3 ms·

> The server software is written in Rust. It's statically linked, and all of the html, css, config, secrets, etc are compiled into the binary. I’ve recently ta

> The server software is written in Rust. It's statically linked, and all of the html, css, config, secrets, etc are compiled into the binary. I’ve recently taken to doing this in Go and absolutely love how easy it makes writing and deploying software that depends on static files.

robmccoll 3y ago
Yes! I do the same. I serve my web applications from the same statically compiled service that serves the backend API. In CI, I run an npm build process then embed the output. Makes running a local test or demo instance a snap.
d3nj4l 3y ago
I am not a fan of go but I find myself using it for this reason. Doing it with rust - especially cross compiling from mac to linux - is relatively painful, while with Go it is trivial and built into the go tool. It makes it so, so easy to remove any friction from finishing and deploying a side project.
- bbkane 3y ago
  Might be more complicated than you need, but I added Goreleaser to my CI/CD for my little tools. Now I can when I push a git tag it runs lints, runs tests, builds binaries, and updates Homebrew and Scoop repos. See https://github.com/bbkane/grabbit https://github.com/bbkane/grabbit for an example Makes it trivial to run `brew/scoop update myapp` from another computer
- AlexITC 3y ago
  > Doing it with rust - especially cross compiling from mac to linux - is relatively painful I have used cargo-dist and the process is quite smooth, it could be worth giving it a try.
mdtusz 3y ago
Including secrets in the compiled binary seems questionable still - using env variables or a config is the "standard" way for secrets, and although it adds another step before you can run, it avoids the case of sharing your binary with someone and forgetting that you had compiled in some secret that goes unnoticed. Unpacking a binary to find strings is pretty trivial. Having the static frontend assets baked in along with a default config is a huge boon though.
- ComputerGuru 3y ago
  You can include encrypted secrets and deploy the key out-of-band (eg just copy the private key with scp). This is much more secure than env variables which are prone to leakage. Our open source solution for this (cross-platform, cross-language): https://neosmart.net/blog/securestore-open-secrets-format/ https://neosmart.net/blog/securestore-open-secrets-format/ It supports embedding the encrypted secrets in the binary or loading them from a file. The secrets would actually be stored (encrypted) alongside the code, even versioned in git. Eg this is the rust version on GitHub: https://github.com/neosmart/securestore-rs/tree/master https://github.com/neosmart/securestore-rs/tree/master
  - chromatin 3y ago
    Hey! Your rust (and C# I guess) secrets library looks super cool. I'm going to look at using this in my next project. Thanks for sharing it.
    - ComputerGuru 3y ago
      Thanks for the words of gratitude, kind stranger! Glad to have potentially written something of some value to you.
zX41ZdbW 3y ago
I'm doing the same way for https://play.clickhouse.com/play?user=play https://play.clickhouse.com/play?user=play But there is one question. The article says: > I get my HTTPS certs from Let's Encrypt via certbot — this handles automatic renewal so I don't have to do anything to keep it working. But I'm using cross-region setup with two servers and a geo-DNS. With this setup, the certbot only works for the server, located in the US, and I have to manually copy the certificates to the server in Europe. Any idea how to overcome this? PS. Read about ClickHouse Playground here: https://ghe.clickhouse.tech/ https://ghe.clickhouse.tech/

robmccoll 3y ago

Yes! I do the same. I serve my web applications from the same statically compiled service that serves the backend API. In CI, I run an npm build process then embed the output. Makes running a local test or demo instance a snap.

d3nj4l 3y ago

I am not a fan of go but I find myself using it for this reason. Doing it with rust - especially cross compiling from mac to linux - is relatively painful, while with Go it is trivial and built into the go tool. It makes it so, so easy to remove any friction from finishing and deploying a side project.

bbkane 3y ago
Might be more complicated than you need, but I added Goreleaser to my CI/CD for my little tools. Now I can when I push a git tag it runs lints, runs tests, builds binaries, and updates Homebrew and Scoop repos. See https://github.com/bbkane/grabbit https://github.com/bbkane/grabbit for an example Makes it trivial to run `brew/scoop update myapp` from another computer
AlexITC 3y ago
> Doing it with rust - especially cross compiling from mac to linux - is relatively painful I have used cargo-dist and the process is quite smooth, it could be worth giving it a try.

mdtusz 3y ago

Including secrets in the compiled binary seems questionable still - using env variables or a config is the "standard" way for secrets, and although it adds another step before you can run, it avoids the case of sharing your binary with someone and forgetting that you had compiled in some secret that goes unnoticed. Unpacking a binary to find strings is pretty trivial. Having the static frontend assets baked in along with a default config is a huge boon though.

ComputerGuru 3y ago
You can include encrypted secrets and deploy the key out-of-band (eg just copy the private key with scp). This is much more secure than env variables which are prone to leakage. Our open source solution for this (cross-platform, cross-language): https://neosmart.net/blog/securestore-open-secrets-format/ https://neosmart.net/blog/securestore-open-secrets-format/ It supports embedding the encrypted secrets in the binary or loading them from a file. The secrets would actually be stored (encrypted) alongside the code, even versioned in git. Eg this is the rust version on GitHub: https://github.com/neosmart/securestore-rs/tree/master https://github.com/neosmart/securestore-rs/tree/master
- chromatin 3y ago
  Hey! Your rust (and C# I guess) secrets library looks super cool. I'm going to look at using this in my next project. Thanks for sharing it.
  - ComputerGuru 3y ago
    Thanks for the words of gratitude, kind stranger! Glad to have potentially written something of some value to you.

zX41ZdbW 3y ago

I'm doing the same way for https://play.clickhouse.com/play?user=play https://play.clickhouse.com/play?user=play But there is one question. The article says: > I get my HTTPS certs from Let's Encrypt via certbot — this handles automatic renewal so I don't have to do anything to keep it working. But I'm using cross-region setup with two servers and a geo-DNS. With this setup, the certbot only works for the server, located in the US, and I have to manually copy the certificates to the server in Europe. Any idea how to overcome this? PS. Read about ClickHouse Playground here: https://ghe.clickhouse.tech/ https://ghe.clickhouse.tech/