static-server: an HTTP server in Go for static content

Post by timenova » Sun, Sep 17, 2023, 1:06 AM UTC

mholt wrote: post #9

These are fun to make. I've done it several times. :) That is why I wrote Caddy: $ caddy file-server It does templates, TLS, and other production things really easily from the command line too, including automatically getting certificates: $ caddy file-server --domain example.com Done! I think projects like static-server are wonderful learning examples of how to get Useful Things done in Go.

Post by housemusicfan » Sun, Sep 17, 2023, 1:13 AM UTC

rcme wrote: post #41

simonw wrote: post #28

Earlier quoted context omitted.

One of the big selling points of Caddy for me is that you can reconfigure it "live" without restarting the server. This is great for if you want to be able to do zero-downtime deploys of new applications behind a proxy server or similar.

I think nginx does that too; if you send it a hup signal, it will reload the config.

Post by xcdzvyn » Sun, Sep 17, 2023, 1:52 AM UTC

gabereiser wrote: post #18

jjice wrote: post #5

Earlier quoted context omitted.

> I know you’ll say “It’s just a static server, meant for serving static stuff” but it will be indexed by pkg.go.dev, people will use this outside your intent. While true, I don't think the author should refrain from making code available based on the potential negatives from others using code they didn't even bother to read the documentation for.

You’re right, however, due to the nature of the go ecosystem, someone will use it - host their react app with it - and expose an endpoint that could shutdown their server. I think that warrants being called out for.

Post by [deleted] » Sun, Sep 17, 2023, 3:46 AM UTC

gabereiser wrote: post #2

While I love Go, have we gotten this lazy that we need a package for this? Go does this in 3 lines minimum, like you describe in your blogpost. However, in your package you expose the ability to kill your server [0] without any security. That’s a huge vulnerability. I know you’ll say “It’s just a static server, meant for serving static stuff” but it will be indexed by pkg.go.dev, people will use this outside your int…

Post by abhishekjha » Sun, Sep 17, 2023, 4:24 AM UTC

mholt wrote: post #35

abhishekjha wrote: post #16

Earlier quoted context omitted.

Is there more to the philosophy of why caddy exists? I am trying to jump into a few open source projects to hone my programming skills and I have a harder time comprehending things if I don't know what was the overall intention of the authors.

Caddy 1 was created because I needed a quick and easy web server for a lot of my projects. Caddy 2 was created when I got serious about it, and we had governments and enterprises starting to rely on the project. Now we exist because we advocate for (and deliver!) HTTPS on every site, memory safety, dynamic configuration, extensibility, and many more features valuable in a modern web server. Hope that helps :)