Is there a secure way to use Redis with Vercel?

I spent a couple of hours yesterday trying to find a way to use Redis with Sanity, which currently runs on Vercel. According to Redis docs on security, it is not a good idea to expose a Redis instance directly to the internet:

Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance directly to the internet or, in general, to an environment where untrusted clients can directly access the Redis TCP port or UNIX socket.

I wanted to use Digital Ocean's trusted sources to restrict the incoming connections to those coming from my Vercel server but looks like that won't be possible because of Vercel's use of dynamic IP addresses. According to Vercel docs:

To ensure your Vercel deployment is able to access the external resource, you should allow connections from all IP addresses. Typically this can be achieved by entering an IP address of (0.0.0.0).

While allowing connections from all IP addresses may be a concern, relying on IP allowlisting for security is generally ineffective and can lead to poor security practices.

To properly secure your database, we recommend using a randomly generated password, stored as an environment variable, at least 32 characters in length, and to rotate this password on a regular basis.

I could rely on password authentication but that is, according to Redis docs, meant as another layer of redundancy rather than the main security measure. That seems to make Vercel incompatible with Redis 🤔

PS. Writing this has made me realize that I really need to add a "comment" feature to Sanity. I'll see what I can do next week - I'm on the fence between either adding comments or tagging posts.

1 comment

Other posts you might like

How I built a chat app using Streams API, Next.JS, Redis and Vercel

Last week I added a chat feature to Sanity. In this article, I'll guide through how I built it using Streams API, Next.js, Redis and Vercel.

Sanity chat

Before we start, a quick disclaimer: there are much better ways to build a chat application, for example by using WebSockets. Vercel unfortunately doesn't support WebSockets and I didn't want to spin a dedicated server, which is why I used Streams API. Using Streams API the way I use it here is most likely not the best use of resources but it works and is a good enough solution for my small scale use. If you're on the same boat, keep reading.

If the chat takes off, I'll have to move it to a dedicated Socket.io server, a serverless WebSocket on AWS, or something similar to reduce costs.

Storing messages in Redis

I use the KV (Redis) database from Vercel to store the last 100 messages. Here is the code used to send and read messages.

import { MAX_CHAT_MESSAGE_LENGTH } from "@/utils";

const MAX_MESSAGES = 100;

export const addChatMessage = async ({
continue reading
programmingvercelstreams apibackendnext.jsreactredisjavascript
reply

How I struggled to fix votes on Sanity

Ever since I implemented upvotes a few months ago, I had been struggling with user upvotes/downvotes request occasionly timing out. The bug persisted for a few months and the few times I tried to debug it, I had no success. Is it the database schema? Nope, I use similar schemas for other collections and they work fine. An inefficient MongoDB query? Same thing. No indexing? I indexed the DB even though there are barely any votes in the collection. An issue with Vercel cold start? Also not it, everything within the norm.

Last Friday the rest of the app was finally ready and I wanted to start inviting some users, so I gave up and decided to pay $20/month for Vercel Pro to increase the timeout from 10 to 60 seconds and worry about the bug another day. And then I checked the logs on Vercel Pro...

Unhandled error: MongooseError: Operation `userVotes.findOne()` buffering timed out after 10000ms
    at Timeout.<anonymous> (/var/task/sanity_client/node_modules/mongoose/lib/drivers/node-mongodb-native/collection.js:175:23)
    at listOnTimeout (node:internal/timers:569:17)
    at process.processTimers (node:internal/timers:512:7)

Because Mongoose timeout is 10000ms and Vercel's timeout is also 10000ms but this includes the cold start time, this error never popped up on my free plan....

continue reading
sanityprogrammingvercelmongodbbuilding in public
reply

Feature announcement 🥳 -> Comments

You can now comment on other posts on Sanity. And you can comment on other people's comments. It's not perfect yet and I'll be making UX improvements here and there over the coming weeks but the essentials are there.

You can leave up to 5 comments a day, so make them count!

sanityfeature announcementcommentsbuilding in publicindie makers
1 comment

A user acquisition conundrum

One of the fastest ways I can attract the first users to Sanity and start getting feedback is by posting about it and engaging on Facebook and Twitter. The thing is, I find them too addictive and full of dark patterns, which is why started Sanity in the first place. I always tell myself I’ll only use them for a specific purpose, or for 15 minutes a day, or only occasionally, and then I gradually get sucked into using them all the time. I start out by visiting once every few days, I check for new posts from a few people I follow, read some AI news, visit groups etc. With time, I find myself using them more and more until several weeks later, I check them throughout the day. This is more of a problem for me with Twitter but, to a lesser extent, also applies to Facebook.

So the question is - how to I get the word out about Sanity without using the addictive social media networks it’s meant to be the alternative to?

I'm focusing on writing content and optimizing SEO for now but it's a slow process. Any tips?

indie makersbuilding in publicseosocial mediasocial media addiction
reply

What should we build next?

We've just finished comments and added some UI/UX improvements to the site, making posts easier to read and the website, I hope, prettier and more aesthetically pleasing. What should we focus on next?

I think notifications would be useful, so that you can see when someone comments or upvotes your posts. This would be limited to a single notification sent once a day that contains a summary of everything relevant that happened.

Anything else that you think Sanity is missing or could do better? Let me know in the comments 💬

sanityfeedbackbuilding in publicuser experiencenotifications
reply

How I implemented slugs on Sanity - a TypeScript code sample

The lack of human-readable slugs on Sanity had bothered me for a while and I finally got around to fixing them last Sunday. The old, slugless URL structure probably wasn't doing me any favors in terms of SEO and user experience. I'm hoping the new format can give Sanity a much needed SEO boost. Plus, I can finally tell which post is which in Google Search Console and Vercel Analytics.

The Result

Before

https://www.sanity.media/p/64c375049f5d6b05859f10c6

After

https://www.sanity.media/p/64c375049f5d6b05859f10c6-delicious-post-workout-milkshake-recipe

Isn't this much clearer?

The Code

When writing the code I had the following goals in mind:

continue reading
programmingjavascriptmongoosebuilding in publicmongodb
1 comment

How to implement AI vector search and related posts with pgvector

At the end of this tutorial, you should be able to set up your own vector search with text embeddings in a Next.js app. This is a tutorial that mostly consists of coding samples taken directly from the Sanity codebase.

You can see the results right here on Sanity. The related posts section underneath each post is generated with pgvector. So is the search.

The stack I used:

  • Open AI's text-embedding-ada-002 model
  • Next.js
  • Prisma
  • PostgreSQL

Start by setting up the Prisma client:

This step is needed to get Prisma to cooperate with Next.js.

// Setting up prisma
continue reading
programmingpgvectoraibuilding in publicsql
reply

Why I started Sanity Media

If you have watched The Social Dilemma, read Stolen Focus or Hooked you probably already know that present-day social media is designed to be addictive. The more time you spend online, the more money social media companies make.

You may also be aware of how social media algorithms can inadvertently create echo chambers, where people are only exposed to views they already agree with. This leads to increased polarization and political extremism.

I’m trying to build a service that's more down to earth. A place where you can log in, read some news or stories that interest you, and then forget about it until the next day. No infinite scrolls, no constant streams of notifications, and no incentive to keep checking the site throughout the day. While it might be a hard task to remove echo chambers altogether, I hope can at least limit them.

How Sanity works

Here are the main features in a nutshell:

  • All posts created on a given day are published simultaneously at midnight UTC time.
  • You can only make a single post a day - make it count.
  • No infinite scrolling - the number of posts you’ll see is limited.
  • You can upvote and downvote posts - but there’s a combined limit of ten a day.
  • The algorithms are simple. For example, everyone s...
continue reading
reply

Quick feature announcement

I updated the layout a bit to make it easier to find replies to your posts and comments. This is not backward-compatible yet, so you are only going to see the posts and replies created from now on. I'll run a database migration some time in the next few days so that older replies also appear there.

sanityfeature announcementbuilding in publicux
reply
feedback