago. Well worth a listen, great episode. [0] https://changelog.com/podcast/510 https://changelog.com/podcast/510
- nikita 4y agoOut of private beta in the 6th of December
- cpursley 4y agoSupabase requires Postgres logical replication which Neon doesn't quite have yet have (but it's on the roadmap) https://community.neon.tech/t/plans-for-logical-replication/219 https://community.neon.tech/t/plans-for-logical-replication/... I'm also really excited about Neon. My dream stack is Neon (Postgres) + ReadySet (database caching proxy) + Supabase.
- boomskats 4y agoInteresting. I assume Supabase requires it because supabase/realtime depends on it? Personally I'm more interested in vanilla PostgREST than Supabase's implementation of it, or their realtime implementation. It seems really cool but I'm not 100% sold on their ability to evaluate complex RLS rules, which is an important one for me. ReadySet looks cool, I'll check it out. Thanks!
- cpursley 4y agoThat's right (regarding listening to the WAL - replication). I actually just stole that part of the Supabase realtime code for my own lib (so I can do logic in Elixir). I haven't used their role based stuff but it looks pretty good.
- kiwicopple 4y ago> I'm not 100% sold on their ability to evaluate complex RLS rules You don’t need to be sold on our ability - all rules are run on the database itself. Supabase is just Postgres, we don’t run any forks. We run vanilla PostgREST too (behind a proxy)
- boomskats 4y agoI've always known that you run vanilla PostgREST, and that it evaluates RLS in-pg, and it all works great. However when I first looked at walrus[0] a while back (18 months ago?), I couldn't quite figure out what the mechanism of action was, i.e. whether the RLS rules were being evaluated in the database or being parsed in from the DDL and then (partially?) reinterpreted by your WAL subscriber. I hope that explains my comment. I've had another brief look at that repo, and either you've clarified a few things since I last looked at it, or I didn't look at it closely enough in the first place. It makes far more sense to me now, the impersonation + re-query mechanism puts me at 100%. Thanks for the response, I appreciate it. [0]: https://github.com/supabase/walrus https://github.com/supabase/walrus
- quickthrower2 4y agoEdit: that was beta free tier. might change.
- chairmanwow1 4y agoRender is a fantastic replacement
- quickthrower2 4y agoNo free psql tier
- selcuka 4y agoFly supports PostgreSQL [1], but it's not managed as you would expect. [1] https://fly.io/docs/postgres/getting-started/what-you-should-know/ https://fly.io/docs/postgres/getting-started/what-you-should...
- langsoul-com 4y agoUse Laravel to generate the api. The boilerplate get you 90% of the way. Host laravel and pgsql on fly for free. Could do other things like directus (handles the api gen), planetscale has free mysql tier or even using airtable as the db, it provides the api part.
- selcuka 4y agoSorry, what I meant by "not managed" was they just support PostgreSQL as in "yet another executable running on their containers", so they don't actually optimise or configure PostgreSQL for you. I find Eloquent's approach to disconnect models from migrations a bit dangerous, but it could be me as I don't have much experience with Laravel. PlanetScale/Vitess doesn't support foreign keys, which is nice for distributed (planet scale, ha!) apps, but could be a problem for certain types of applications. I'd rather stick with (stock-ish) PostgreSQL.
- edmundsauto 4y agoSupabase has a free tier with all this included, plus more. It's the best install of postgres I've seen and I'm obsessed with how it makes triggers, auth, etc., all included.
- rmason 4y agoDid a user group presentation on Supabase, no one in the audience had ever heard of it. I came away quite impressed. Plan on building a complex API with it soon. If I was currently employed as a backend developer I'd be worried.
- cpursley 4y agoDon't worry, somebody still has to design all the database tables/relations, views, triggers, etc. Which means we all become better database developers, which is a very good thing. Also, these tools can't handle certain back end logic (ie, API interactions and integrations, long running processes, etc). Which is the complex bit, anyways.
- edmundsauto 4y agoThis just removes the need for some backend engineering, but will leave the actual hard work (schema design, etc) More and more, developers need to add value to the business, instead of being the key holders of arcane invocations. It used to be that knowing how to use a computer was a technical skills; now it’s evolved into understanding the business.
- is_true 4y agoI think they should create a tier between the free and pro with a price of USD5 that doesn't pause projects and has backups
- edmundsauto 4y agoAgree on the backups piece, that should even be in the free plan as that much space is not likely to be expensive if they used cold storage. Otoh, if you aren’t sending 1 request per week to an installation, it’s really not active at all. The overheard of supporting this niche is probably too much for a company that clearly is in ruthless prioritization mode.
- tptacek 4y agoBunch of providers have free tiers.
- nattaylor 4y agoReminds me of datasette, which does similar things for SQLite (and much more, too). Docs at https://docs.datasette.io/en/stable/json_api.html https://docs.datasette.io/en/stable/json_api.html Example: Retrieve JSON for https://fivethirtyeight.datasettes.com/polls/president_primary_polls https://fivethirtyeight.datasettes.com/polls/president_prima... simply with https://covid-19.datasettes.com/covid/ny_times_us_counties.json?state__exact=Texas&_sort_desc=date https://covid-19.datasettes.com/covid/ny_times_us_counties.j... (I added a filter for Texas)
- bmn__ 4y agoBig problems with the design of the response here, too. Example: https://fivethirtyeight.datasettes.com/polls/president_primary_polls.json https://fivethirtyeight.datasettes.com/polls/president_prima... The schema is ad-hoc and requires a human to interpret it. Link relations (at the bottom) are expressed the wrong way: a machine could understand the "next" or "license" relations, but not an arbitrary "next_url" or "license_url" JSON key. Recommendation: adopt relevant IETF/IANA standards and reformulate the response to take advantage of them.
- edgyquant 4y agoWhy not just use postgraphile?
- cpursley 4y agoHaskell (performant functional language) > JavaScript (soggy wet noodles)
- 55555 4y agoCheck out this simple, easy API replacement: just set up Docker, APISIX, Grafana, Prometheus, etc. Does anyone else miss the old days of just editing your site's code and adding new columns to your MYSQL database while people were surfing your website? That was fun. Tip: Another way to turn your DB into an API is to just connect to it and then write SQL queries.
- tptacek 4y agoGrafana and Prometheus aren't necessary, and Docker is at this point pretty close to a Linux platform feature. APISIX is a reasonable complaint --- the "poor man's API" is "using a big open source project that provides generic APIs", sure, that's not all that clever.
- ilrwbwrkhv 4y agoAbsolutely. It is shameful how much stuff needs to be run before you can even get started.
- tommek4077 4y agoYou still can do it, the main feature is: it just works. You don't have to follow the hype. One problem could be that new devs never experience the simplicity of such a setup, but that is not your problem.
- dasloop 4y ago
- hanzhangzeng 4y agoThis is informational and reminds me of that funny github repo porsager/postgres. Thanks for sharing this!
- tasuki 4y ago> Creating a full-fledged API [...]. You need to think about [...] the REST principles I can assure you you don't need to do that. And most people don't. It's perfectly possible to create a useful API without adhering to the REST principles. [Edit, having read the rest of the article]: Case in point, this very PostgREST tool promoted in the article appears very useful, while not thinking about the REST principles.
- beachy 4y agoIf you're talking about HATEOAS (which many zealots equate one to one with REST) you may be pleased to know there is no reference to it whatsoever in this article.
- morelisp 4y ago> zealots REST is defined by four interface constraints: identification of resources; manipulation of resources through representations; self-descriptive messages; and, hypermedia as the engine of application state.
- kreetx 4y agoOr is it the other way around? I seem to remember that Roy Fielding did actually mean HATEOAS when saying REST, that REST isn't only CRUD but a discoverable and self-describing API. EDIT: And the corollary of above is that most people when saying REST actually mean HTTP with correct method use. If not, then is there a good source on what you mean by REST and HATEOAS?
- morelisp 4y agoA lot of people confuse HATEOAS, the idea, with HAL, some attempt to standardize it.
- deleted 4y ago[deleted]
- tasuki 4y agoPerhaps I'm a zealot: HATEOAS is one required part of REST as per Roy Fielding, who came up with both. What does "REST" mean to you?
- brvier 4y agoShame ...
- colonwqbang 4y ago> when you’ve validated the requirements, you can keep the existing façade and replace PostgREST with your custom-developed API. Why? What is it about postgrest which makes it unsuitable for "real" usage? The author doesn't mention it.
- jansommer 4y agoAgree. I've used PostgREST for production and it works great. No need to rewrite the API.
- k__ 4y agoI would go the other way around. Why start with an SQL database? When I start something new, I don't want to fiddle around with tables every time I change my model.
- quickthrower2 4y agoI agree but the baby of “joins” is often thrown out with the bathwater of “schemas” Is there a relational schemaless DB I wonder?
- Aeolun 4y agoSounds like a contradiction in terms to me.
- layer8 4y agoNo contradiction at all. Imagine a relational database where the only column type is a variant (union) of the usual datatypes, and where new tables and new columns are auto-created whenever an insert/update references them (and, possibly, unused tables and columns are garbage-collected). You’d still use regular SQL and have joins and everything, the tables would still be relations, but there’s no defined schema.
- falcolas 4y agoThere are, but they’re pretty niche because their performance is really bad. Niche enough I can’t recall a single name today. But really, my advice for early prototyping is split in two: either keep it in memory and serialize to disk, or use SQLite. Note that even using serialized memory constructs will require data migrations, aka schema updates.
- pram 4y agoEhh this seems more annoying than just writing an MVP in (your language of choice) given you already have the expertise.
- blowski 4y agoMany projects grow to the point that the limitations of writing everything in views and stored procedures becomes more painful than writing the CRUD code in Python, Node, Ruby, PHP, or whatever. Personally, I’d give a shout for https://api-platform.com/ https://api-platform.com/.
- cpursley 4y agoWhat are the particular pain points for you? For me - using a similar system (Hasura), it's migrating things dependent on views. Feels like this should be a solved problem (database migration issue, not due to Hasura). But I still prefer it over writing CRUD.
- blowski 4y agoAt some point CRUD goes from being pure CRUD to mostly CRUD with a few special requirements - e.g. complex RBAC rules, decorating data, API versions, integrating third-party APIs, scaling. They're easy to do in most app frameworks (Laravel, Django, Rails), tricky in something like Postgrest. I haven't use Hasura.
- cpursley 4y agoYou can get really far with database views (decorating data, especially), functions (all sorts of biz logic) and Postgres roles for RBAC. But I hear you on integrating with 3rd party APIs, etc. Fwiw, there's a number of PostgREST backend client libraries to help with that.
- blowski 4y agoTotally agree that it's possible. But at some level, it may just be easier to use something else. If you're a strong Postgres DBA, I can see how you'd come down on the side of PostgREST. If you're a strong Rails dev, it would make more sense to use that.
- sgt 4y agoIs APISIX any good?
- jjzhiyuan 4y agoDepends on your needs of API Gateway, Ingress Controller, and Service Mesh. According to Apache APISIX Slack[1] channel discussions and GitHub Issues/Discussions, most people focus on Security, Feature Rich, and Performance. 1. Security: As an Apache project, there have a lot of users and maintainers who are watching project activities, and the Security Team follows up very quickly. 2. Feature Rich: Just join the Slack channel and you will find that lots of questions are related to "features". 3. Performance: https://api7.ai/blog/apisix-kong-3-0-performance-comparison https://api7.ai/blog/apisix-kong-3-0-performance-comparison [1] https://apisix.apache.org/slack https://apisix.apache.org/slack
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- bmn__ 4y ago> PostgREST is a fast way to construct a RESTful API. That's false. The responses don't even have hyperlinks.
- GolDDranks 4y agoJust to clear things up a bit (as I remember not knowing about this side of "RESTfulness" a while ago myself): an important part of REST is relying on hypertext, that is pointing to other resources by using URLs. Just returning an ID of a referenced object/resource as a plain number isn't very RESTful, but returning an URL of that object/resource is.
- omnibrain 4y agoYes, but who really does this? I never encountered an API doing it. (Not saying they don't exist!)
- Aeolun 4y agoIf you already have relationships between tables, then it shouldn't be that hard to add right?
- bmn__ 4y agoRight. The problem is not difficulty, but motivation. The responsible programmer begriffs does not have the understanding why it is a good idea to do so, despite bug reporters on Github having spent years in discussions.
- steve-chavez 4y agoTo be fair, begriffs never shut down any discussion of HATEOAS, previous contributors did - because at the time users were asking for more JSON capabilities from PostgREST and we needed to focus on those. We're still open on adding HATEOAS, I've just opened an issue for it: https://github.com/PostgREST/postgrest/issues/2579 https://github.com/PostgREST/postgrest/issues/2579
- 12tvende 4y agoPretty cool postgress feature
- bmn__ 4y agoIt's third-party software.
- senko 4y agoOr just use an API generator like https://apibakery.com https://apibakery.com , https://amplication.com https://amplication.com or another with your favorite framework and call it a day.
- bmn__ 4y agoAPI Bakery requires a user to tediously and manually replicate the DB schema. In my eyes, that makes it worse than the solution under discussion.
- senko 4y agoOh if you have a database already and want to expose it, then yeah, it does make sense to go with the API adapter bolted onto it. If you're starting from scratch (as the post is, since PostgreSQL is advertised as part of the solution), then you have to manually create the DB schema. I would argue that a Node developer would find it easier to do that in Prisma, or a Django developer in Django ORM, than to do raw CREATE TABLE queries manually.
- ushakov 4y agoDo I have to generate my API from scratch if the schema changes? If so, this solution is a no-go
- tiborsaas 4y agoThis is far from what I'd call "poor man's" thing. I'd want to host it for free, so Vercel and Netlify comes to my mind. But to go real poor man style, I'd use Google sheets as a backend and throw some caching layer on top of it. Firebase or one of its competitors is also a good idea to get some API up and running for free.
- cpursley 4y agoStick it on the Render free or cheap tier. Or Supabase for free in just a single click: https://supabase.com/pricing https://supabase.com/pricing You're better off starting with Postgres than having to migrate from some kind of no-sql setup later.
- tiborsaas 4y agoI'd love to have the migration problem because it indicates what I'm building has something to it. If nobody uses it then no regrets doing it stupid fast.
- cpursley 4y agoIt's more than just a migrating issue, it's thinking about the structure of your data from the beginning. Your data is your application. Web framework flavor of the day should be a secondary consideration.
- siscia 4y agoMaybe I am biased, but at this point I would find simpler to just give access to the DB. Let user write their own SQL queries and meter how much time they use for billing or abuse prevention.
- falcolas 4y agoDid you know that databases can read from disk? Databases are huge security vulnerabilities and should always have some kind of shim over them. Never expose your relational DB publicly if you want any control over it.
- asalahli 4y agoSo can the services providing http APIs. What does that have anything to do with security?
- andai 4y agoAt that point you might as well just let them download the .sqlite file ;) Or (as is the fashion recently) compile sqlite to wasm and run it in browser.
- maartenh 4y agoHm, using Apache APISIX for DDoS protection on a single node? That won't really stop a real DDoS. Not much you can do on a single server, if a botnet is saturating the network links to your server(s), without help from your infra provider. This setup can be used to prevent the backends from being overloaded, which one can probably already do from a single host, and depending on the speed/amount of work by the backends done, not a lot of bandwidth is required to overload most systems that have a limited amount of request processing capacity. I would argue that this is load management/shedding though, and not DDoS protection.
- 411111111111111 4y agoHasn't DDoS protection always been a small misnomer? You can't really protect against it, you can only have enough bandwidth to handle everything.
- oogali 4y agoThe root of the issue has always been the definition of DDoS. Network engineers define it as one thing: a massive amount of abnormal traffic generated by a large number of sources (distributed) that you need adequate bandwidth to soak up without impacting normal traffic. Software engineers define it as another thing: unwanted traffic that causes resource exhaustion and should be blocked. They're almost always thinking of DoS but refer to it as DDoS. That's why when TFA talks about DDoS, the example immediately attached to it is rate limiting at what to me (network engineering background) seems like an absurdly low limit (1 request every 5 seconds).
- bee_rider 4y ago“Mitigation” would probably be a better name (and sounds fancier, but maybe not as definitive).
- KronisLV 4y agoHere's a page that talks a bit more about Apache APISIX: https://apisix.apache.org/docs/apisix/getting-started/ https://apisix.apache.org/docs/apisix/getting-started/ I find it a bit ironic that they don't support Apache2 as the web server, you know, it being an Apache project and all, instead going for Nginx or OpenResty (though admittedly they're great projects). Even nowadays Apache2 is pretty okay: https://blog.kronis.dev/tutorials/how-and-why-to-use-apache-httpd-in-2022 https://blog.kronis.dev/tutorials/how-and-why-to-use-apache-... (especially if you disable .htaccess for less disk I/O and use it with a single file based config)
- jlengrand 4y agoThat's what I actually admire about Supabase [0]. The folks created an almost full fledged Firebase replacement by clipping pieces together (similar to the article, replacing APISIX with Kong) and it allows them to iterate super fast. Pragmatic, and nice if you're on the receiving end of it . [0] https://github.com/supabase/supabase#how-it-works https://github.com/supabase/supabase#how-it-works
- deleted 4y ago[deleted]
- molmorg 4y ago