Production Deployment

durable-streams-server dev

{
  admin off
}

:4437 {
  route /v1/stream/* {
    durable_streams {
      data_dir ./data
    }
  }
}

durable-streams-server run --config Caddyfile

:4437 {
  route /v1/stream/* {
    durable_streams {
      data_dir /var/lib/durable-streams
    }
  }
}

/var/lib/durable-streams/
├── streams.db/           # LMDB database
│   ├── data.mdb
│   └── lock.mdb
└── segments/             # Stream data segments
    ├── stream-1/
    │   ├── 0000000000.seg
    │   └── 0000001024.seg
    └── stream-2/
        └── 0000000000.seg

#!/bin/bash
DATE=$(date +%Y%m%d-%H%M%S)
BACKUP_DIR="/backups/durable-streams-$DATE"

# Stop writes (optional - LMDB supports hot backups)
systemctl stop durable-streams

# Backup data directory
cp -r /var/lib/durable-streams "$BACKUP_DIR"

# Restart service
systemctl start durable-streams

echo "Backup created: $BACKUP_DIR"

FROM golang:1.21-alpine AS builder

WORKDIR /build
COPY . .

RUN go build -o durable-streams-server ./cmd/caddy

FROM alpine:latest

RUN apk --no-cache add ca-certificates

WORKDIR /app
COPY --from=builder /build/durable-streams-server .
COPY Caddyfile .

EXPOSE 4437

VOLUME ["/data"]

CMD ["./durable-streams-server", "run", "--config", "Caddyfile"]

# Build image
docker build -t durable-streams .

# Run container
docker run -d \
  -p 4437:4437 \
  -v $(pwd)/data:/data \
  --name durable-streams \
  durable-streams

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: durable-streams-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 100Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: durable-streams
spec:
  replicas: 1  # Note: File store doesn't support multiple replicas
  selector:
    matchLabels:
      app: durable-streams
  template:
    metadata:
      labels:
        app: durable-streams
    spec:
      containers:
      - name: server
        image: durable-streams:latest
        ports:
        - containerPort: 4437
        volumeMounts:
        - name: data
          mountPath: /data
        resources:
          requests:
            memory: "512Mi"
            cpu: "500m"
          limits:
            memory: "2Gi"
            cpu: "2000m"
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: durable-streams-data
---
apiVersion: v1
kind: Service
metadata:
  name: durable-streams
spec:
  selector:
    app: durable-streams
  ports:
  - port: 4437
    targetPort: 4437
  type: LoadBalancer

[Unit]
Description=Durable Streams Server
After=network.target

[Service]
Type=simple
User=durable-streams
Group=durable-streams
WorkingDirectory=/opt/durable-streams
ExecStart=/usr/local/bin/durable-streams-server run --config /etc/durable-streams/Caddyfile
Restart=on-failure
RestartSec=5s

# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/durable-streams

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable durable-streams
sudo systemctl start durable-streams
sudo systemctl status durable-streams

// cloudflare-worker.js
export default {
  async fetch(request, env) {
    const url = new URL(request.url)
    
    // Only cache GET requests with offset parameter
    if (request.method === 'GET' && url.searchParams.has('offset')) {
      const cacheKey = new Request(url.toString(), request)
      const cache = caches.default
      
      // Check cache
      let response = await cache.match(cacheKey)
      
      if (!response) {
        // Fetch from origin
        response = await fetch(request)
        
        // Cache if response has Cache-Control header
        if (response.headers.get('Cache-Control')) {
          await cache.put(cacheKey, response.clone())
        }
      }
      
      return response
    }
    
    // Pass through all other requests
    return fetch(request)
  }
}

curl http://localhost:4437/health

{
  admin off
  servers {
    metrics
  }
}

:4437 {
  route /v1/stream/* {
    durable_streams {
      data_dir /var/lib/durable-streams
    }
  }
  
  route /metrics {
    metrics /metrics
  }
}

{
  admin off
  log {
    output file /var/log/durable-streams/access.log
    format json
  }
}

{
  servers {
    max_header_bytes 16KB
  }
}

:4437 {
  route /v1/stream/* {
    durable_streams {
      data_dir /var/lib/durable-streams
      long_poll_timeout 30s
    }
  }
}

# /etc/security/limits.conf
durable-streams soft nofile 65536
durable-streams hard nofile 65536

:4437 {
  route /v1/stream/* {
    # Validate JWT token
    @authenticated {
      header Authorization "Bearer *"
    }
    
    handle @authenticated {
      durable_streams {
        data_dir /var/lib/durable-streams
      }
    }
    
    handle {
      respond "Unauthorized" 401
    }
  }
}

:4437 {
  route /v1/stream/* {
    header {
      Access-Control-Allow-Origin https://app.example.com
      Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
      Access-Control-Allow-Headers "Authorization, Content-Type"
    }
    
    durable_streams {
      data_dir /var/lib/durable-streams
    }
  }
}

1 KB × 100 msg/s × 86400 s/day × 30 days ≈ 259 GB