Deployment

A Clamp web app ships as one release binary plus public/. It listens on 127.0.0.1 only, so a reverse proxy such as nginx faces the internet and handles HTTPS.

Build#

npm run build             # public/build/: views, CSS, JS
cargo build --release     # target/release/my-site

Copy the binary, public/ and .env to the server. Run it from the folder that contains public/ and storage/: paths are relative to the working directory.

Configure#

APP_ENV=production
PORT=8080              # fixed port for the proxy; the process exits if it is taken
LOG_CHANNEL=stderr     # let systemd or the container collect logs
LOG_LEVEL=info
TRUST_PROXY=true       # rate limits by X-Forwarded-For, behind exactly one proxy

With APP_ENV=production, Sessions::from_config makes the session cookie HTTPS-only, and refuses SESSION_SECURE=false.

Run behind nginx#

server {
    server_name example.com;
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Run the binary under systemd or a container with restart on failure. A panicking handler answers 500 and is logged; the server keeps running.

Know the limits#

• One request at a time. Fine for sites and internal tools. For high concurrency use rustclamp-http on Axum and Tower.
• State in memory. Sessions and rate-limit counts reset on restart and are not shared between processes.
• No HTTPS in the binary. Terminate TLS at the proxy.