# Building OrderCraft: A Local-First Financial Charting Terminal in a Single ~14MB Go Binary Modern financial charting platforms have converged on the same frustrating cloud SaaS model: lock basic technical analysis behind $15 to $60/month subscriptions, restrict free users to 2 indicators per chart, paywall multi-chart split-screen layouts, and force all your watchlists and layouts into their cloud. On the flip side, developers who try to build hosted open-source alternatives hit two massive walls almost immediately: 1. **IP Rate Limits:** Public exchange APIs (like Binance or Yahoo Finance) ban central server IPs within hours when multiple users request market data through a shared backend. 2. **Market Data Redistribution Licensing:** Exchanges demand thousands of dollars per month the moment a central server redistributes market feeds to third-party users. To solve both problems at the root, I built and open-sourced **OrderCraft** (`v0.1.0`, MIT License) — a high-performance, **100% local-first** financial charting and technical analysis terminal built with **Go**, **React 19**, **TypeScript**, and **Lightweight Charts** (Apache-2.0). --- ## 🏗️ How It Works: The Single-Binary Local-First Architecture Instead of running in the cloud, OrderCraft compiles into a single standalone ~14.8MB executable (`CGO_ENABLED=0`) that runs directly on your machine (`127.0.0.1`). Because *your* machine connects directly to public market data feeds or your own brokerage API keys, there is no middleman server, zero telemetry, and no exchange redistribution bottleneck. ### 1\. Zero-Dependency `//go:embed` Packaging The entire frontend (React 19, TypeScript, Vite) compiles down into static assets and is embedded directly into the Go binary using `//go:embed`: - No Node.js, Python, or external database installation required for end-users. - Cross-compiles cleanly to standalone binaries for **Windows (**`amd64`**)**, **macOS (**`arm64` **/ Apple Silicon &** `amd64`**)**, and **Linux (**`amd64` **/** `arm64`**)**. - Running `./ordercraft --app-mode` automatically detects Chromium, Brave, or Edge and launches the terminal inside a native, frameless desktop application window. ### 2\. Concurrent Go WebSocket Fan-In / Fan-Out Coordinator Financial charting requires sub-second tick updates across multiple symbols and timeframes simultaneously. In `internal/server/hub.go` and `internal/datafeed/`: - The Go backend manages upstream WebSocket streams and REST polling across **Binance**, **Yahoo Finance**, **OANDA v20**, **Alpaca**, and **TwelveData**. - Incoming ticks are normalized, aggregated into live OHLCV bars in memory, and fanned out over a local WebSocket hub to all subscribed chart panes in the browser. ### 3\. Pure-Go SQLite Persistence (`0600` Permissions) All historical OHLCV candle caches, multi-pane workspace layouts, custom chart drawings, indicator templates, and BYOK (Bring Your Own Key) brokerage credentials are stored in a local SQLite database: - Historical bars are cached locally so switching timeframes or scrolling back in history is instantaneous. - API keys (OANDA, Alpaca, TwelveData) are stored strictly on your local disk with `0600` file permissions (`0700` directory permissions) and are masked (`AKIA••••••••1234`) across all status endpoints so raw secrets are never exposed back to the browser. ### 4\. Custom Canvas 2D Drawing Primitives (`ISeriesPrimitive`) While `lightweight-charts` (Apache-2.0) provides fast HTML5 Canvas candlestick rendering, it does not ship with interactive drawing tools out of the box. We built a custom Canvas 2D drawing engine from scratch supporting: - **Trendlines, Rays & Extended Lines** (with OHLC magnet snapping) - **Fibonacci Retracements** with customizable levels - **Parallel Channels & Shaded Rectangles** - **Long & Short Risk-Reward Position Calculators** with interactive Entry, Take-Profit, and Stop-Loss drag handles - **Multi-Pane Synchronized Workspaces:** Split your screen into `1x1`, `2V`, `2H`, `3`, or `4`\-pane grids with synchronized crosshairs, symbols, and timeframes. ### 5\. Hardening a `127.0.0.1` Server Against Cross-Tab Browser Attacks One overlooked attack surface in local-first web apps is **Localhost CSRF & Cross-Site WebSocket Hijacking**. If a local server sets `Access-Control-Allow-Origin: *` or skips WebSocket `Origin` checks, any malicious website open in another browser tab can query `[http://127.0.0.1:3000/api/](http://127.0.0.1:3000/api/)*` and read user data. Before releasing `v0.1.0`, we hardened the Go HTTP/WebSocket server to enforce: - Strict loopback `Origin` validation (`localhost`, `127.0.0.1`, `[::1]`) on both REST preflight/mutation handlers and the WebSocket upgrader. - Upstream URL path and query escaping (`url.PathEscape` / `url.QueryEscape`) across all provider adapters to prevent SSRF/path traversal. - `http.MaxBytesReader` payload caps and Slowloris connection timeouts (`ReadHeaderTimeout`, `ReadTimeout`, `WriteTimeout`). --- ## ⚡ Try It Out in 10 Seconds You can grab the prebuilt `v0.1.0` binary for Windows, macOS, or Linux directly from our [**GitHub Releases**](https://github.com/ordercraft-hq/terminal/releases/latest) page, or build from source: ```bash git clone https://github.com/ordercraft-hq/terminal.git cd terminal # Run in native frameless desktop window mode: ./ordercraft --app-mode ``` Out of the box, it streams live crypto (`BINANCE:BTCUSDT`, `ETHUSDT`, etc.) and equity data (`AAPL`, `NVDA`, `SPY`) with zero configuration or API keys required. I'd love for you to check out the repository, give it a ⭐ on GitHub if you find local-first tools useful, and let me know in the comments (or in [GitHub Discussions](https://github.com/ordercraft-hq/terminal/discussions)) what indicators or market data providers (IBKR, Polygon, local CSV/Parquet backtest replay) you'd like to see in `v0.2.0`! 👉 **GitHub Repository:**