boxlang

Serving Sites from Your Dev Server

Side projects shouldn’t cost more than they have users. Here’s how I moved mine off a $75/mo hosting bill and onto Docker on my dev server: a Cloudflare Tunnel with no open ports, a trusted CF-Connecting-IP header, JVM memory sized from container limits, a deploy script that tests itself before it touches production, and encrypted off-site backups to R2. It’s not high availability. It’s a home server. But the bill is zero.

Passwordless sign-in for BoxLang with bx-passkeys

Passkeys replace passwords with a key pair kept on the user's device, so there's nothing reusable to phish or leak. This step-by-step guide adds them to a BoxLang app with bx-passkeys. You install the module, create the table and configure the relying party, then wire up four calls: registrationOptions(), register(), signInOptions() and verify(). It also covers the browser helper, listing and removing passkeys, testing with a fake authenticator, and a production checklist.

Everything Runs on My Dev Box Now, and That’s Fine

November means burning leftover time off on side projects. Feedhouse outgrew a $75/mo hosting bill it was never going to earn back, so everything now runs in Docker on my dev machine behind Cloudflare Tunnels. It’s faster, too, now that the database isn’t starving. And DismalThreads is back with a facelift after a launch nobody came to and more rewrites than I’d like to admit: Facebook for developers, minus the memes and the LinkedIn-ness.

The JVM Was Calling System.gc() Behind My Back

Feedhouse, a small BoxLang RSS reader, was running up to 70 full GCs an hour with its heap a quarter full. The likely cause: when direct (off-heap) buffer memory reaches -XX:MaxDirectMemorySize, the JDK calls System.gc() itself, and I had capped it at 64 MB. Raising the cap to 128 MB cut full GCs to 2-5 an hour, past the point where the spike used to begin. How I tracked it down with hourly JVM metrics and an admin GraphQL API, driven by Claude Code.

Everything Feedhouse Does, From the Boring Parts Up

A tour of everything Feedhouse does, from the boring parts up: adding feeds, folders and keyboard shortcuts, then search, read-later, highlights and stories shown once, then filters for what you never want to see, feed health, a reading-stats table of shame, sharing, bundles and the phone app. Then the good stuff: newsletters with an address of their own and no tracking pixels, and a podcast player that keeps going while you read. No algorithm required.

Google Reader Would Have Been 21 Today

My blog joined the fediverse

This blog is now on the fediverse as @blog@kisdigital.com. Follow it from Mastodon and new posts, edits and deletions reach your timeline within minutes; replies come back here as comments, and likes and boosts are counted. It's all powered by bx-activitypub, a new BoxLang module on ForgeBox and GitHub: your app answers four questions about its data and the module handles WebFinger, HTTP Signatures and delivery. Here's how it works, what I learned, and what's next.

What's in BoxExpress Today

BoxExpress is an Express.js-style web framework for BoxLang, running on Undertow with a virtual thread per request — no servlet container needed. It covers routing, middleware, sessions, views, file serving, WebSockets, a full STOMP broker, and a scheduler. New: cross-process cluster support, with leader-elected scheduled jobs and STOMP pub/sub relayed across instances, backed by a durable shared cache. Real example apps: bxThreads (forum) and bx-graphql-demo.

bxThreads: a bx-express port of DismalThreads

Ported my forum app (DismalThreads) from ColdBox/CBWIRE to BoxLang/boxlang-express as bxThreads — swapping CBWIRE's component reactivity for hand-rolled fetch()/websockets. Porting a real app with existing opinions (auth, rate limiting, realtime fan-out) is a better BoxLang stress test than starting fresh, since a blank project lets you dodge every hard problem by never hitting it.

Adding SSE and WebSockets to BoxExpress (and Everything That Broke Along the Way)

BoxExpress adds server-sent events and full WebSocket support for pushing live updates to clients — dashboards, progress bars, chat, notifications. Built from scratch, since BoxExpress skips BoxLang's built-in web layer. Along the way: a concurrency bug in broadcast connections, a header-injection-style hole in SSE metadata, a BoxLang update that broke page rendering, and a STOMP bug letting one client hijack another's subscription. All caught by trying to break it.

BoxLang and GraphQL

bx-graphql brings GraphQL to native BoxLang via graphql-java, wrapping it in a schema-agnostic module with convention-based resolvers and zero framework lock-in. To prove it out beyond source code, Robert built a fully offline demo pairing it with boxlang-express — a JSONPlaceholder-style schema, thin resolvers that mostly fall through to `PropertyDataFetcher`, and a no-build-step query console. Both modules are live on ForgeBox: `box install` and go.

BoxLang Express Development Update 8/26

BoxExpress 0.1.15→0.2.1: five patch releases fixed empty-value crashes (query/cookie/multipart), hardened proxy-IP trust for real platforms, fixed session data loss against non-memory stores, added response outcome accessors and opt-out session writes, and closed a trailing-slash bug hitting nearly every request. Then 0.2.0 replaced the JDK's HttpServer with Undertow entirely (breaking), verified at full parity and load-tested. 0.2.1 added live HTTP-layer metrics via getConnectorStatistics().