Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

static-server: an HTTP server in Go for static content

eli.thegreenplace.net

Post reply on HN
Print view View original

61–67 of 67 posts

Re: static-server: an HTTP server in Go for static content

#61

Post by mholt »

mnstngr wrote: post #40
mholt wrote: post #9

These are fun to make. I've done it several times. :) That is why I wrote Caddy: $ caddy file-server It does templates, TLS, and other production things really easily from the command line too, including automatically getting certificates: $ caddy file-server --domain example.com Done! I think projects like static-server are wonderful learning examples of how to get Useful Things done in Go.

Thank you for Caddy! Going from a complex nginx setup to the delight that's the Caddyfile was a breeze. And a special call-out to your dedication to providing amazing documentation. Caddy is what all projects should aspire to be.

Thank you! We try very hard (collectively, as a community).

Re: static-server: an HTTP server in Go for static content

#62

Post by mholt »

mbakke wrote: post #56
mnstngr wrote: post #40

Earlier quoted context omitted.

Thank you for Caddy! Going from a complex nginx setup to the delight that's the Caddyfile was a breeze. And a special call-out to your dedication to providing amazing documentation. Caddy is what all projects should aspire to be.

Caddy is amazing. I accidentally wiped my fairly complex nginx configuration (yay apt-get purge) and have been so spoiled by Guix that I did not care about etckeeper or ansible on my one Debian server. Anyway I decided to try Caddy to quickly get up and running and had a good setup in minutes including certificates for multiple domains. Even added wildcard certificates which I never figured out with Lets Encrypt, jus…

That's awesome! Thank you for the experience/feedback.

Re: static-server: an HTTP server in Go for static content

#63

Post by mholt »

housemusicfan wrote: post #43
abhishekjha wrote: post #16

Earlier quoted context omitted.

Is there more to the philosophy of why caddy exists? I am trying to jump into a few open source projects to hone my programming skills and I have a harder time comprehending things if I don't know what was the overall intention of the authors.

From afar, Caddy is one of those weird HN cargo cults. It seems like in every thread about web servers, the developers are in here peddling their wares, and the disciples pour in with endless praise. It's another product with insane footgun defaults (the admin API on localhost) in a sea of mature alternatives. That's all I need to know. I don't mean to insult anyone's hard work but in the words of Josh Baskin, "I don…

What's wrong with the admin API on localhost, exactly?

Re: static-server: an HTTP server in Go for static content

#64

Post by mholt »

chaxor wrote: post #55
mholt wrote: post #9

These are fun to make. I've done it several times. :) That is why I wrote Caddy: $ caddy file-server It does templates, TLS, and other production things really easily from the command line too, including automatically getting certificates: $ caddy file-server --domain example.com Done! I think projects like static-server are wonderful learning examples of how to get Useful Things done in Go.

I'm ( very ) unfamiliar with webdev and hosting. Is this 'oneliner' a secure way to host files? I have heard that using a reverse proxy, some 2FA on a cloud gateway that forwards to another location, with a VLAN for the file server, and containerization, etc are all the standard practice now for ensuring security. Is there anything that works toward making this goal more easily amenable (since it's not possible with…

It depends. What is your definition of "security"? There's lots of dimensions of security in the web serving space. If you list out your requirements and specify your threat model, then answers become a lot clearer.

But yes, in general: Caddy's one-liner is a safe way to serve static files in the sense that remote services can't upload files or escape memory bounds to run arbitrary code. It encrypts your connections for you, so they're basically safe from surveillance and modification.

The elements you're describing are all external factors that have nothing to do with serving static files specifically. For example, a reverse proxy just multiplexes requests coming in on a port to various backends, maybe making modifications along the way. Authentication will restrict access to only allowed users, if that's something you require. Containers are more a way of administering a system or mitigating very specific risks that have niche relevance with static Go programs; and VLANs are just ways of isolating network traffic, but again it's somewhat orthogonal to file serving.

Overall, `caddy file-server` is better than Python's simple HTTP server in every way, though: static binary, faster performing, production-ready (handles Range requests properly, and a few other details), automatic HTTPS, folder indices, etc...

Re: static-server: an HTTP server in Go for static content

#65

Post by mholt »

timenova wrote: post #42
mholt wrote: post #9

These are fun to make. I've done it several times. :) That is why I wrote Caddy: $ caddy file-server It does templates, TLS, and other production things really easily from the command line too, including automatically getting certificates: $ caddy file-server --domain example.com Done! I think projects like static-server are wonderful learning examples of how to get Useful Things done in Go.

Hey, I was just wondering if there's any timeline on when the caddy-l4 module be compatible with Caddyfile? I know I can write it in JSON, but IMO the greatest appeal of Caddy is its simple and easy-to-read Caddyfile!

I, too, would like to see this, but it'll be a lot of work. It's just not a top priority right now for me, unfortunately.

This is something I could prioritize if a business wanted to sponsor this; but right now the most pressing things are updating the docs, revamping our test suite, and I have a few action items for existing sponsors I need to prioritize too.

Anyway, no timeline -- but definitely something wanted!

PS. There is kind of Caddyfile support here: https://github.com/RussellLuo/caddy-ext/tree/master/layer4

Re: static-server: an HTTP server in Go for static content

#66

Post by eliben »

benhoyt wrote: post #52
simonw wrote: post #27

This is cool - I didn't know you could have Go one-liners that look like this: go run github.com/eliben/static-server@latest I had to upgrade to Go 1.21 for this to work - I was previously on Go 1.20. "brew upgrade go" worked for me. Looks like almost the entire implementation is here, it's mostly CLI option parsing logic: https://github.com/eliben/static-server/blob/main/internal/s...

Yeah, with the "go 1.21.0" line in the go.mod file, it only works on Go 1.21. Here's what I get on Go 1.20: $ go run . go: errors parsing go.mod: .../static-server/go.mod:3: invalid go version '1.21.0': must match format 1.23 Eli, you might consider changing that to "go 1.20" so it works on Go 1.20 (and older, actually -- it's the 1.2.3 format that is getting in the way on Go pre-1.21).

Done now; thanks for the note!

Re: static-server: an HTTP server in Go for static content

#67

Post by eliben »

gabereiser wrote: post #19
eliben wrote: post #4

Earlier quoted context omitted.

Thanks for your comment. I surely hope no one will even consider using this server for anything public-facing :) It's solely for testing on localhost. The shutdown endpoint is used for robust testing; I suppose I can hide it a bit more, like using an environment variable or something.

Just check a header for a secret key you generate when you startup. Easy peasy. This keeps you able to call it for testing (granted you read from stdout or passed the key to tests as a variable). Then some scripto ransomware User from Omgodisztan doesn’t shutdown your server from the tent he’s camped in with Starlink.

This is done now, thanks for the suggestion
Post reply on HN