How would you host an app written with Nodejs and SQLite?
Posted by Famous_Damage_2279@reddit | linuxadmin | View on Reddit | 14 comments
I like Nodejs and SQLite and am thinking to write some software with those two for the public internet. I am just not sure what would be a good way to host those in a decently secure way. I am just wondering, based on your experience, how would you set up to host an app with those two pieces of software? What Linux distro would you use and what stuff would you set up to make such software decently secure and reliable?
Maleficent-Bat-9168@reddit
for an easy choice, hostinger node js works well for a small node app, and you can use sqlite for low traffic as long as you back it up often
EnvironmentalFix9258@reddit
it doesn’t have to be complicated. a basic linux setup or a host like hostinger should be enough to run node js and sqlite if you just follow a few basic security steps.
sumsabumba@reddit
Just throw it up on vercel or something.
I would containerize it, and throw it in a vm somewhere. Postgres or MariaDB. NGINX is great but the config files a "fun" in the beginning. Most vm providers give you something decently secure. Use ssh keys and fail2ban.
ZaitsXL@reddit
Depending on complexity it can be either a function (like Lambda in AWS language) or a managed container platform (like Fargate in AWS language)
chilinux@reddit
If you are using SQLite then all your stress testing has involved if it scales to handling maybe only a couple concurrent requests at the same time. Reliable scalability and the goals of SQLite are two completely different things.
Another mistake made when it comes to nodejs being reliable is a misunderstanding of memory "garbage collection." nodejs will remove memory allocation for something that is no longer referenced. But that is not the same as automatically addressing stale references. It will not detect you never intend to ever use something. If the reference still exists, it is still technically in use even if it has been days or weeks from the last time the memory allocation was read or written to.
For reliability, make sure to carefully monitor how much the memory usage crawls up with each request.
Also learn how to do unit testing for your nodejs service such that you have success/failure criteria at the granular level of per function instead of only high level testing of does the entire app appear to work for the usual use case.
For "security" involving your nodejs/SQL service, make sure you are using prepared statement. Research what a SQL injection is and how to test if you can perform a SQL injection attack.
Make sure to run the service as an userid created only for the service. That userid should only be able to read and write to the files and directories it absolutely needs those permissions for. It should never be allowed to write to the nodejs script itself. If it should only ever be able to read/write to the SQL server then all files and directories should be set that it can not write to any of them.
Learning SELinux and how to create a strict profile for the system calls your nodejs needs (and does not need) would be a good additional step for security.
Have a third-party do a security review of your code. Also, if your understanding of the code is only what an AI told you then write off security as one of your goals. In that case limit what type of data the app handles accordingly with the assumption it might just be a matter of time before an "unforeseeable" edge use case penetrates the concept of security.
_Buldozzer@reddit
Maybe make a docker image out of it?
sudonem@reddit
First - this isn’t really the right sub for this question.
Secondly - Not knowing anything about the app you’ve written, my immediate thought is that you’ll want to reconsider SQLite. It’s not an amazing choice for a web application back end unless you’re literally the only user.
Broadly speaking - you probably want to find a way to containerize this via docker and shift to MySQL or MariaDB most likely so you can actually scale this thing.
slippery@reddit
I disagree with your take on SQLite. It is self-maintained in a single file, can scale, and handle transactions. Fine for most web apps with many users.
A more robust db would be needed if you want log replay or nosql type features or gis extensions.
franktheworm@reddit
Containers may be premature optimisation, but I would agree in steering away from sqlite in favour of MySQL/Maria, or postgres would be a suitable option too. For most apps, which you choose won't matter.
Its always concerning seeing "how do I security?" Style questions in the context of something that's live on the internet. OP, you can't get a thorough answer from Reddit on that, that's not how knowledge transfer works. You should adopt a default deny / least privilege approach to everything though. Block all traffic at the firewall level, allowing only what's needed. Grant db users only the permissions they need to do their role. Then, the important one is keep reading and learning, and iterate on what you have in place, fixing edge cases that you come across as you learn. If this is a commercial app that you're doing and you get traction, pay actual security people to review what you have and implement their recommendations.
Ditto for reliability. You'll need metrics and logs, and a strategy on how to define what's good and what's bad. The aim is to try catch the bad before it is service impacting (generically speaking).
Good luck, and godspeed
Famous_Damage_2279@reddit (OP)
For context the current version uses firestore and firebase functions where everything is managed by Google. I want SQLite because I feel that is a database that is simple to master and has SQL. I also think a single cloud vm with nodejs and SQLite should be fast and cheap and simple. This software is pretty low scale. The hard part is figuring out what kind of VM / linux if any, would be secure enough to run that on the public internet. If I can't find something that makes sense for SQLite my second option is just to switch from firestore to Spanner for a fully managed SQL database.
franktheworm@reddit
It's not about the distro, it's about how you use/configure the distro you choose. Ubuntu server, debian, fedora, rhel etc are all going to be fine and are running countless things on the internet, some securely, some insecurely - it depends on how they've been configured.
If your attitude towards security is simply to rely on the underlying os to be secure out of the box, you're in for some, let's say "interesting experiences"...
Sqlite's performance does not scale well. It does not (typically) handle a multi user environment well - use something fit for purpose.
There's no reason you can't run node and Maria or postgres or whatever other db you choose on the same server. It's been a common pattern for small scale web apps since the dawn of the age of putting things on servers.
HTX-713@reddit
NGINX in front of Nodejs, and MySQL instead of SQLite. you could easily host this in a single VM or set up a docker swarm for it.
Lock down host with CIS benchmarks.
Famous_Damage_2279@reddit (OP)
In your experience, which kind of host is easiest to lock down with CIS benchmarks?
HTX-713@reddit
I meant the OS. There are programs that will automatically reconfigure the OS to meet the CIS benchmarks (RHEL has a role built into the installer), however you will then need to know how to work around the limits put in place as some will most likely break access or functionality in some way.