Building OrderCraft: A Local-First Financial Charting Terminal in a Single ~14MB Go Binary

Shreyas — Mon, 02 Nov 2026 15:11:08 +0000

Modern financial charting platforms have converged on the same frustrating cloud SaaS model: lock basic technical analysis behind $15 to $60/month subscriptions, restrict free users to 2 indicators per chart, paywall multi-chart split-screen layouts, and force all your watchlists and layouts into their cloud.

On the flip side, developers who try to build hosted open-source alternatives hit two massive walls almost immediately:

IP Rate Limits: Public exchange APIs (like Binance or Yahoo Finance) ban central server IPs within hours when multiple users request market data through a shared backend.
Market Data Redistribution Licensing: Exchanges demand thousands of dollars per month the moment a central server redistributes market feeds to third-party users.

To solve both problems at the root, I built and open-sourced OrderCraft (v0.1.0, MIT License) — a high-performance, 100% local-first financial charting and technical analysis terminal built with Go, React 19, TypeScript, and Lightweight Charts (Apache-2.0).

ordercraft-hq / terminal

High-performance, local-first financial charting & technical analysis terminal built with Go, React, and Lightweight Charts.

OrderCraft

High-Performance Open-Source Financial Charting & Market Analysis Workstation

⚡ What is OrderCraft?

OrderCraft is a 100% original, permissive open-source financial charting workstation built from first principles with Go, React 19, TypeScript, and Lightweight Charts v5 (Apache-2.0).

Designed for active discretionary traders, quantitative developers, and financial analysts, OrderCraft runs as a single standalone binary with an embedded high-speed frontend (//go:embed), a local Docker container, or a PWA app. It features sub-millisecond multi-exchange WebSocket streams, multi-chart synchronized workspaces, pixel-perfect drawing primitives, vectorized indicator math, and complete local SQLite persistence.

🚀 Key Features

Capability	Highlights
Multi-Provider Data Feeds	Zero-config out-of-the-box public streams (Binance Spot & Futures, Bybit v5, Coinbase Advanced) and BYOK broker integrations (Alpaca Markets, OANDA v20).
Unified Single Binary	Go backend embeds the React SPA (`//go:embed`) and runs standalone with `--app-mode`, `--port`,

…

View on GitHub

🏗️ How It Works: The Single-Binary Local-First Architecture

Instead of running in the cloud, OrderCraft compiles into a single standalone ~14.8MB executable (CGO_ENABLED=0) that runs directly on your machine (127.0.0.1). Because your machine connects directly to public market data feeds or your own brokerage API keys, there is no middleman server, zero telemetry, and no exchange redistribution bottleneck.

1. Zero-Dependency `//go:embed` Packaging

The entire frontend (React 19, TypeScript, Vite) compiles down into static assets and is embedded directly into the Go binary using //go:embed:

No Node.js, Python, or external database installation required for end-users.
Cross-compiles cleanly to standalone binaries for Windows (amd64), macOS (arm64 / Apple Silicon & amd64), and Linux (amd64 / arm64).
Running ./ordercraft --app-mode automatically detects Chromium, Brave, or Edge and launches the terminal inside a native, frameless desktop application window.

2. Concurrent Go WebSocket Fan-In / Fan-Out Coordinator

Financial charting requires sub-second tick updates across multiple symbols and timeframes simultaneously. In internal/server/hub.go and internal/datafeed/:

The Go backend manages upstream WebSocket streams and REST polling across Binance, Yahoo Finance, OANDA v20, Alpaca, and TwelveData.
Incoming ticks are normalized, aggregated into live OHLCV bars in memory, and fanned out over a local WebSocket hub to all subscribed chart panes in the browser.

3. Pure-Go SQLite Persistence (`0600` Permissions)

All historical OHLCV candle caches, multi-pane workspace layouts, custom chart drawings, indicator templates, and BYOK (Bring Your Own Key) brokerage credentials are stored in a local SQLite database:

Historical bars are cached locally so switching timeframes or scrolling back in history is instantaneous.
API keys (OANDA, Alpaca, TwelveData) are stored strictly on your local disk with 0600 file permissions (0700 directory permissions) and are masked (AKIA••••••••1234) across all status endpoints so raw secrets are never exposed back to the browser.

4. Custom Canvas 2D Drawing Primitives (`ISeriesPrimitive`)

While lightweight-charts (Apache-2.0) provides fast HTML5 Canvas candlestick rendering, it does not ship with interactive drawing tools out of the box. We built a custom Canvas 2D drawing engine from scratch supporting:

Trendlines, Rays & Extended Lines (with OHLC magnet snapping)
Fibonacci Retracements with customizable levels
Parallel Channels & Shaded Rectangles
Long & Short Risk-Reward Position Calculators with interactive Entry, Take-Profit, and Stop-Loss drag handles
Multi-Pane Synchronized Workspaces: Split your screen into 1x1, 2V, 2H, 3, or 4-pane grids with synchronized crosshairs, symbols, and timeframes.

5. Hardening a `127.0.0.1` Server Against Cross-Tab Browser Attacks

One overlooked attack surface in local-first web apps is Localhost CSRF & Cross-Site WebSocket Hijacking. If a local server sets Access-Control-Allow-Origin: * or skips WebSocket Origin checks, any malicious website open in another browser tab can query [http://127.0.0.1:3000/api/](http://127.0.0.1:3000/api/)* and read user data.

Before releasing v0.1.0, we hardened the Go HTTP/WebSocket server to enforce:

Strict loopback Origin validation (localhost, 127.0.0.1, [::1]) on both REST preflight/mutation handlers and the WebSocket upgrader.
Upstream URL path and query escaping (url.PathEscape / url.QueryEscape) across all provider adapters to prevent SSRF/path traversal.
http.MaxBytesReader payload caps and Slowloris connection timeouts (ReadHeaderTimeout, ReadTimeout, WriteTimeout).

⚡ Try It Out in 10 Seconds

You can grab the prebuilt v0.1.0 binary for Windows, macOS, or Linux directly from our GitHub Releases page, or build from source:

git clone https://github.com/ordercraft-hq/terminal.git
cd terminal
# Run in native frameless desktop window mode:
./ordercraft --app-mode

Out of the box, it streams live crypto (BINANCE:BTCUSDT, ETHUSDT, etc.) and equity data (AAPL, NVDA, SPY) with zero configuration or API keys required.

I'd love for you to check out the repository, give it a ⭐ on GitHub if you find local-first tools useful, and let me know in the comments (or in GitHub Discussions) what indicators or market data providers (IBKR, Polygon, local CSV/Parquet backtest replay) you'd like to see in v0.2.0!

👉 GitHub Repository: https://github.com/ordercraft-hq/terminal

DEV Community: Shreyas