Help with the basics of deployment

[justanotheranonymoususer]

Summary

So I decided to write my latest internet-facing thing in Rust. I figured Axum is among the popular choices. I got it up and running locally. Then I grabbed my Ubuntu instance, opened the ports, installed Rust, configured a Let's Encrypt certbot, did some other boring stuff, then ran cargo run --release, and it worked!

But that can't be working like this in production, right? What about security updates? What about certbot updates? Now, I can create some fragile cron job or systemd service to try and handle it by running cargo update and restarting it periodically, but there must be a better way. Any help is appreciated!

Note that it's a hobby project, so losing existing connections after dependency updates or a cert update is acceptable (load balancer would be an overkill), but I also don't want to have too much of it - it's more than a toy I play with, it will have some users.

axum version

0.8.7

[jplatte]

What you described re. running cargo run --release on the server is basically how I run https://turbo.fish (it's wrapped in a systemd user service).

I think the next step up from that that I would consider personally would be setting up a small script to build a container from the app using buildah (CLI because I find it much more accessible than Dockerfiles), then push the resulting image to some container registry and set up a systemd quadlet that runs this (see this blog post).

Regarding security updates of the VM system + adjacent services, I'm not much of a devops person so others may be able to answer this better, but I think both Debian and Ubuntu server offer automatic background updates (not sure about reboots for kernel upgrades). There's also nixos which I think has a pretty big userbase for server stuff? Really depends on where you are coming from / what you're aiming for.

[justanotheranonymoususer]

Thank you for the reply. trubo fish is cool but being a joke website, it's less sensitive to security updates.

After thinking about it, and without having much devops knowledge, I settled for just creating a service and running it with systemd, which is similar to the cargo run approach. I'll have to keep up with the updates manually and hope for the best.

[darth-raijin]

If you’re not already using Docker, this might be a good time to pick it up.
It gives you a very simple, reliable way to run your application in a controlled environment, without relying on whatever happens to be installed on the host machine. That isolation removes a lot of long-term maintenance friction.

Right now you’re running cargo run directly on the server. That works for a hobby setup, but you immediately run into the questions you mentioned.

With Docker, you gain determinism: you build a known, tested binary image, publish it, and you know exactly what version of your application and dependencies is running in production. No accidental cargo update, no drift between environments, and no dependency surprises at runtime.

Ultimately it comes down to how much you value deterministic builds, and having guarantees.
If you want the guarantee that every deployment runs the same tested version you expect, packaging the app into a container makes that easy.