One HTTPS server in Modern Pascal to Rule Them All

A brand new asynchronous and event-driven HTTP server was written for mORMot 2, and we added some general-purpose features to make it a potential alternative to apache, nginx, caddy or IIS. We will present this web server, and some of its features.

Hands-On

Use modern object pascal for HTTP serving, even without any complex REST service
Web server best practices: HTTPS certificates, IP blacklisting, scaling, monitoring
Current alternatives, especially on Windows: e.g. Apache, nginx, caddy or IIS
Integrate the mORMot 2 Web Server to your production system
Optionally leverage the framework DB, ORM or SOA features

1. One HTTPS Server
in Modern Pascal
to Rule Them All
When embedded is better

2. Welcome
Arnaud Bouchez
•Open Source Founder
• mORMot 1, mORMot 2, SynPDF, dmustache
•Modern Object Pascal
Delphi and FPC -Embarcadero MVP
•Synopse Tranquil IT
https://synopse.info https://tranquil.it

3. Welcome
Arnaud Bouchez
•Open Source Founder
• mORMot 1, mORMot 2, SynPDF, dmustache
•Modern Object Pascal
Delphi and FPC -Embarcadero MVP
•Synopse Tranquil IT
https://synopse.info https://tranquil.it

4. One HTTPS Server
in Modern Pascal
to Rule Them All

5. Hands On
•Serve HTTPS from modern Object Pascal
•Web server best practices
•Beyond Apache, Nginx, Caddy or IIS
•Integrate the mORMot 2 Web Server
•Optionally leverage its Toolbox

6. Today’s Special
•HTTPS Web Servers
•mORMot 2 THttpAsyncServer
•ACME, PeerCache, ProxyCache
•Usecasesfor your projects

7. Today’s Special
•HTTPS Web Servers
•mORMot 2 THttpAsyncServer
•ACME, PeerCache, ProxyCache
•Usecasesfor your projects

8. HTTPS Web Servers

9. HTTPS Web Servers
Apache, Nginx, Caddy, IIS…
•Resolve Host names
•Serve static content
•Forward dynamic content
•Handle HTTPS security

10. HTTPS Web Servers
Apache, Nginx, Caddy, IIS…

11. HTTPS Web Servers
•HTTPS via ACME services
•HTTPS is mandatory
•Enter the Trust Chain
•Paid or free certificate
•Periodic renewal

12. HTTPS Web Servers
HTTPS via ACME services

13. HTTPS Web Servers
IIS–Internet Information Services
•Windows Specific
•Based on http.sys system driver
•Use the system registry and netshtool

14. HTTPS Web Servers
Apache, Nginx, Caddy
•Use configuration files
•Favor Linux/BSD
•Well known

15. HTTPS Web Servers
Apache
•The venerable web server
•LAMP (Linux Apache MySQLPHP)
•WAMP for debugging/testing
•Somewhat old and not scaling

16. HTTPS Web Servers
Nginx
•The most used in the Internet
•Very fast
•Unusable on Windows

17. HTTPS Web Servers
Caddy
•Written in Go
•Built-in HTTPS / ACME
•Convenient, but not as fast

18. HTTPS Web Servers
Apache, Nginx, Caddy, IIS…
•Another brick in the project
•Part of the Operating System
•System wide configuration
•HTTPS may be tricky to get working
•Can be tampered (for good or evil)

19. Today’s Special
•HTTPS Web Servers
•mORMot 2 THttpAsyncServer
•ACME, PeerCache, ProxyCache
•Usecasesfor your projects

20. mORMot 2 THttpAsyncServer

21. mORMot 2 THttpAsyncServer
•mormot.net.async.pas
•mormot.net.server.pas
•mormot.net.http.pas
•mormot.net.sock.pas

22. mORMot 2 THttpAsyncServer
mormot.net.sock.pas
•Cross-platform and cross-compiler
•High-level Socket abstraction
•poll() or epoll() API on POSIX/Linux
•IOCP on Windows(via mormot.core.os)
•INetTlsabstraction for HTTPS

23. mORMot 2 THttpAsyncServer
INetTlsabstraction for HTTPS
•OpenSSLon POSIX and Windows
mormot.lib.openssl11.pas
•SSPI / SChannelAPI on Windows
mormot.net.sock.pas

24. mORMot 2 THttpAsyncServer
mormot.net.http.pas
•Fast client/server HTTP state machine
•THttpServerRequestAbstractclass
•Logging/Metrics/IPBanengines

25. mORMot 2 THttpAsyncServer
mormot.net.server.pas
•Efficient URI routing
•THttpServerGenericclass
•THttpServerclass (not async)
•THttpApiServer(http.sys -Windows only)
•THttpPeerCache

26. mORMot 2 THttpAsyncServer
mormot.net.async.pas
•Non-blocking socket connections
•THttpAsyncServerEvent-Driven server
•THttpProxyServerwith cache

27. mORMot 2 THttpAsyncServer
mormot.net.async.pas
•Non-blocking socket connections
•THttpAsyncServerEvent-Driven server
•THttpProxyServerwith cache

28. mORMot 2 THttpAsyncServer
THttpAsyncServerEvent-Driven
•IOCP on Windows, epoll() on Linux
•Non-blocking socket+httpstate engine
•Internal thread pool
•Minimize memory allocations and locks

29. mORMot 2 THttpAsyncServer
THttpAsyncServerEvent-Driven
•Leverage simple/cheap hardware
•e.g. #1 in the TFB challenge
for serving cached ORM JSON
•Cross-platform and cross-compiler

30. mORMot 2 THttpAsyncServer
THttpServerGeneric.Router
•Register GET/POST/PUT… URIs
•Rewrite URIs in-place
•Redirect to Object Pascal callbacks

31. mORMot 2 THttpAsyncServer
THttpServerGeneric.Router
•Register GET/POST/PUT… URIs
•Rewrite URIs in-place
•Redirect to Object Pascal callbacks
… so you can do whatever you want …
… in pure code, with no configfiles …

32. mORMot 2 THttpAsyncServer
function TMyServer.Cached(ctxt: THttpServerRequest): cardinal;
vari: integer;
res: TOrmWorlds;
begin
SetLength(res, GetQueriesParamValue(ctxt, 'COUNT='));
for i:= 0 to length(res) -1 do
res[i] := fRawCache[Random32(WORLD_COUNT)];
result := ctxt.SetOutJson(@res, TypeInfo(TOrmWorlds));
end;

33. mORMot 2 THttpAsyncServer
https://www.techempower.com/benchmarks/#section=data -r23&test=cached-query

34. mORMot 2 THttpAsyncServer
SHOW ME THE CODE !

35. mORMot 2 THttpAsyncServer
THttpServer.Options
= set of THttpServerOption;
Let’s look at mormot.net.server.pas

36. mORMot 2 THttpAsyncServer
THttpServerOption
•IncludeDateHeader
•Ban40xIP
•EnableLogging
•TelemetryCsv/Json
•RejectBotUserAgent…

37. mORMot 2 THttpAsyncServer
THttpServerSocketGeneric.Banned
•Access a THttpAcceptBanIPv4 banning list
•Via hsoBan40xIP option
or manually from your code

38. mORMot 2 THttpAsyncServer
THttpServerSocketGeneric.BlackListUri
:= 'https://www.spamhaus.org/drop/drop.txt';
or any CIDR text list address
•Reject unsafe IP ASAP
•Automated daily update/refresh

39. mORMot 2 THttpAsyncServer
THttpServerSocketGeneric.SetAuthorize*()
•Enable BASIC / DIGEST / NEGOTIATE
authorization schemes
•BASIC/DIGEST with efficient in-memory lookup
•NEGOTIATE on POSIX (GSSAPI)and Windows (SSPI)

40. mORMot 2 THttpAsyncServer
THttpServerSocketGeneric.KeyTab
•Allow server-side Kerberos authentication
•Using an external keytabfile on POSIX/GSSAPI
•Can serve content outside of a Domain

41. mORMot 2 THttpAsyncServer
TWebSocketAsyncServer
•In mormot.net.ws.async.pasunit
•Plain HTTP, but can upgrade to WebSockets
•Non-blocking WebSocketsserver via callbacks

42. mORMot 2 THttpAsyncServer
TWebSocketAsyncServer

43. mORMot 2 THttpAsyncServer
As used by TRestHttpServer
•To publish a mORMot TRestServerlogic
•Over HTTP or WebSockets
•High-level SOA via methods or interfaces
•MVC Web with Mustache templates
… but not mandatory -and not this session topic ;)

44. Today’s Special
•HTTPS Web Servers
•mORMot 2 THttpAsyncServer
•ACME, PeerCache, ProxyCache
•Usecasesfor your projects

45. ACME, PeerCache, ProxyCache
Some “advanced” features
•Needed for my current work at TranquilIT
•Mimics existing features in pure pascal
(Let’s Encrypt certbot, MS BranchCache, Nginx/Squid)

46. ACME, PeerCache, ProxyCache
Some “advanced” features
•Needed for my current work at TranquilIT
•Mimics existing features in pure pascal
(Let’s Encrypt certbot, MS BranchCache, Nginx/Squid)
… but may be handy for your projects too!

47. ACME client for HTTPS

48. ACME client for HTTPS
Let’s the mORMot keep your keys!

49. ACME client for HTTPS
TAcmeLetsEncryptServer
•From mormot.net.acme.pas
•Host a simple HTTP server on port 80
to fulfill Let’s Encrypt or ZeroSSLchallenges
•Renew the certificates when needed
•Interact e.g. with a regular THttpAsyncServer

50. ACME client for HTTPS
TAcmeLetsEncryptServer
•Use OpenSSLfor the TLS / HTTPS layer
•No other external script or library
•Sensitive self-configuration by default

51. Custom/Mutual HTTPS
Specify your own certificates
•No need of ACME if you own the client
•Generate certificates mormot.crypt.secure.pas
•Server certificates -and your own CA
•Client certificates –for mutual authentication

52. Peer Cache

53. Peer Cache
THttpPeerCache
•From mormot.net.server.pas
•Maintain a cache between network peers
of remote HTTP/HTTPS resources
•Secured with proper cryptography

54. Peer Cache
THttpPeerCache= class(IWGetAlternate)
Used by our WGET -but with
1) UDP broadcast on the local network
2) Download a resource locally if available
or in the original URI for the first peer
3) Other peers would reuse this download
if they need the same resource

55. Proxy Cache

56. Proxy Cache
THttpProxyServercaching proxy
•Encapsulate THttpAsyncServer
•Use in-memory or on-disk (JSON) settings

57. Proxy Cache
THttpProxyServerpurpose
•Serve static content with in-memory cache
•Proxy remote content with disk cache
•Routing to Object Pascal callbacks

58. Proxy Cache
THttpProxyServerpurpose
•Serve static content with in-memory cache
•Proxy remote content with disk cache
•Routing to Object Pascal callbacks

59. Proxy Cache
Proxy remote content with disk cache
•e.g. to cache apt/rpm repositories
or any HTTP/HTTPS resources
•Optional PeerCachesupport (soon)
•A single executable on Windows or POSIX

60. Proxy Cache
SHOW ME THE CODE !

61. Today’s Special
•HTTPS Web Servers
•mORMot 2 THttpAsyncServer
•ACME, PeerCache, ProxyCache
•Usecasesfor your projects

62. When to use the mORMot

63. When to use the mORMot
mORMot is not a framework
… but a Toolbox
•You can pickup what you need
•You can use its Web Server
without the REST, SOA, ORM, DB…

64. When to use the mORMot
If you need regular PHP hosting

65. When to use the mORMot
If you need regular PHP hosting
•Then Nginxmay be a better candidate
•With a reverse proxy
to a PHP engine or a mORMot server
for dynamic content

66. When to use the mORMot
If you need regular PHP hosting
•Then Nginxmay be a better candidate
•But stay tuned…
because we plan to host PHP
very soon 

67. When to use the mORMot
If you extend a project to the web

68. When to use the mORMot
If you extend a project to the web
•You have an existing Object Pascal code
•You need to publish it over REST
•With some static content

69. When to use the mORMot
If you extend a project to the web
•You have an existing Object Pascal code
•You are using Windows and Delphi
•But plan to support Linux and FPC

70. When to use the mORMot
If you extend a project to the web
•You know well Object Pascal
•You don’t know so well Nginx& co
•But need HTTPS support

71. When to use the mORMot
If you extend a project to web/REST
•And consider configfiles as unsafe
•Or favor single executable delivery
•Or want to automate your own CA
•Or need a turnkey solution (e.g. regulation)

72. When to use the mORMot
If you extend a project to web/REST
•You have an existing Object Pascal code
•You plan to support Linux and FPC
•You prefer Object Pascal to configfiles
Then look at the mORMot Web Server!

73. When to use the mORMot
Don’t forget you can mix both
•You could e.g. use Nginx
as reverse proxy over a mORMot server
•And disable e.g. mORMot ACME or cache
at runtime in such cases

74. Today’s Special
•HTTPS Web Servers
•mORMot 2 THttpAsyncServer
•ACME, PeerCache, ProxyCache
•Usecasesfor your projects

75. To Visit the marmots
https://cauterets.site

76. Questions?