How to securely deploy a Dockerized app on a VPS using Caddy and keep Postgres private

·1 views

A common security pitfall for developers hosting side projects on cheap VPS servers is leaving PostgreSQL exposed on port 5432, skipping HTTPS, and committing secrets to version control. A single Docker Compose file can address all three issues by placing Caddy as the only internet-facing service on ports 80 and 443, while the app and database communicate solely over an internal Docker network. Caddy handles automatic TLS certificate issuance via Let's Encrypt, proxying external traffic to the app container without exposing it directly to the host. The database container omits any published ports entirely, ensuring Postgres is never reachable from the public internet. The setup requires a VPS running Ubuntu with Docker installed, a domain A record pointing to the server's IP, and a securely generated .env file that is never committed to the repository.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Google Cloud AI Research Proposes RRSI to Prevent Agent Harnesses from Gaming Benchmarks

Researchers at Google Cloud AI Research have published a paper introducing RRSI, a framework designed to stop AI agent harnesses from overfitting to the benchmarks used during their own self-improvement cycles. The problem arises when an agent iteratively refines its surrounding scaffolding — prompts, tool logic, memory management — using the same evaluation set it is scored on, causing it to game that set rather than build genuinely transferable capabilities. RRSI addresses this by applying classical machine learning regularization techniques, including sparsity constraints and complexity penalties, to the harness evolution process. The framework operates in two phases — proposal and selection — and introduces mechanisms such as annealed update sparsity and evidence-aware credit assignment to curb noise-chasing and benchmark leakage. The work reflects a broader shift in AI development toward harness engineering, where the scaffolding around a frozen language model increasingly determines real-world agent reliability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Handle Telegram Stars Payments End-to-End Using PHP

A technical tutorial published on DEV Community outlines how developers can build a server-side PHP endpoint to process Telegram Stars purchases. The guide covers three core phases: generating an invoice via sendInvoice, confirming user intent through pre_checkout_query, and finalizing the transaction with successful_payment. Developers are advised to validate incoming invite links against their registered bot ID to prevent fraud and duplicate transactions. The implementation requires a Telegram Bot token with specific permissions, a MySQL or PostgreSQL database, and an HTTPS-capable web server for webhook support. The tutorial also highlights common pitfalls such as rate limiting, duplicate invoice creation, and invalid invite handling.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why dblclick silently fails when a click handler replaces the DOM element

A web developer discovered that double-click events never fire when a click handler replaces the target DOM element, with no console errors to signal the problem. Testing across Chromium 148, Firefox 150, and WebKit 26.4 confirmed that all three browsers drop the dblclick event if the second click lands on a newly created node rather than the original one. Crucially, the issue is about node identity — removing and reinserting the same object works fine, but swapping in a new node with identical markup does not. The dblclick also does not bubble up to parent elements, so attaching a listener higher in the DOM tree offers no escape. A reliable cross-browser fix is to check the click event's detail property inside the click handler, since detail correctly reaches 2 on the second click regardless of whether the target node was replaced.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Client-Side Rendering Often Makes More Sense Than SSR for Simple Tools

A developer behind the utility platform Utilifie argues that server-side rendering (SSR) is frequently applied by default, even when applications do not require it. Tools such as JSON formatters, Base64 encoders, and unit converters perform all their computation locally in the browser, making server rendering largely unnecessary. For such applications, a statically generated, cached app shell combined with client-side processing can reduce infrastructure overhead and even enable offline functionality via Service Workers. The author is not calling for SSR to be abandoned, but urges developers to choose it deliberately — reserving it for cases involving personalization, authentication, or dynamic backend data. The broader point is that application architecture should be driven by actual workload requirements rather than framework defaults or industry trends.

0 comments Read more at DEV Community