I'm getting ready to deploy a small Axum web service for a client in Canada, and it stores customer details. PIPEDA covers most private businesses here, and BC public bodies and Quebec's Law 25 add stricter rules about where personal information is stored, so the server and database will both live in a Canadian data centre. This is my deployment plan:

  1. Build: a release build with cargo build --release, made on CI for the same target as the server.
  2. Binary size: LTO and strip = true in the release profile to keep the binary small.
  3. Service manager: a systemd unit with restart on failure and a dedicated non-root user.
  4. Reverse proxy: Caddy or Nginx in front for TLS, with the app listening only on localhost.
  5. Database: Postgres through sqlx, with migrations run before the new binary starts.
  6. Logging: tracing with JSON output, and logs kept on the same server for a limited time.
  7. Updates: cargo audit on every build, plus a quick rollback by keeping the previous binary.

For those running Rust services in production: do you prefer a plain binary with systemd or a container, and how do you handle zero-downtime restarts?

2 posts - 2 participants

Read full topic