Web on

Lesson 12: Production Deployment — Docker, graceful shutdown, observability

Mon, 28 Oct 2024 08:55:00 +0000

Shipping to production is where the real education begins. Your local dev environment is a controlled fantasy — one instance, no load balancer, fast database on localhost, unlimited memory. Production is a hostile environment where your service gets killed mid-request, runs out of memory at 3am, and needs to tell you what went wrong without you SSH-ing into a container. This lesson is about surviving out there.

Dockerfile: The Multi-Stage Build

Rust binaries are statically linked (or nearly so). A compiled Rust service can run in a scratch or distroless container with no runtime dependencies. This means tiny images — often under 20MB.

Lesson 11: Integration Testing HTTP Services — Testing without mocks

Thu, 24 Oct 2024 15:40:00 +0000

I worked on a codebase that had 600 unit tests with mocked HTTP clients, mocked databases, mocked everything. All 600 passed. The application didn’t work. The mocks were wrong — they returned data in a format the real database never produced. Those 600 tests gave the team confidence to ship broken code. Integration tests that hit real infrastructure are harder to write but they tell you whether your application actually works.

Lesson 10: OpenAPI / Swagger Generation — Documentation from code

Mon, 21 Oct 2024 10:05:00 +0000

I’ve never seen a team maintain a separate OpenAPI spec in sync with their actual API for more than three months. Someone adds a field, forgets to update the docs, and suddenly the spec says one thing and the API does another. The only API documentation that stays accurate is documentation generated from the code itself. If the code changes, the docs change. No human discipline required.

The Approach: utoipa

utoipa is the go-to crate for generating OpenAPI specs from Rust code. It uses derive macros and attribute annotations to produce an OpenAPI 3.1 JSON spec at compile time. You add annotations to your types and handlers, and utoipa generates a spec that’s always in sync with your code.

Lesson 9: Rate Limiting and Throttling — Protecting your service

Fri, 18 Oct 2024 13:10:00 +0000

We launched a public API without rate limiting. Within a week, a single user was making 200 requests per second — not maliciously, just a badly written script with no backoff. Their traffic consumed 40% of our database connections and degraded performance for everyone else. We added rate limiting, their requests started getting 429s, they fixed their script, and everyone was happy. Should’ve been there from day one.

Why Rate Limit

Three reasons, in order of importance:

Lesson 8: WebSockets with Axum — Real-time in Rust

Wed, 16 Oct 2024 09:20:00 +0000

A startup I consulted for was polling their REST API every 500 milliseconds to check for new messages. Forty thousand clients, each making two requests per second. That’s 80,000 requests per second to check if anything changed — and 99% of the time, nothing had. They switched to WebSockets, dropped their server count from 12 to 2, and their AWS bill fell by 70%. Polling is fine for dashboards that refresh every 30 seconds. For anything real-time, you want WebSockets.

Lesson 7: Pagination, Filtering, and Sorting — API patterns that scale

Mon, 14 Oct 2024 16:30:00 +0000

We shipped a “list all orders” endpoint that returned everything. No pagination. Worked great in development with 50 test records. In production, one customer had 340,000 orders. The endpoint took 12 seconds, the response was 45MB, and the frontend crashed trying to render it. We added pagination that afternoon. You should add it before that afternoon.

Offset-Based Pagination

The most common approach. Simple to implement, easy to understand, and good enough for most internal tools and admin panels.

Lesson 6: Database Integration — SQLx and connection management

Sat, 12 Oct 2024 07:45:00 +0000

My first Rust web service leaked database connections. I opened a new connection per request and forgot that Rust’s ownership system doesn’t magically manage TCP sockets. After about 200 concurrent users, PostgreSQL refused new connections and the whole service went down. Connection pooling isn’t optional — it’s the first thing you set up.

Why SQLx

There are three main approaches to database access in Rust:

Diesel — A full ORM with a query builder. Generates SQL at compile time. Requires a build step that connects to your database. Strong opinions about schema management.
SeaORM — An async ORM inspired by ActiveRecord. Higher level, more magic. Good if you like ORMs.
SQLx — Not an ORM. You write SQL. SQLx compiles your SQL queries against a real database at compile time, verifying that your SQL is valid and your result types match the columns returned.

I use SQLx because I like writing SQL and I don’t trust ORMs in production. ORMs generate queries you can’t see, and when they generate bad queries (and they will), debugging is miserable. With SQLx, the SQL is right there in your code, and the compiler verifies it’s correct.

Lesson 5: Authentication — JWT, sessions, OAuth

Wed, 09 Oct 2024 11:00:00 +0000

I’ve reviewed auth implementations at four different companies. Three of them stored passwords in SHA-256 without salting. One stored them in plain text in a column called password_encrypted — because naming it “encrypted” apparently counted as security. Auth is the part of your application that bad actors actively try to break. Getting it wrong isn’t a bug, it’s a liability.

Password Hashing: Do This Right or Don’t Do It At All

Before we talk about tokens or sessions, let’s nail password storage. The rules are simple and non-negotiable:

Lesson 4: Request Validation and Error Responses — Clean input handling

Mon, 07 Oct 2024 19:15:00 +0000

A junior engineer on my team once deployed an endpoint that accepted any string as an email address. Someone submitted “lol” as their email, the downstream email service threw a cryptic error, and our error tracking lit up with 500s for an hour. Input validation isn’t glamorous, but skipping it is how you get paged at dinner.

The Problem with Default Error Responses

Out of the box, Axum’s error responses are… not great. Send malformed JSON to a Json<T> handler and you get back:

Lesson 3: Middleware with Tower Layers — The composable middleware pattern

Sat, 05 Oct 2024 08:30:00 +0000

I once inherited a Node.js codebase with 23 Express middleware functions chained together. Half of them silently swallowed errors, three of them conflicted with each other, and nobody knew what order they ran in. When I started building services in Axum, the Tower middleware model felt like a revelation — not because it’s easier (it’s actually harder at first), but because it makes middleware composable and type-checked. You can’t silently swallow errors when the type system forces you to handle them.

Lesson 2: Axum from Zero — Routing, handlers, extractors

Thu, 03 Oct 2024 14:45:00 +0000

The first time I tried Axum, I wrote a handler that took five extractor arguments and spent twenty minutes staring at a compiler error that said my function “didn’t implement Handler.” Turns out the order of extractors matters, and there’s a limit on how many you can have. Nobody tells you that upfront. So I’m telling you now.

Routing Fundamentals

Axum’s router is just a struct that maps HTTP methods and paths to handler functions. No macros, no attributes — you build routes with method calls.

Lesson 1: The Rust Web Landscape — Axum, Actix, Rocket and why I pick Axum

Tue, 01 Oct 2024 10:22:00 +0000

I spent three weeks building a service in Actix-web before ripping it out and switching to Axum. Not because Actix was bad — it’s genuinely fast and battle-tested. I switched because every time I needed custom middleware, I was fighting the framework instead of writing my application. That experience taught me something: in Rust web development, the framework you pick determines how much you fight the type system versus how much you work with it.