DEV Community: ogc16

The Status Quo of AI in Software Development (2026)

ogc16 — Mon, 17 Aug 2026 15:40:14 +0000

Artificial Intelligence in 2026: From Companion to Infrastructure

Artificial Intelligence has moved from being a futuristic concept to an everyday companion in software development. In 2026, the landscape is defined by rapid innovation, fierce competition, and unresolved challenges around governance, sustainability, and labor. Developers today are navigating both unprecedented opportunities and complex risks.

Industry Dominance

Over 90% of notable AI models now originate from industry rather than academia, signaling commercialization as the primary driver of innovation. Research labs continue to contribute breakthroughs, but the pace of deployment is overwhelmingly shaped by corporate priorities, venture capital, and cloud infrastructure.

Geopolitical Competition

The United States leads in model releases and data center infrastructure, while China dominates robotics and research output. This rivalry shapes the pace and direction of AI development.

Europe has carved out a niche in regulation, with the AI Act setting global standards.
Emerging economies in Africa and India are focusing on applied AI, building tools for agriculture, education, and healthcare.

Compute Explosion

Global AI compute capacity has grown more than threefold annually since 2022, powered largely by Nvidia GPUs. Data centers now consume nearly 30 GW of electricity — comparable to the peak demand of New York City. This raises urgent questions about sustainability and the environmental cost of progress.

The ChatGPT Moment

Artificial Intelligence has had many waves, but the one that truly captured global attention was the release of ChatGPT. What began as a conversational model quickly became a cultural phenomenon, reshaping how people interact with technology, learn, and even work.

Disruption: It challenged traditional search engines, productivity tools, and educational practices.
Social Acceptance: Within months, it was integrated into classrooms, offices, and personal devices. AI was no longer niche — it was part of everyday life.

This acceptance marked a turning point: AI became a daily companion rather than a distant technology.

Competitors and Successors

The success of ChatGPT opened the floodgates for competitors, each pushing boundaries in unique ways:

DeepSeek: Efficiency and cost‑effectiveness, democratizing access for startups and individuals.
Claude (Anthropic): Safety and alignment, trusted by enterprises and governments.
OpenClaw: Multimodal capabilities, handling text, images, and structured data seamlessly.

Together, they signal that the AI race is far from over — innovation is accelerating across domains.

Governance and Ethics

Despite progress, unresolved challenges loom large:

Governance: Who sets the rules for safe deployment?
Labor impact: Automation reshapes jobs, but reskilling remains uneven.
Bias and trust: Ensuring fairness and reliability in outputs is still a work in progress.

Future Outlook

Artificial Intelligence in 2026 is no longer a tool but a partner. From classrooms to boardrooms, it shapes decisions, creativity, and governance. Yet the story is unfinished:

AI as infrastructure: Becoming as essential as electricity or the internet.
Hybrid intelligence: Humans and AI collaborating rather than competing.
Next disruption: Multimodal reasoning, embodied AI, or quantum‑accelerated models.

Artificial Intelligence has entered everyday life, but its trajectory will be defined not just by innovation, but by how societies govern, sustain, and integrate it into human progress.
## Share Your Experience

Artificial Intelligence is now part of everyday life, but usage varies widely.

Which AI do you rely on most in your daily work or personal projects?

ChatGPT
Claude
DeepSeek
OpenClaw
Other AI tools

Comment below or update your own README to let others know how you’re using AI day‑to‑day.

Deploying IaaS Platform: A Production Playbook

ogc16 — Fri, 14 Aug 2026 13:08:56 +0000

Learn how to go from docker compose up to production-grade deployments on Railway, Kubernetes, and beyond.

Follow-up to: Building a Multi-Tenant IaaS Platform in Go

Overview

Last week's post showed you the architecture of a production-ready IaaS platform. Today, we're going practical: how to actually run it in production.

IaaS Platform ships with multiple deployment options because different teams have different constraints:

Local dev — docker compose (5 seconds to running)
Single host — systemd + PostgreSQL (small team, Hetzner/Linode)
Containers — Docker image + Railway/Render (zero-ops, scales easily)
Kubernetes — StatefulSet + Secrets (enterprise teams)
Infrastructure-as-Code — Terraform (repeatable, auditable)

This post walks through each, with real configs you can copy-paste.

Part 1: Local Development (5 Minutes)

Start here. No thinking required.

The Fastest Possible Start

git clone https://github.com/ogc16/iaas-platform.git
cd iaas-platform
docker compose up -d
go run ./cmd/server

What just happened:

PostgreSQL 16 started in a Docker container (listening on localhost:5432)
Server migrations ran automatically
Control plane listening on http://localhost:8080
Dashboard loaded at /
API ready at /api/v1

What's Inside `docker-compose.yml`

services:
  postgres:
    image: postgres:16-alpine
    ports:
      - "5432:5432"
    environment:
      POSTGRES_USER: iaas
      POSTGRES_PASSWORD: iaas
      POSTGRES_DB: iaas
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U iaas -d iaas"]
      interval: 5s
      timeout: 5s
      retries: 5

Key takeaways:

Alpine Linux keeps the image tiny (~150 MB)
Health checks ensure readiness probes pass
Volume persists data across container restarts
Default credentials are fine for local dev (but NOT production)

Part 2: Single-Host Deployment (1 Hour Setup)

You're ready to show this to early users. Use a cheap VPS: $5/month on Linode or Hetzner.

Step 1: Provision the Host

# SSH into a fresh Ubuntu 22.04 server
ssh root@your-server-ip

# Update everything
apt-get update && apt-get upgrade -y

# Install Docker
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh

# Install PostgreSQL (system package, NOT container)
apt-get install -y postgresql postgresql-contrib

# Create DB user for the app
sudo -u postgres psql <<EOF
CREATE USER iaas WITH PASSWORD 'YOUR_SECURE_PASSWORD_HERE';
CREATE DATABASE iaas OWNER iaas;
GRANT ALL PRIVILEGES ON DATABASE iaas TO iaas;
EOF

# Verify connection
psql -h localhost -U iaas -d iaas -c "\dt"

Step 2: Deploy the Binary

# Download v0.1.0 release binary
wget https://github.com/ogc16/iaas-platform/releases/download/v0.1.0/iaas-platform-server-linux-amd64
chmod +x iaas-platform-server-linux-amd64

# Create a user to run the service
useradd -r -s /bin/false iaas-platform

# Move binary to a standard location
mkdir -p /opt/iaas-platform/bin
mv iaas-platform-server-linux-amd64 /opt/iaas-platform/bin/server
chown -R iaas-platform:iaas-platform /opt/iaas-platform

Step 3: Create a systemd Service

Save this to /etc/systemd/system/iaas-platform.service:

[Unit]
Description=IaaS Platform Control Plane
After=network-online.target postgresql.service
Wants=network-online.target

[Service]
Type=simple
User=iaas-platform
Group=iaas-platform

# Load environment variables from a file
EnvironmentFile=/etc/iaas-platform/env

ExecStart=/opt/iaas-platform/bin/server

# Auto-restart if the process crashes
Restart=on-failure
RestartSec=5

# Limits
LimitNOFILE=65536
TimeoutStopSec=30

[Install]
WantedBy=multi-user.target

Step 4: Configure Environment Variables

Create /etc/iaas-platform/env:

# Production hardening
ENV=production
PORT=8080

# Database (use the user/password from Step 1)
DATABASE_URL=postgres://iaas:YOUR_SECURE_PASSWORD_HERE@localhost:5432/iaas?sslmode=require

# Generate a strong secret: openssl rand -hex 32
JWT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Password hashing
BCRYPT_COST=12

# Email (optional; without SMTP, password-reset links are logged to stdout)
SMTP_HOST=smtp.sendgrid.net
SMTP_PORT=587
SMTP_USERNAME=apikey
SMTP_PASSWORD=SG.xxxxxxxxxxxxx
SMTP_FROM=noreply@yourdomain.com

# Base URL for password-reset links
APP_BASE_URL=https://iaas.yourdomain.com

# Restrict read access
chmod 600 /etc/iaas-platform/env

Step 5: Enable and Start

systemctl daemon-reload
systemctl enable iaas-platform
systemctl start iaas-platform
systemctl status iaas-platform   # Verify it's running

Step 6: Nginx Reverse Proxy

Put this in /etc/nginx/sites-available/iaas:

upstream iaas_platform {
    server 127.0.0.1:8080;
}

# HTTP → HTTPS redirect
server {
    listen 80;
    server_name iaas.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

# HTTPS server
server {
    listen 443 ssl http2;
    server_name iaas.yourdomain.com;

    # Use Let's Encrypt (or your CA)
    ssl_certificate /etc/letsencrypt/live/iaas.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/iaas.yourdomain.com/privkey.pem;

    # Security headers (some added by our app, but reinforce here)
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Referrer-Policy "no-referrer" always;

    # Request body size limit (prevents DoS; issue #13 will add this to the app)
    client_max_body_size 1M;

    # Proxy to our app
    location / {
        proxy_pass http://iaas_platform;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeouts for long-polling (health checks, etc.)
        proxy_read_timeout 30s;
        proxy_connect_timeout 10s;
    }
}

Step 7: Get an SSL Certificate

apt-get install -y certbot python3-certbot-nginx
certbot certonly --nginx -d iaas.yourdomain.com

# Auto-renew
systemctl enable certbot.timer

Step 8: Verify It Works

# Check the app is running
curl https://iaas.yourdomain.com/healthz
# Should return: OK

# Check readiness (pings the database)
curl https://iaas.yourdomain.com/readyz
# Should return: OK

# Open in browser
open https://iaas.yourdomain.com

Cost: ~$5/month (VPS) + ~$10/year (domain) + free SSL (Let's Encrypt).

Part 3: Container Deployment (No Server Management)

Use Railway or Render for zero-ops deployment. We'll show Railway because it's fast.

Step 1: Containerize the App

The repo includes a multi-stage Dockerfile:

# Build stage
FROM golang:1.26-alpine AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/server ./cmd/server

# Runtime stage (distroless = minimal, no shell, no package manager)
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=build /out/server /usr/local/bin/
EXPOSE 8080
ENTRYPOINT ["/usr/local/bin/server"]

Why distroless?

✅ Image size: ~30 MB (not 800 MB with Alpine)
✅ No shell or package manager = smaller attack surface
✅ Runs as non-root by default (uid 65532)
✅ Security scanning doesn't find phantom vulnerabilities

Step 2: Push to Container Registry

Option A: GitHub Container Registry (free, no auth needed for public repos):

docker build -t ghcr.io/YOUR_GITHUB_USERNAME/iaas-platform:latest .
docker push ghcr.io/YOUR_GITHUB_USERNAME/iaas-platform:latest

Option B: Docker Hub:

docker build -t YOUR_DOCKER_USERNAME/iaas-platform:latest .
docker push YOUR_DOCKER_USERNAME/iaas-platform:latest

Step 3: Deploy to Railway

Go to railway.app
Click "New Project" → "Deploy from GitHub"
Select your iaas-platform fork
Railway auto-detects the Dockerfile
Add PostgreSQL 16 plugin
Set environment variables:

   ENV=production
   JWT_SECRET=<generate: openssl rand -hex 32>
   DATABASE_URL=<Railway generates this automatically>
   BCRYPT_COST=12

Deploy button → Wait 2 minutes

That's it. Railway provides:

✅ HTTPS by default (auto-generated domain)
✅ PostgreSQL managed for you
✅ Auto-scaling
✅ $5/month free tier (then $5/gb RAM/month)

Your app is now live at: https://yourdomain-production-xxxx.railway.app

Part 4: Kubernetes Deployment (Enterprise)

For large teams, Kubernetes gives you orchestration, auto-scaling, and self-healing.

Prerequisites

A Kubernetes cluster (EKS, GKE, DigitalOcean, or local minikube)
kubectl CLI
helm (optional but recommended)

Step 1: Create Secrets

# Generate a strong JWT secret
JWT_SECRET=$(openssl rand -hex 32)

# Create a Kubernetes secret
kubectl create secret generic iaas-platform-secrets \
  --from-literal=JWT_SECRET=$JWT_SECRET \
  --from-literal=DATABASE_URL=postgres://iaas:password@postgres-svc:5432/iaas \
  --from-literal=BCRYPT_COST=12 \
  --from-literal=ENV=production

Step 2: Deploy PostgreSQL (if not using managed RDS)

Create postgres.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: postgres-config
data:
  POSTGRES_USER: iaas
  POSTGRES_DB: iaas

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
spec:
  replicas: 1
  selector:
    matchLabels: { app: postgres }
  template:
    metadata:
      labels: { app: postgres }
    spec:
      containers:
      - name: postgres
        image: postgres:16-alpine
        envFrom:
        - configMapRef:
            name: postgres-config
        env:
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: postgres-secrets
              key: password
        ports:
        - containerPort: 5432
        volumeMounts:
        - name: data
          mountPath: /var/lib/postgresql/data
        livenessProbe:
          exec:
            command: ["pg_isready", "-U", "iaas"]
          initialDelaySeconds: 30
          periodSeconds: 10
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: postgres-pvc

---
apiVersion: v1
kind: Service
metadata:
  name: postgres-svc
spec:
  selector: { app: postgres }
  ports:
  - port: 5432
    targetPort: 5432

Step 3: Deploy the App

Create iaas-platform.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: iaas-platform
  labels: { app: iaas-platform }
spec:
  replicas: 2
  selector:
    matchLabels: { app: iaas-platform }
  template:
    metadata:
      labels: { app: iaas-platform }
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
      containers:
      - name: server
        image: ghcr.io/YOUR_GITHUB_USERNAME/iaas-platform:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
          name: http
        envFrom:
        - secretRef:
            name: iaas-platform-secrets
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5

---
apiVersion: v1
kind: Service
metadata:
  name: iaas-platform-svc
spec:
  selector: { app: iaas-platform }
  type: LoadBalancer
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP

---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: iaas-platform-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: iaas-platform
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

Step 4: Apply and Verify

# Create namespace
kubectl create namespace iaas

# Apply configs
kubectl apply -f postgres.yaml -n iaas
kubectl apply -f iaas-platform.yaml -n iaas

# Wait for rollout
kubectl rollout status deployment/iaas-platform -n iaas

# Get the LoadBalancer IP
kubectl get svc iaas-platform-svc -n iaas

# Test it
curl http://<LOAD_BALANCER_IP>/healthz

Kubernetes gives you:

✅ Auto-scaling (CPU-based HPA)
✅ Self-healing (pod restarts on failure)
✅ Rolling updates (zero downtime deploys)
✅ Multi-region ready (Federated clusters)

Part 5: Infrastructure-as-Code (Terraform)

For repeatable, auditable infrastructure.

What's Included

The repo has examples/terraform/ with configs for single-host Docker deployment (great for staging):

# examples/terraform/main.tf

terraform {
  required_version = ">= 1.5"
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
      version = "~> 3.0"
    }
  }
}

provider "docker" {}

# PostgreSQL container
resource "docker_container" "postgres" {
  name  = "iaas-platform-postgres"
  image = docker_image.postgres.image_id
  env = [
    "POSTGRES_USER=iaas",
    "POSTGRES_PASSWORD=${var.database_password}",
    "POSTGRES_DB=iaas",
  ]
  ports {
    internal = 5432
    external = var.database_port
  }
  volumes {
    volume_name    = docker_volume.postgres_data.name
    container_path = "/var/lib/postgresql/data"
  }
}

# App server container
resource "docker_container" "server" {
  name  = "iaas-platform-server"
  image = docker_image.iaas_platform.image_id
  env = [
    "ENV=production",
    "HTTP_ADDR=:${var.server_port}",
    "DATABASE_URL=postgres://iaas:${var.database_password}@postgres:5432/iaas?sslmode=disable",
    "JWT_SECRET=${var.jwt_secret}",
  ]
  ports {
    internal = var.server_port
    external = var.server_port
  }
  depends_on = [docker_container.postgres]
}

Deploy with Terraform

cd examples/terraform
terraform init
terraform apply -var server_image_tag=v0.1.0

Benefits:

✅ Repeatable (same config → same infrastructure)
✅ Auditable (git history of changes)
✅ Shareable (colleague runs terraform apply, gets identical setup)
✅ Destroyable (tear down with terraform destroy)

Production Readiness Checklist

Before launching, verify:

Security

[ ] ENV=production (refuses weak JWT secrets)
[ ] JWT_SECRET is ≥32 bytes random (run: openssl rand -hex 32)
[ ] TLS enabled (HTTPS only, no HTTP)
[ ] Database password strong
[ ] SMTP credentials NOT committed to Git (use env or secrets manager)
[ ] API key hashing enabled (default)

Operations

[ ] Health probes working (/healthz, /readyz)
[ ] Logs flowing to stdout (JSON structured via slog)
[ ] Backups scheduled (pg_dump daily)
[ ] Rollback plan documented

Testing

[ ] api-usage.sh works against production
[ ] Dashboard loads
[ ] Can create org, instance, and generate invoice
[ ] Password reset emails working (if SMTP enabled)

Cost Comparison

Platform	Cost/Month	Setup Time	Scaling	Best For
Single Host (systemd)	$5-15	1 hour	Manual	Early-stage startups, learning
Railway/Render	$5-50	10 min	Auto	Fast iteration, small teams
Kubernetes (GKE/EKS)	$100+	2 hours	Auto	Enterprise, high traffic
Terraform (staging)	$10-50	30 min	Repeatable	CI/CD integration, testing

Deployment Workflow (Complete Example)

# 1. Build and test locally
make test
make race
docker build -t iaas-platform:latest .

# 2. Push to registry
docker tag iaas-platform:latest ghcr.io/you/iaas-platform:v0.1.1
docker push ghcr.io/you/iaas-platform:v0.1.1

# 3. Deploy to staging (Terraform)
cd examples/terraform
terraform apply -var server_image_tag=v0.1.1

# 4. Smoke test
curl http://staging-server/healthz
bash examples/api-usage.sh

# 5. Deploy to production (Railway or K8s)
# Railway: auto-deploys on git push
# K8s: kubectl set image deployment/iaas-platform \
#        server=ghcr.io/you/iaas-platform:v0.1.1

# 6. Verify
curl https://iaas.yourdomain.com/healthz

Monitoring in Production

IaaS Platform logs structured JSON (via Go's slog). Aggregate with:

ELK Stack — Elasticsearch + Logstash + Kibana
Datadog — SaaS APM (integrates with Kubernetes)
Grafana Loki — Lightweight log aggregation
CloudWatch — If using AWS

Every request includes an X-Request-ID for correlation.

Missing: Prometheus metrics. That's issue #14; see ROADMAP.md.

Next Steps

Pick your platform — Start with Railway if unsure
Follow the steps above — Copy-paste the configs
Test the API — Run examples/api-usage.sh
Explore the dashboard — Create an org, spin up an instance
Open an issue — Something missing? File it on GitHub

Troubleshooting

"healthz returns 503"

Database isn't reachable. Check:

# Is PostgreSQL running?
docker ps | grep postgres

# Can the app reach it?
curl $DATABASE_URL  # Should fail gracefully, not hang

"502 Bad Gateway"

App crashed. Check logs:

# If systemd:
journalctl -u iaas-platform -f

# If Docker:
docker logs iaas-platform-server

# If Kubernetes:
kubectl logs -f deployment/iaas-platform -n iaas

"Certificate verification failed"

TLS misconfigured. For development:

curl --insecure https://localhost:8080/healthz

For production, ensure Let's Encrypt cert is valid:

openssl x509 -in /etc/letsencrypt/live/yourdomain.com/fullchain.pem -text -noout

What's Next?

This series has covered:

Part 1 - Architecture: Multi-tenant design, billing engine, async lifecycle
Part 2 - Deployment (this post): Local, single-host, containerized, K8s
Part 3 (coming soon) - Scaling beyond v0.1.0: Prometheus metrics, webhook notifications, real compute backends

Join the Community

The IaaS Platform is open source and growing:

⭐ GitHub
💬 Discussions
🐛 Open Issues (5 good-first-issues for contributors)

Have deployment questions? Reply in the comments below or open an issue.

Happy deploying! 🚀

Learn how to build a cloud control panel with authentication, billing, and resource management — complete with runnable code.

ogc16 — Fri, 14 Aug 2026 12:20:24 +0000

Building a Multi-Tenant IaaS Platform in Go: From Zero to Production

Learn how to build a cloud control plane with authentication, billing, and resource management — complete with runnable code.

TL;DR: I built an open-source Infrastructure-as-a-Service platform in Go with multi-tenant orgs, async compute lifecycle, usage-based billing, and production-grade security. It's ~2,000 lines of code, fully tested, and ready to deploy. Check it out on GitHub.

Why I Built This

A few months ago, I was trying to understand how cloud platforms like AWS, DigitalOcean, and Heroku work under the hood. Specifically:

How do they isolate customer data across multiple organizations?
How does the billing engine track usage and generate invoices?
How do they manage async compute lifecycle (start/stop/terminate)?
What does secure multi-tenant architecture actually look like?

I couldn't find a reference implementation that was both simple enough to learn from and complete enough to be production-like. So I built one.

The result is IaaS Platform: a fully-functional control plane that handles authentication, multi-tenancy, compute resource management, and usage-based billing — all in ~2,000 lines of clean, tested Go code.

What Does It Do?

Imagine you're building your own version of AWS or Heroku. You need:

1️⃣ Authentication & Tenancy

Users sign up with email/password
Each user can create multiple organizations
Organizations have members with roles (admin/member)
Member suspensions with auto-expiry
API keys for programmatic access

2️⃣ Compute Lifecycle

Users request compute instances
Instances move through states asynchronously: pending → running → stopping → stopped
Per-organization quotas (max 20 instances, 16 vCPU, 32 GB RAM, 500 GB disk)
Per-region capacity enforcement (e.g., us-east-1 has 64 vCPU total)
Background reconciler settles transient states

3️⃣ Usage-Based Billing

Track CPU hours, memory GB-hours, disk GB-hours
Pricing: $0.50/core-hour, $0.20/GB-hour, $0.01/GB-hour
Generate invoices monthly with line items
Audit-logged every transaction

4️⃣ Production Features

JWT + API key authentication (both Bearer and X-API-Key)
Rate limiting (token bucket, 1 req/sec per IP/API key)
Security headers (CSP, HSTS, X-Frame-Options, etc.)
Bcrypt password hashing (cost 12)
API keys stored as SHA-256 hashes at rest
CodeQL + gitleaks in CI
Full test suite with integration tests
OpenAPI 3.0 spec included

Architecture Overview

Here's how the pieces fit together:

┌─────────────────────────────────────────────────────┐
│  HTTP Client (curl, SDK, Dashboard)                 │
│  with JWT Bearer or X-API-Key                       │
└─────────────────┬───────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────┐
│  Chi Router + Middleware Layer                      │
│  • CORS, Logging, Rate Limiting, Security Headers   │
│  • Request ID propagation                           │
└─────────────────┬───────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────┐
│  Service Layer (Business Logic)                     │
│  • AuthService (JWT, bcrypt, API keys)              │
│  • ComputeService (quota, capacity, state machine)  │
│  • BillingService (usage tracking, invoices)        │
│  • OrganizationService (multi-tenancy)              │
└─────────────────┬───────────────────────────────────┘
                  │
                  ▼
┌─────────────────────────────────────────────────────┐
│  PostgreSQL 16 (pgx driver)                         │
│  • users, organizations, members, instances         │
│  • usage_records, invoices, invoices_line_items     │
│  • quotas, region_capacity                          │
└─────────────────────────────────────────────────────┘

Key insight: The API layer is intentionally thin. All business rules (quota checks, capacity enforcement, multi-tenancy gates) live in the service layer.

Let's Look at the Code

1. Multi-Tenant Quota Enforcement

Here's how we prevent one organization from consuming all resources:

// internal/compute/service.go

func (s *Service) enforceQuota(ctx context.Context, orgID int64, cpu, mem, disk int) error {
    quota, err := s.quotas.Get(ctx, orgID)
    if err != nil {
        return fmt.Errorf("get quota: %w", err)
    }

    // Sum active instances for this org
    usage, err := s.repo.SumActiveByOrg(ctx, orgID)
    if err != nil {
        return fmt.Errorf("sum org usage: %w", err)
    }

    // Check each dimension: instances, CPU, memory, disk
    if usage.Count+1 > quota.MaxInstances {
        return fmt.Errorf("%w: would exceed quota", ErrQuotaExceeded)
    }
    if usage.CPUCores+int64(cpu) > quota.MaxCPUCores {
        return fmt.Errorf("%w: CPU exceeds quota (%d max)", ErrQuotaExceeded, quota.MaxCPUCores)
    }
    if usage.MemoryMB+int64(mem) > quota.MaxMemoryMB {
        return fmt.Errorf("%w: memory exceeds quota", ErrQuotaExceeded)
    }
    if usage.DiskGB+int64(disk) > quota.MaxDiskGB {
        return fmt.Errorf("%w: disk exceeds quota", ErrQuotaExceeded)
    }

    return nil
}

What's important here:

Multi-dimensional quotas (not just "max instances", but CPU, memory, disk separately)
Check enforcement at creation time (fail fast)
Each org has independent limits
Graceful error messages that tell users exactly what they hit

2. Async State Machine

Instances don't provision instantly. Here's how we handle that without blocking:

// internal/compute/service.go

var instanceTransitions = map[string]map[string]bool{
    "pending": {
        "running":     true,  // reconciler advances this
        "terminating": true,  // user can terminate anytime
    },
    "running": {
        "stopping":    true,
        "terminating": true,
    },
    "stopping": {
        "stopped":     true,  // reconciler advances this
        "terminating": true,
    },
    "stopped": {
        "pending":     true,  // user restarts
        "terminating": true,
    },
    "terminating": {
        "terminated": true,   // reconciler advances this
    },
}

func (s *Service) Create(ctx context.Context, orgID, userID int64, req models.CreateInstanceRequest) (*models.ComputeInstance, error) {
    // ... validation & quota checks ...

    inst := &models.ComputeInstance{
        OrganizationID: orgID,
        Status:         "pending",  // Start here
        // ... specs ...
    }

    // Immediately persist to DB
    if err := s.repo.Create(ctx, inst); err != nil {
        return nil, err
    }

    // Return 202 Accepted to client
    // Background reconciler advances pending → running
    return inst, nil
}

Why this matters:

API returns immediately (202 Accepted, not blocking)
Client polls /orgs/{id}/instances/{id} to watch status
Background reconciler (runs every 2 seconds) advances pending → running
Prevents one slow provision from blocking other requests

3. Usage-Based Billing

Here's how we track usage and generate invoices:

// internal/billing/service.go

var unitPrices = map[string]int64{
    "cpu_hours":           50,  // $0.50 per CPU hour
    "memory_gb_hours":     20,  // $0.20 per GB-hour
    "disk_gb_hours":        1,  // $0.01 per GB-hour
}

func (s *Service) GenerateInvoice(ctx context.Context, orgID int64) (*models.Invoice, error) {
    now := time.Now().UTC()
    periodStart := time.Date(now.Year(), now.Month(), 1, 0, 0, 0, 0, time.UTC)
    periodEnd := periodStart.AddDate(0, 1, 0)

    // Get 30-day usage summary
    usage, err := s.usageRepo.GetSummary(ctx, orgID, periodStart)
    if err != nil {
        return nil, err
    }

    // Calculate amounts in cents
    items := []struct {
        resourceType string
        quantity     float64
        description  string
    }{
        {"cpu_hours", usage.CPUHours, "CPU Hours"},
        {"memory_gb_hours", usage.MemoryGBHours, "Memory GB-hours"},
        {"disk_gb_hours", usage.DiskGBHours, "Disk GB-hours"},
    }

    var totalCents int64
    for _, item := range items {
        if item.quantity > 0 {
            totalCents += int64(item.quantity * float64(unitPrices[item.resourceType]))
        }
    }

    // Create invoice and line items
    inv := &models.Invoice{
        OrganizationID: orgID,
        AmountCents:    totalCents,
        PeriodStart:    periodStart,
        PeriodEnd:      periodEnd,
        Status:         "pending",
    }

    if err := s.invoiceRepo.Create(ctx, inv); err != nil {
        return nil, err
    }

    // Add detailed line items for transparency
    for _, item := range items {
        if item.quantity > 0 {
            li := &models.InvoiceLineItem{
                InvoiceID:      inv.ID,
                Description:    item.description,
                ResourceType:   item.resourceType,
                Quantity:       item.quantity,
                UnitPriceCents: unitPrices[item.resourceType],
                AmountCents:    int64(item.quantity * float64(unitPrices[item.resourceType])),
            }
            s.invoiceRepo.AddLineItem(ctx, li)
        }
    }

    return inv, nil
}

Key details:

Usage tracked in 30-day windows
Money always in cents (integer math, no float rounding errors)
Line items for transparency (customers can see CPU hours vs memory hours)
Idempotent (calling twice for same month doesn't double-charge)

4. Multi-Tenant Security

Every service layer operation checks membership before proceeding:

// Pattern repeated across compute, billing, organizations services

func (s *Service) Get(ctx context.Context, orgID, instanceID, userID int64) (*models.ComputeInstance, error) {
    // ALWAYS check membership first
    if _, err := s.orgRepo.FindMember(ctx, orgID, userID); err != nil {
        if errors.Is(err, database.ErrNotFound) {
            return nil, ErrNotInOrg
        }
        return nil, fmt.Errorf("check membership: %w", err)
    }

    // Then get the resource
    inst, err := s.repo.FindByID(ctx, instanceID)
    if err != nil {
        return nil, err
    }

    // Verify it belongs to the right org
    if inst.OrganizationID != orgID {
        return nil, ErrNotFound
    }

    return inst, nil
}

Why this is critical:

Multi-tenancy is enforced at the service layer, not just the router
Prevents SQL injection or logic bugs from leaking data across orgs
Defense in depth: router checks + service checks

Getting Started (5 Minutes)

Prerequisites

Docker & Docker Compose
Go 1.26+
curl & jq (for examples)

Quick Start

# 1. Clone the repo
git clone https://github.com/ogc16/iaas-platform.git
cd iaas-platform

# 2. Start PostgreSQL
docker compose up -d

# 3. Run the server
go run ./cmd/server

# 4. Try the API
curl -X POST http://localhost:8080/api/v1/auth/signup \
  -H 'Content-Type: application/json' \
  -d '{"email":"test@example.com","password":"changeme123","name":"Demo User"}'

# 5. Explore the dashboard
open http://localhost:8080

Or run the full end-to-end demo:

bash examples/quick-start.sh

This will:

Start PostgreSQL
Boot the server
Create a user account
Create an organization
Provision an instance (watch it move from pending → running)
Record usage and generate an invoice
Clean up everything

Production Readiness Checklist

The platform is designed to be deployed to production. Here's what we included:

Security ✅

Passwords: bcrypt (cost 12)
API keys: stored as SHA-256 hashes
JWT: HS256, 24h expiry, configurable
Headers: CSP, HSTS, X-Frame-Options, etc.
Secret scanning: gitleaks in CI
Code scanning: CodeQL on every PR
Audit logging: every action recorded with actor/IP/timestamp

Testing ✅

45%+ code coverage
Unit tests for all services
Integration tests against PostgreSQL
Race detector enabled in CI
go vet & gofmt checks

Operations ✅

Health probes: /healthz (always 200) and /readyz (checks DB)
Structured logging with request IDs
OpenAPI 3.0 spec (machine-readable)
Docker multi-stage build (distroless runtime)
Graceful shutdown
Connection pooling (pgx)

Deployment ✅

Environment-based config (12-factor app)
TLS support (in-process or reverse proxy)
Horizontal scaling ready (but bring your own shared rate-limit store)
Kubernetes-friendly (health probes, graceful shutdown, resource requests)

What's Next?

This is v0.1.0. The roadmap includes:

v1.0

[ ] Prometheus metrics export (/metrics)
[ ] CORS allowlist (currently allows all origins)
[ ] Request-body size limits
[ ] API key rotation endpoint
[ ] golangci-lint integration
[ ] Transaction support for multi-step writes
[ ] Database migrations versioning

v2.0

[ ] Real compute backends (Docker, Podman, AWS EC2)
[ ] Webhook notifications for lifecycle events
[ ] Per-account rate limiting beyond global bucket
[ ] Control plane dashboard v2 (real-time charts, cost forecasts)
[ ] Audit logs UI
[ ] Usage aggregation jobs (move billing out of request path)

Key Takeaways

Building this taught me several things I wish I'd known earlier:

Service layer is the security perimeter. Router auth checks are necessary but not sufficient. Every service method should re-verify authorization.
Async operations unblock your API. Don't provision instances synchronously. Return 202 Accepted, then have a background reconciler advance state.
Track money in cents, not dollars. Float precision issues will haunt you. Use integers for financial calculations.
Multi-dimensionality matters. Quotas aren't just "max instances". Real systems need CPU, memory, disk, and network quotas.
Observability from day one. Structured logging, health probes, and OpenAPI specs aren't afterthoughts. Build them in.
Test with real PostgreSQL. Unit tests are great, but integration tests against your actual database catch the bugs that matter.

Try It Out

GitHub: ogc16/iaas-platform

⭐ Star if you find it useful
🐛 Open issues for bugs or feature requests
🤝 PRs welcome — see CONTRIBUTING.md
💬 Questions? Start a discussion

Let's Connect

What aspects of building multi-tenant systems interest you most? I'd love to hear your thoughts in the comments:

Are you building a SaaS platform?
Which part would you like me to explain in more detail?
What did you learn from this project?

Tweet @ogc16 or reply here.

MCP Servers Explained

ogc16 — Fri, 28 Mar 2025 08:43:28 +0000

MCP Servers are systems that provide context, tools, and prompts to AI clients. See

MCP is a standard open-source protocol developed for AI to securely access external data and tools, enabling consistent and interoperable interactions
using a client-server system with standardized requests and secure OAuth authorization, allowing AI to access external tools and data sources.

How are you adapting as a developer?

ogc16 — Fri, 28 Mar 2025 07:20:08 +0000

With a few prompts you are able to achieve amazing products like:

Streaming platform

The objective is to create a streaming service offering a diverse library of content, personalized recommendations, and innovative features that enhance the viewing experience. This platform will differentiate itself through a focus on niche content, community engagement, and flexible pricing models while maintaining affordability and accessibility for users worldwide.

Key Goals and Objectives
> Primary Goals:

Provide a vast library of movies, TV shows, documentaries, and original content.
Offer advanced personalization through AI-driven recommendations based on user behavior and preferences.
Support community features like live watch parties, discussion forums, and user-generated content.

> Secondary Goals:

Introduce flexible pricing models (e.g., à la carte content selection, tiered subscriptions).
Ensure seamless integration with various devices (smart TVs, mobile apps, gaming consoles).
Offer high-quality video streaming with options for 4K, HDR, and Dolby Atmos.

Target Audience

>Primary Users:

Young adults (18–35) seeking diverse content options and social features.
Niche audiences interested in independent films, documentaries, or international content.
Families looking for affordable entertainment solutions with parental controls.

>Demographics:

Global reach with a focus on urban, tech-savvy individuals who value content discovery and community engagement.

Competitor Analysis
Netflix:

Strengths: Extensive content library, strong brand recognition, user-friendly interface.
Weaknesses: Increasing costs; limited focus on niche content or community features.

Amazon Prime Video:

Strengths: Integration with Amazon ecosystem; additional benefits like free shipping.
Weaknesses: Confusing interface; less emphasis on social features.

Hulu:

Strengths: Strong focus on TV shows; affordable pricing options.
Weaknesses: Limited international content; fewer original titles compared to Netflix.

Disney+:

Strengths: Exclusive Disney, Pixar, Marvel, and Star Wars content; family-friendly focus.
Weaknesses: Limited content diversity beyond Disney franchises.

> Design Requirements

Functional Needs:

Advanced search and recommendation algorithms based on user viewing history and ratings.
Community features like live watch parties with real-time chat, user reviews, and ratings.
Flexible pricing models allowing users to choose specific content bundles or à la carte options.
High-quality video streaming with support for 4K, HDR, and Dolby Atmos.

> Visual Design:

Clean interface with customizable themes (light/dark mode).
Dynamic content showcases highlighting new releases, user favorites, and trending titles.
Intuitive navigation for discovering new content or accessing personalized recommendations.

Regards Ref

Can AI outsmart Human beings?

ogc16 — Wed, 26 Mar 2025 19:10:42 +0000

Software's Future: Developer's Role Evolves

Software drives our world, from phones to global systems. Developers are key, but tech advances bring change.
The world is increasingly powered by software. From the smartphones in our pockets to the complex systems running global infrastructure, software developers are the architects of our digital reality. But as technology advances at an unprecedented pace, what does the future hold for these vital professionals? It's a landscape of both immense opportunity and evolving challenges.

The Rise of AI and Automation:

Perhaps the most significant shift is the increasing integration of artificial intelligence (AI) and automation into the development workflow. AI-powered tools are already assisting with code generation, bug detection, and testing, streamlining the development process. In the future, we can expect:

AI-assisted coding: AI models will become more sophisticated, capable of generating complex code snippets and even entire applications based on high-level specifications. This doesn't mean developers will be replaced, but rather that their role will evolve towards higher-level design and architecture.
Automated testing and deployment: Continuous integration and continuous deployment (CI/CD) pipelines, powered by AI, will become even more prevalent, allowing for faster and more reliable software releases.
Low-code/no-code platforms: These platforms, which enable non-developers to create applications, will become more powerful and user-friendly. Developers will likely work alongside these platforms, integrating them into larger systems and building custom extensions.

The Expanding Scope of Software Development:

Software is permeating every aspect of our lives, leading to a broader range of development domains:

The Internet of Things (IoT): With the proliferation of connected devices, developers will be crucial in building secure and efficient IoT applications, from smart home systems to industrial automation.
Edge computing: As data processing moves closer to the source, developers will need to master edge computing technologies to build low-latency and responsive applications.
Quantum computing: While still in its early stages, quantum computing holds immense potential for solving complex problems. Developers who specialize in quantum algorithms and software will be highly sought after.
Virtual and Augmented Reality (VR/AR): The metaverse and immersive experiences are rapidly expanding, creating demand for developers who can build engaging and interactive VR/AR applications.
Cybersecurity: As software becomes more integrated into critical infrastructure, cybersecurity will become paramount. Developers will need to prioritize security best practices and understand how to build resilient systems.

The Importance of Soft Skills and Adaptability:

Technical skills remain essential, but soft skills are becoming increasingly crucial:

Communication and collaboration: Developers will need to effectively communicate with stakeholders, collaborate with cross-functional teams, and explain complex technical concepts to non-technical audiences.
Problem-solving and critical thinking: The ability to analyze complex problems, identify root causes, and develop innovative solutions will be highly valued.
Continuous learning and adaptability: The technology landscape is constantly evolving, so developers must be lifelong learners, willing to embrace new technologies and adapt to changing requirements.
Ethical considerations: As software becomes more powerful, developers will need to consider the ethical implications of their work, ensuring that their creations are used responsibly and for the benefit of society.

The Rise of Specialized Roles:

As the field of software development becomes more complex, specialization will become increasingly important:

AI/ML engineers: Developers with expertise in machine learning and deep learning will be in high demand.
Cloud architects: Designing and managing cloud-based infrastructure will require specialized skills.
DevOps engineers: Streamlining the development and deployment process will remain a critical role.
Security engineers: Protecting software systems from cyber threats will be a top priority.
Data scientists and engineers: The ability to process and analyze large datasets will be essential for building data-driven applications.

Conclusion:

The future for software developers is bright, albeit one that requires constant adaptation. While AI and automation may reshape the development process, they will also create new opportunities for developers to focus on higher-level tasks and innovate in emerging fields. The key to success will be a combination of strong technical skills, essential soft skills, and a willingness to embrace continuous learning. By staying ahead of the curve and adapting to the evolving landscape, software developers can continue to play a vital role in shaping the future of technology.
Verdict: There are a lot tasks to be completed by human beings.

Software's Future: Developer's Role Evolves Software drives our world, from phones to global systems. Developers are key, but tech advances bring change. The world is increasingly powered by software. From the smartphones in our pockets to the complex

ogc16 — Wed, 26 Mar 2025 18:56:54 +0000

DEV Community: ogc16

The Status Quo of AI in Software Development (2026)

Artificial Intelligence in 2026: From Companion to Infrastructure

Industry Dominance

Geopolitical Competition

Compute Explosion

The ChatGPT Moment

Competitors and Successors

Governance and Ethics

Future Outlook

Deploying IaaS Platform: A Production Playbook

Overview

Part 1: Local Development (5 Minutes)

The Fastest Possible Start

What's Inside docker-compose.yml

Part 2: Single-Host Deployment (1 Hour Setup)

Step 1: Provision the Host

Step 2: Deploy the Binary

Step 3: Create a systemd Service

Step 4: Configure Environment Variables

Step 5: Enable and Start

Step 6: Nginx Reverse Proxy

Step 7: Get an SSL Certificate

Step 8: Verify It Works

Part 3: Container Deployment (No Server Management)

Step 1: Containerize the App

Step 2: Push to Container Registry

Step 3: Deploy to Railway

Part 4: Kubernetes Deployment (Enterprise)

Prerequisites

Step 1: Create Secrets

Step 2: Deploy PostgreSQL (if not using managed RDS)

Step 3: Deploy the App

Step 4: Apply and Verify

Part 5: Infrastructure-as-Code (Terraform)

What's Included

Deploy with Terraform

Production Readiness Checklist

Security

Operations

Testing

Cost Comparison

Deployment Workflow (Complete Example)

Monitoring in Production

Next Steps

Troubleshooting

"healthz returns 503"

"502 Bad Gateway"

"Certificate verification failed"

What's Next?

Join the Community

Learn how to build a cloud control panel with authentication, billing, and resource management — complete with runnable code.

Building a Multi-Tenant IaaS Platform in Go: From Zero to Production

Why I Built This

What Does It Do?

1️⃣ Authentication & Tenancy

2️⃣ Compute Lifecycle

3️⃣ Usage-Based Billing

4️⃣ Production Features

Architecture Overview

Let's Look at the Code

1. Multi-Tenant Quota Enforcement

2. Async State Machine

3. Usage-Based Billing

4. Multi-Tenant Security

Getting Started (5 Minutes)

Prerequisites

Quick Start

Production Readiness Checklist

Security ✅

Testing ✅

Operations ✅

Deployment ✅

What's Next?

v1.0

v2.0

Key Takeaways

Try It Out

Further Reading

Let's Connect

What's Inside `docker-compose.yml`