Rails 8 Introduces Kamal 2 For Zero Downtime Deployments

Rails 8 ships with Kamal 2 pre-configured,
so each new app can deploy to any Linux server with zero downtime
and computerized SSL — no PaaS required.

Many groups pay for costly Platform-as-a-Service options
simply to keep away from managing deployments themselves.
Rails 8 removes that trade-off.

What’s Kamal?

Kamal is a deployment software developed by
37signals
that makes use of Docker containers to deploy net functions.
It could actually flip a contemporary Linux field right into a manufacturing prepared utility server
with only a single command.

Earlier than

Earlier than Rails 8, establishing Kamal required guide set up
and configuration.

We needed to set up the gem:

gem set up kamal

Or add it to the Gemfile:

# Gemfile
gem 'kamal', require: false

Then initialize Kamal:

kamal init

This created configuration recordsdata that wanted guide setup
earlier than we might deploy.

After

Rails 8 now
consists of Kamal 2 by default.

Once we create a brand new Rails 8 utility:

rails new my_app

Kamal is routinely configured with:

• kamal gem within the Gemfile
• config/deploy.yml with default configuration
• .kamal/secrets and techniques for managing delicate knowledge
• A manufacturing Dockerfile able to construct and ship

Right here’s the config/deploy.yml Rails 8 generates:

# config/deploy.yml
service: my_app
picture: username/my_app

servers:
  net:
    - 192.168.0.1

proxy:
  ssl: true
  host: app.instance.com

registry:
  username: username
  password:
    - KAMAL_REGISTRY_PASSWORD

env:
  secret:
    - RAILS_MASTER_KEY
  clear:
    SOLID_QUEUE_IN_PUMA: true

aliases:
  console: app exec --interactive --reuse "bin/rails console"
  shell: app exec --interactive --reuse "bash"
  logs: app logs -f
  dbc: app exec --interactive --reuse "bin/rails dbconsole"

volumes:
  - "my_app_storage:/rails/storage"

asset_path: /rails/public/property

builder:
  arch: amd64

Swap in a server IP, a registry username, and a website,
and the app is deployable.

Key Options of Kamal 2

Kamal Proxy Replaces Traefik

Probably the most important change in Kamal 2 is the alternative of Traefik
with a brand new purpose-built proxy referred to as
Kamal Proxy.

Kamal Proxy offers:

• Zero downtime deployments
• Automated SSL certificates by way of Let’s Encrypt
• Assist for a number of functions on a single server
• Easier configuration in comparison with Traefik

Improved Secrets and techniques Administration

Kamal 2 introduces a brand new strategy to dealing with secrets and techniques.
As a substitute of utilizing .env recordsdata,
it now helps in-built integration with password managers:

Secrets and techniques are saved in .kamal/secrets and techniques:

# .kamal/secrets and techniques
KAMAL_REGISTRY_PASSWORD=$(op learn "op://Vault/Docker Hub/password")
RAILS_MASTER_KEY=$(cat config/grasp.key)

Command Aliases

The aliases part of deploy.yml maps quick instructions
to longer Kamal invocations.
Rails 8 generates essentially the most helpful ones out of the field:

# Begin a distant Rails console
kamal console

# Tail utility logs
kamal logs

# Open a shell contained in the operating container
kamal shell

# Begin a distant database console
kamal dbc

No SSH-ing into servers and looking for container IDs.

Deploying with Kamal 2

As soon as configured, deployment is easy.

First, arrange the servers:

kamal setup

This command:

• Installs Docker on the goal servers
• Units up Kamal Proxy
• Configures the container community
• Deploys the applying

For subsequent deployments:

kamal deploy

Zero Downtime Deployments

Kamal Proxy handles zero downtime deployments routinely.

Throughout deployment:

1. A brand new container is began with the up to date utility
2. Kamal Proxy polls the brand new container’s well being examine endpoint (/up, which Rails offers by default)
3. As soon as wholesome, site visitors is seamlessly switched to the brand new container
4. In-flight requests to the outdated container are drained, then it’s stopped

This ensures customers by no means expertise downtime throughout deployments.

Rolling Again

Dangerous deploys occur. Kamal retains the outdated containers round,
so rolling again is fast.

Record the variations out there on the server:

kamal app containers

Then roll again to a earlier model:

kamal rollback 04b0f8c81cf05a20dd1ea9ce7f10da316b461fe4

For the reason that outdated container is already on the server,
the rollback is only a site visitors swap — no picture construct, no push.
kamal audit exhibits who deployed what and when.

What to Watch For

A couple of sensible notes earlier than going all in:

• kamal rollback switches containers, it doesn’t reverse
  database migrations. Preserve migrations backward suitable
  so the earlier model can nonetheless run towards the brand new schema.
• Automated SSL wants the area’s DNS pointing on the server
  and port 443 reachable earlier than the primary deploy,
  in any other case Let’s Encrypt certificates issuance fails.
• Upgrading an current Kamal 1 app? Replace the gem and run
  kamal improve emigrate servers to Kamal Proxy —
  it may be executed one server at a time with --rolling.

SSL for Multi-Tenant Purposes

Multi-tenant SaaS functions usually have to deal with
SSL certificates for a number of domains or subdomains.
Kamal 2 offers a number of approaches for this.

Single Area with Automated SSL

For functions serving a single area,
Kamal Proxy handles SSL routinely by way of Let’s Encrypt:

# config/deploy.yml
proxy:
  host: myapp.com
  ssl: true

Kamal Proxy will provision and renew certificates routinely.

A number of Purposes on One Server

Kamal 2 helps operating a number of functions on a single server.
Every utility can have its personal area with computerized SSL.

For the principle utility:

# config/deploy.yml (predominant app)
service: main_app
proxy:
  host: app.instance.com
  ssl: true

For the API service:

# config/deploy.yml (api)
service: api_service
proxy:
  host: api.instance.com
  ssl: true

The primary deployment installs Kamal Proxy.
Subsequent deployments register with the present proxy.

We are able to confirm operating functions on the server:

kamal-proxy checklist

A number of Hosts for One Software

An utility can reply to a number of domains:

# config/deploy.yml
proxy:
  hosts:
    - instance.com
    - www.instance.com
  ssl: true

Customized SSL Certificates

When Let’s Encrypt will not be appropriate,
we will present customized certificates:

# config/deploy.yml
proxy:
  host: myapp.com
  ssl:
    certificate_pem: SSL_CERT_PEM
    private_key_pem: SSL_KEY_PEM

The certificates values are learn from secrets and techniques.

Wildcard Domains for True Multi-Tenancy

For functions with buyer subdomains like customer1.myapp.com,
Kamal Proxy doesn’t but assist wildcard certificates natively.

The really useful strategy is to make use of
Caddy
as a reverse proxy in entrance of Kamal Proxy:

# Caddyfile
*.myapp.com {
  tls {
    on_demand
  }
  reverse_proxy localhost:8080
}

Caddy may be deployed as a Kamal accent:

# config/deploy.yml
equipment:
  caddy:
    picture: caddy:newest
    host: 192.168.0.1
    port: "443:443"
    recordsdata:
      - config/Caddyfile:/and many others/caddy/Caddyfile

When utilizing Caddy, disable SSL in Kamal Proxy:

proxy:
  host: myapp.com
  ssl: false

This setup permits Caddy to deal with wildcard certificates
whereas Kamal Proxy manages the applying containers.

The Full No-PaaS Stack

Kamal 2 is one piece of the Rails 8 story.
Mixed with the Stable adapters,
a single server can now run your entire stack
that beforehand wanted Redis, a job runner, and a managed platform:

One server, one database, one kamal deploy.

Skipping Kamal

If we desire to not use Kamal,
we will skip it when creating a brand new utility:

rails new my_app --skip-kamal

Conclusion

Kamal 2 in Rails 8 makes deployment accessible to everybody.
We not want costly PaaS options
or advanced infrastructure setups.

With only a few instructions,
we will deploy our Rails functions to any server
with zero downtime and computerized SSL.

References