quic-go VS Caddy

2023/05/04 11:38:37 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size for details.

2023-02-12T15:29:22Z INF Starting tunnel tunnelID=f0cc67d9-973b-44bd-ae58-d7c9e3b112f0 2023-02-12T15:29:22Z INF Version 2023.2.1 2023-02-12T15:29:22Z INF GOOS: linux, GOVersion: go1.19.5, GoArch: amd64 2023-02-12T15:29:22Z INF Settings: map[no-autoupdate:true token:*****] 2023-02-12T15:29:23Z INF Generated Connector ID: 0550ea9c-1c9e-4e48-9d85-defcdc33a31c 2023-02-12T15:29:23Z INF Will be fetching remotely managed configuration from Cloudflare API. Defaulting to protocol: quic 2023-02-12T15:29:23Z INF Initial protocol quic 2023-02-12T15:29:23Z INF ICMP proxy will use 172.17.0.2 as source for IPv4 2023-02-12T15:29:23Z INF ICMP proxy will use :: as source for IPv6 2023-02-12T15:29:23Z INF Starting metrics server on 127.0.0.1:45807/metrics 2023/02/12 15:29:23 failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size for details. 2023-02-12T15:29:23Z INF Connection c81366ed-3bb8-479a-a832-243451980ad3 registered with protocol: quic connIndex=0 ip=198.41.192.227 location=MSP 2023-02-12T15:29:24Z INF Connection 8f2804c5-2dd7-4b2f-8400-e103c2165a80 registered with protocol: quic connIndex=1 ip=198.41.200.43 location=ORD 2023-02-12T15:29:24Z INF Updated to new configuration config="{\"ingress\":[{\"hostname\":\"portainer.mydomain.com\",\"originRequest\":{},\"service\":\"http://my-public-ip:9000\"},{\"hostname\":\"homeassistant.mydomain.com\",\"originRequest\":{},\"service\":\"http://my-public-ip:8123\"},{\"hostname\":\"frigate.mydomain.com\",\"originRequest\":{},\"service\":\"http://my-public-ip:5000\"},{\"hostname\":\"mosquitto.mydomain.com\",\"originRequest\":{},\"service\":\"http://my-public-ip:1883\"},{\"hostname\":\"ra.mydomain.com\",\"originRequest\":{},\"service\":\"http://my-public-ip:8124\"},{\"service\":\"http_status:404\"}],\"warp-routing\":{\"enabled\":false}}" version=28 2023-02-12T15:29:25Z INF Connection f5847632-f534-4cae-a4df-02e11447406e registered with protocol: quic connIndex=2 ip=198.41.192.107 location=MSP 2023-02-12T15:29:25Z INF Connection 664d6d41-b0ac-499d-894d-42e38e5bd475 registered with protocol: quic connIndex=3 ip=198.41.200.193 location=ORD 2023-02-12T15:30:16Z ERR error="Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared: dial tcp my-public-ip:5000: connect: connection refused" cfRay=79865d4d2bdd62bd-ORD ingressRule=2 originService=http://my-public-ip:5000 2023-02-12T15:30:16Z ERR Request failed error="Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared: dial tcp my-public-ip:5000: connect: connection refused" connIndex=1 dest=http://frigate.mydomain.com/api/stats ip=198.41.200.43 type=http 2023-02-12T15:31:37Z ERR error="Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared: dial tcp my-public-ip:5000: connect: connection refused" cfRay=79865f497bb98101-ORD ingressRule=2 originService=http://my-public-ip:5000 2023-02-12T15:31:37Z ERR Request failed error="Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared: dial tcp my-public-ip:5000: connect: connection refused" connIndex=1 dest=http://frigate.mydomain.com/api/stats ip=198.41.200.43 type=http

These projects use Caddy as my local development server, Dart Sass for converting my Sass files to CSS, elm, elm-format, elm-optimize-level-2, elm-review, elm-test (only in Calculator), ShellCheck to find bugs in my shell scripts, and Terser to mangle and compress JavaScript code.

No, look at the associated unit test: https://github.com/caddyserver/caddy/blob/c6eb186064091c79f4...

If that test fails we could serve PHP source code instead of having it be evaluated, a major security flaw.

However, it's very unlikely that .NET developers will directly expose their Kestrel-based web apps to the internet. Typically, we use other popular web servers like Nginx, Traefik, and Caddy to act as a reverse-proxy in front of Kestrel for various reasons:

I think that recompiling with upgraded Go will not solve the issue. It seems Caddy imports `golang.org/x/net/http2` and pins it to v0.22.0 which is vulnerable: https://github.com/caddyserver/caddy/issues/6219#issuecommen....

Caddy [1] is a single binary. It is not minimal, but the size difference is barely noticeable.

serve also comes to mind. If you have node installed, `npx serve .` does exactly that.

There are a few go projects that fit your description, none of them very popular, probably because they end up being a 20-line wrapper around http frameworks just like this one.

[1] https://caddyserver.com/

Each app’s front end is built with Qwik and uses Tailwind for styling. The server-side is powered by Qwik City (Qwik’s official meta-framework) and runs on Node.js hosted on a shared Linode VPS. The apps also use PM2 for process management and Caddy as a reverse proxy and SSL provisioner. The data is stored in a PostgreSQL database that also runs on a shared Linode VPS. The apps interact with the database using Drizzle, an Object-Relational Mapper (ORM) for JavaScript. The entire infrastructure for both apps is managed with Terraform using the Terraform Linode provider, which was new to me, but made provisioning and destroying infrastructure really fast and easy (once I learned how it all worked).

So I dug a little deeper and came across this gem: Caddy. Caddy is this fantastic, extensible, cross-platform, open-source web server that's written in Go. The best part? It comes with automatic HTTPS. It basically condenses all the work our scripts and manual maintenance were doing into just 4-5 lines of config. So, stick around and I'll walk you through how to set up an automatic SSL solution with Caddy, Docker and a Node.js server.

Let's use Caddy which can act as reverse-proxy with automatic HTTPS coverage.

Even if it may be simple, it doesn't handle edge cases such as https://github.com/caddyserver/caddy/issues/1632

I personally would make the trade off of taking on more complexity so that I can have extra compatibility.

One of the most heavily used Russian software projects on the internet https://www.nginx.com/blog/do-svidaniya-igor-thank-you-for-n... but it's only marginally more modern than Apache httpd.

In light of recently announced nginx memory-safety vulnerabilities I'd suggest migrating to Caddy https://caddyserver.com/