← William Cooke

Ambrosia

active · 2 min · codeberg.org

elixir · otp · gemini · beam · tls · fault-tolerance · supervision-trees · concurrency · ranch · prometheus · docker · rate-limiting · security · small-internet

The unfortunately named Gemini protocol is, as far as I can tell, entirely overshadowed by Google's mediocre AI offerings. Though it predates it by many year, it is now occulted by the shadow of the vast Big Brother. Perhaps that is a good thing!

Gemini is a bastion of the quiet internet, one that utterly removes a vast swathe of security and privacy issues of the standard HTTP web. In Ambrosia, I wanted to create my own contribution to both that space and the Elixir ecosystem. The goal was a simple docker-based deployment, a high level of security and low attack surface, and to use OTP to build something resilient that could serve masses of traffic against low resources.

Each connection runs in its own supervised process via Ranch. If one crashes, others continue serving. A supervision tree oversees rate limiting via token bucket, connection tracking, the TCP acceptor pool, and a Prometheus metrics endpoint. That is the OTP architecture in action.

The whole thing runs comfortably on a Raspberry Pi at 75-100MB memory or equivalent VPS. There is an extensive set of security tests so it can mostly be left unsupervised (with standard hardening of other services) and has been tested at 1k concurrent requests. Docker deployment with automatic certificate generation, or build a release from source.

Though I count it as an active project, I don't have much time to work on it, there are still some features around TLS verification that would allow extended functionality seen in other servers.