Live data from Hacker News

static-server: an HTTP server in Go for static content

eli.thegreenplace.net

21–30 of 67 posts

Re: static-server: an HTTP server in Go for static content

#22
post #9

These are fun to make. I've done it several times. :) That is why I wrote Caddy: $ caddy file-server It does templates, TLS, and other production things really easily from the command line too, including automatically getting certificates: $ caddy file-server --domain example.com Done! I think projects like static-server are wonderful learning examples of how to get Useful Things done in Go.

Is there more to the philosophy of why caddy exists? I am trying to jump into a few open source projects to hone my programming skills and I have a harder time comprehending things if I don't know what was the overall intention of the authors.

Caddy's appeal when I last looked at it some years ago was that the configuration file format was very easy to read and use; and that configuration itself was minimal. It came/comes with Letsencrypt integration which was novel some years ago, so setting up a secure site was even easier for people who weren't used to it.

Its syntax for being configured as a reverse proxy (secure front-end to less secure back-end servers) is similarly pretty easy.

I haven't looked at it in a long time because I recall them screwing with their terms of service so it wasn't fully FOSS by the most liberal definition.

Re: static-server: an HTTP server in Go for static content

#23
post #11
post #9

These are fun to make. I've done it several times. :) That is why I wrote Caddy: $ caddy file-server It does templates, TLS, and other production things really easily from the command line too, including automatically getting certificates: $ caddy file-server --domain example.com Done! I think projects like static-server are wonderful learning examples of how to get Useful Things done in Go.

Wait, file-server without arguments does dynamic content (templating)?! I assume that's just poorly phrased?

Only for directory listings I think. And of course you can turn that off as well.

Re: static-server: an HTTP server in Go for static content

#24
Awesome. There is a very surreal joy in building such standalone tools even just for learning. I have been working on a kitchen sync style "chat" app to experiment with new ideas (like integration with X/y/z). I just need to muster the courage to publish it!

Re: static-server: an HTTP server in Go for static content

#25
post #4

While I love Go, have we gotten this lazy that we need a package for this? Go does this in 3 lines minimum, like you describe in your blogpost. However, in your package you expose the ability to kill your server [0] without any security. That’s a huge vulnerability. I know you’ll say “It’s just a static server, meant for serving static stuff” but it will be indexed by pkg.go.dev, people will use this outside your int…

Thanks for your comment. I surely hope no one will even consider using this server for anything public-facing :) It's solely for testing on localhost. The shutdown endpoint is used for robust testing; I suppose I can hide it a bit more, like using an environment variable or something.

A simple middleware hook for http basic auth :)

Re: static-server: an HTTP server in Go for static content

#26
post #9

These are fun to make. I've done it several times. :) That is why I wrote Caddy: $ caddy file-server It does templates, TLS, and other production things really easily from the command line too, including automatically getting certificates: $ caddy file-server --domain example.com Done! I think projects like static-server are wonderful learning examples of how to get Useful Things done in Go.

Thanks for the comment, Matt! I love Caddy. For some reason I thought it needs a configuration file.

The simplest cmdline I found to run it as a local server on a non-priveledged port with listings is:

    $ caddy file-server --listen localhost:8099 --browse
Is there a simpler way I'm missing?

Re: static-server: an HTTP server in Go for static content

#27
This is cool - I didn't know you could have Go one-liners that look like this:

    go run github.com/eliben/static-server@latest
I had to upgrade to Go 1.21 for this to work - I was previously on Go 1.20. "brew upgrade go" worked for me.

Looks like almost the entire implementation is here, it's mostly CLI option parsing logic: https://github.com/eliben/static-server/blob/main/internal/s...

Re: static-server: an HTTP server in Go for static content

#28
post #9

These are fun to make. I've done it several times. :) That is why I wrote Caddy: $ caddy file-server It does templates, TLS, and other production things really easily from the command line too, including automatically getting certificates: $ caddy file-server --domain example.com Done! I think projects like static-server are wonderful learning examples of how to get Useful Things done in Go.

Is there more to the philosophy of why caddy exists? I am trying to jump into a few open source projects to hone my programming skills and I have a harder time comprehending things if I don't know what was the overall intention of the authors.

One of the big selling points of Caddy for me is that you can reconfigure it "live" without restarting the server.

This is great for if you want to be able to do zero-downtime deploys of new applications behind a proxy server or similar.

Re: static-server: an HTTP server in Go for static content

#29

Earlier quoted context omitted.

Is there more to the philosophy of why caddy exists? I am trying to jump into a few open source projects to hone my programming skills and I have a harder time comprehending things if I don't know what was the overall intention of the authors.

Caddy's appeal when I last looked at it some years ago was that the configuration file format was very easy to read and use; and that configuration itself was minimal. It came/comes with Letsencrypt integration which was novel some years ago, so setting up a secure site was even easier for people who weren't used to it. Its syntax for being configured as a reverse proxy (secure front-end to less secure back-end serve…

It’s had an Apache-2.0 license for at least the last 4 years: https://github.com/caddyserver/caddy/blob/master/LICENSE

Re: static-server: an HTTP server in Go for static content

#30
post #4

While I love Go, have we gotten this lazy that we need a package for this? Go does this in 3 lines minimum, like you describe in your blogpost. However, in your package you expose the ability to kill your server [0] without any security. That’s a huge vulnerability. I know you’ll say “It’s just a static server, meant for serving static stuff” but it will be indexed by pkg.go.dev, people will use this outside your int…

Thanks for your comment. I surely hope no one will even consider using this server for anything public-facing :) It's solely for testing on localhost. The shutdown endpoint is used for robust testing; I suppose I can hide it a bit more, like using an environment variable or something.

It's fine the way it is IMO. However, it might be worth caveating in the README that it's for local testing only, the same way you do in your blog post.

Mainly because of the shutdown endpoint, but also that the -cors flag returns "Access-Control-Allow-Origin: *" exposing you to arbitrary cross origin requests.

Post reply on HN