Crystal + Kemal: Real-time App with Server-Side Privacy

Building a real-time Moving Motivators app in Crystal taught me how powerful the language is when you prioritize server-side invariants for confidentiality. By using Kemal, I managed to keep the entire deployment footprint incredibly lean—the final hardened scratch image clocked in at just 14 MB.

The core of this project is a pure-domain design. Instead of relying on client-side logic to handle privacy, the server acts as the single source of truth, ensuring that data confidentiality is an immutable invariant. This prevents the common "leaky API" problem where sensitive fields are accidentally sent to the frontend and filtered out via JavaScript.

For those looking to try a similar setup, here is the basic structure for a Kemal server handling real-time updates:

require "kemal"

Kemal.start do
  on "get", "/" do
    Kemal.response("Real-time Motivators Active")
  end

  on "post", "/update" do
    # Domain logic ensures privacy invariants are checked here
    # before broadcasting to other clients
    Kemal.response(status: 200)
  end
end

The performance gains are noticeable. Crystal's compiled nature means the real-time overhead is negligible, and the memory usage is a fraction of what you'd see with a Node.js or Python backend.

The most satisfying part was the deployment. Using a multi-stage Docker build to move the compiled binary into a scratch image eliminates almost all attack vectors and keeps the image size tiny. This is a great real-world example of how a type-safe, compiled language can simplify the AI workflow for developers who need high performance without the bloat of traditional frameworks.