AWS Compliance scan with cloudquery

I've added compliance queries for AWS - [https://github.com/cloudquery/cloudquery#aws-compliance-pack](https://github.com/cloudquery/cloudquery#aws-compliance-pack) . I'd love to get feedback

https://redd.it/kaec29
@r_devops

What's the best setup for an on-prem server running a handful of containers?

I am moving some of our internal tools out of the cloud and into a rack in my office. Today I am setting up a new server to run a handful of webapps, most likely in containers.

The plan is to setup oauth2-proxy and then a handful of low-traffic, internal use only, mostly open source apps.

I would like to be able to update the apps independently, and to be able to tell at a glance what all is running and if they are good. We are a small team and these tools are nice to have a more than mission critical. So I don't need a bunch of residency as long as I can recreate the setup relatively easily.

These containers will be the only thing running on this server. The database is on another server and will be accessed via an isolated network (public Nic for proxy, internal Nic db/admin).

I don't have much experience with kubernetes, and that seems to be overkill. My current thinking is that docker-compose could be a good fit, especially since I could ensure the proxy and apps are configured in the same place.

But I don't know what I don't know.

Is there a distro that really excels at something like this? Or maybe some kind of admin panel (cockpit?) that makes managing a single container server a breeze?

https://redd.it/kaeosn
@r_devops

Noob Question - Can(or should) I Orchestrate Containers with Different Configurations?

So I've started a business, and we need a way to quickly deploy very similar applications. In essence they're simple web applications that hook into some niche data, and can quickly provide websites. Each container will contain one instance of the application(of course more can be added depending on the client's needs), but each instance of the application is tailored a bit to the customer. The number of containers will get pretty high so I feel that container orchestration is definitely necessary to easily keep the application up to date. In my mind, Kubernetes will work just fine in this situation I'm just not too sure.

https://redd.it/kahnt8
@r_devops

Spinnaker vs Helm Discussion

Hey guys,

I am a young developer who has used spinnaker but has just jumped into helm deployments to kubernetes at my first job.

I was wondering which tool (spinnaker or helm) you guys thought is better and why? Why would I use one and not the other?

Additionally, I was wondering which continuous deployment tool is easier to setup / use. Thanks.

https://redd.it/kaj0lh
@r_devops

XSS Question

Hi

In my application I have a formula where I have an input for username and the user can type his username in the formual as <script > alert ('1') </script> but it's saved in the database a string with a double quote like this "<script > alert ('1') </script> ", does that make my web app vulnerable to XSS ?

https://redd.it/kajqrj
@r_devops

AWS or Azure

So I want to host my small web app and I am wondering whether to learn AWS or Azure. From what I understand, AWS is superior to Azure in every way. However, there is no way to set hard limits on spending using AWS whereas Azure doesn't even require a credit card.
So I'm mostly going to go with Azure due to this reason. However, I wanted to know how transferrable is the knowledge? If I wanted to use AWS later, would I find it easier due to my previous experience with Azure?

https://redd.it/kagnmf
@r_devops

Jenkins pipeline with the Jira plugin, how to create a ticket?

We're currently using the [Jira](https://plugins.jenkins.io/jira/) plugin for Jenkins and I'm trying to work out how to use it to create a ticket in Jira via pipeline.

Looking at the documentation, it makes an offhand comment on permisions needed for a service account, but doesn't explain how to do it, let alone how to do it in pipeline. The only documentation I can find for pipeline is in [here](https://github.com/jenkinsci/jira-plugin/blob/master/COMPATIBILITY.md).

Am I being blind \\ daft?

Use case: In a certain repo, all branches need a jira ticket number otherwise it'll get rejected. So the job creates a ticket, creates a branch in Bitbucket using the ticket number and then does some changes to an XML doc etc etc etc.

https://redd.it/kad267
@r_devops

Apache Kafka Lag Monitoring at AppsFlyer

This article covers one crucial piece of every distributed system: visibility. At AppsFlyer, we call ourselves metrics obsessed and truly believe that you cannot know what you cannot see.

With 150+ billion events per day, Kafka monitoring and metrics are crucial. Here's how AppsFlyer built a Kafka lag monitoring solution with time-based metrics, smart alerts, and decoupling.

[https://www.confluent.io/blog/kafka-lag-monitoring-and-metrics-at-appsflyer/](https://www.confluent.io/blog/kafka-lag-monitoring-and-metrics-at-appsflyer/)

https://redd.it/kankfo
@r_devops

What metrics do you visualize monthly for your DevOps adoption?

Currently been reporting on
Delivery Lead Time
Delivery Prep Time
Delivery Wait Time
Deployment Frequency
I use Tableau to show alot of this. Looking for some creative ways people have uses metrics when reporting to management

https://redd.it/kao88r
@r_devops

Taming ElasticSearch Field Explosion

It's very easy to get carried away with field mappings if they're dynamic. Here's a post about how that caused an incident for us:


[https://medium.com/handy-tech/elasticsearch-field-explosion-ca0a21f97a4a](https://medium.com/handy-tech/elasticsearch-field-explosion-ca0a21f97a4a)

https://redd.it/kape3y
@r_devops

Infrastructure as Code with terraform for multiple environments

Hola Mundo, I wrote a blog post about - Infrastructure as Code with terraform for multiple environments

https://dev.to/prodopsio/infrastructure-as-code-with-terraform-for-multiple-environments-5c1p

Let me know if you have any questions!

https://redd.it/kackan
@r_devops

What topic should I cover in my upcoming streams/video on Youtube?

I used to organize a lot of meetups in Bangalore and post COVID I started youtube streaming with other community members to be and learn together with the community.

What do you want to hear next?

[View Poll](https://www.reddit.com/poll/ka9nhv)

https://redd.it/ka9nhv
@r_devops

"SEO" for Google Play & App Store & organic growth, please share your experience 🙏

Me & My Best Friend are going to launch our first app ever for Android & iOS.

We will have small, but very smart marketing campaign.

Can you please share me your experience about "SEO" & algorithm of Google Play & App Store. How does it work, what kind of organic growth can be expected just from people visiting Store and searching for new apps?

Can you please share your experience & tips?

I know there is no unique answer, but anything will be helpful!

Thanks! :)

https://redd.it/ka7qa8
@r_devops

Roles and responsibilities to transition to AWS

My company, probably like many others, is transitioning to AWS. On the on-prem side we have a virtualization team that works with VMware to provide VMs for teams and products. On the AWS front we are a devops team, provision and install software (mostly with packer when it's in EC2).

The thing is that leadership is thinking that the virtualization team can provision EC2 instances like they do for VMs. I can stop thinking that this is a terrible idea that almost goes against these ephemeral and dynamic environments. IMO a better approach is that you own whatever you deploy, meaning software, AWS resources, monitoring and anything in between.

I want to keep an open mind, though, and I'd like to know how others are transitioning to AWS in terms of roles and responsibilities.

In case it helps to give some context, this is a tech company with 2k people and 700+ devs.

https://redd.it/katseh
@r_devops

HELP ... Failling to Deploy a simple HELLO WORLD Node application to DOKKU

Hi There ...

I have been searched and read a lot but still can not figure out what I am doing wrong to deploy as Simple Node.js Hello World application to DOKKU ( on Digital Ocean )

`Attempting pre-flight checks (web.1)`

`Waiting for 10 seconds ...`

`79fbc174a28cbc876bb15224f0aa21bd1a5e4517f9fb73a2cb8ef38de5f55d7e`

`remote: ! App container failed to start!!`

`=====> blingfront web container output:`

`internal/modules/cjs/loader.js:818`

`throw err;`

It seems failing during start application .. as I got the build success application

My sequence at dokku server was :

dokku apps:create blingfront

dokku postgres:create blingfrontdb

dokku postgres:link blingfrontdb blingfront

dokku buildpacks:add blingfront [https://github.com/heroku/heroku-buildpack-nodejs.git](https://github.com/heroku/heroku-buildpack-nodejs.git)

On mY host ... I did

git remote add dokku dokku@<ip addres>:blingfront

git push dokku

after several messages I can see

`Build succeeded!`

`Using release configuration from last framework (Node.js).`

`-----> Discovering process types`

`Procfile declares types -> web`

But finish with the message from the beggining ...

What am I doing WRONG ?

Any comment appreciated

https://redd.it/ka36v9
@r_devops

Is there an advantage (in terms of server cost) of making a desktop app vs a browser app?

Why did Zoom choose to make their video platform desktop based while HopIn is web based? Is one format cheaper than the other?

https://redd.it/kavqam
@r_devops

Nginx throwing 307 error, can't figure out why

I need some help getting to the bottom of a 307 error that my server is throwing when I try to hit my .net core 3.1 app.

This is running on a Ubuntu 20.04 vps

Here is my config file:

server {

server_name mydomain.com www.mydomain.com;

location / {
proxy_pass https://localhost:5000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection keep-alive;
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}

listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/mydomain.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
if ($host = www.mydomain.com) {
return 301 https://$host$request_uri;
} # managed by Certbot


if ($host = mydomain.com) {
return 301 https://$host$request_uri;
} # managed by Certbot


listen 80;
listen [::]:80;

server_name mydomain.com www.mydomain.com;
return 404; # managed by Certbot
}

This is pretty much my exact config file for a separate vps running a .net5 app, (the only difference is I haven't explicitly pointed to my static file folder in this one).

My requests are hitting the app, but I just get a 307, and then my browser will time out. In my error log I just have "signal process started".

I don't know how to troubleshoot this stuff so any help would be awesome!

https://redd.it/ka0p6p
@r_devops

How to best deploy and maintain individual VMs per customer?

I’ve been trying to look for an answer to this but haven’t found anything that hits it on the head. I have a SaaS solution being developed that requires one or more VMs to be stood up per customer. I am hosting everything on Azure and use Azure DevOps for my pipeline. Currently I have a Release pipeline with a variable for the customers name that I input to stand up a new instance.

This feel cludgey at best as it handles deployment just fine, it doesn’t handle any updates that need to be pushed to the VMs. How do people handle having a clean way to setup, maintain, and tear down the resources on a per customer level?

https://redd.it/kb3z6e
@r_devops

Meli, a Netlify-like platform for deploying static sites

Hi there 👋

We used to host our sites on Netlify, but our eyes fill with glitter when we hear open source and self-hosted 🎉. So, we built Meli, which essentially is a Netlify alternative that lets you deploy static sites and frontend applications with ease, featuring per-branch deployments, web/slack/mattermost/email hooks, an API, and a way to manage organizations, teams and sites easily.

We built Meli on top of Caddy, a very powerful HTTP server. We've used Typescript, Node (backend), React (frontend) and MongoDB for the database.

It's a beta, but you can install super easily with Docker Compose: https://docs.meli.sh/get-started/installation

Check us out at https://github.com/getmeli/meli 🚀

Looking forward for your feedback 😀

https://redd.it/kb5l6m
@r_devops

Octopus deploy pricing target server definition

For those of you who use octopus deploy, what does deploy target mean in the context of licensing? I read their licensing 1 of 2 ways.

1. Deploy target means a target/server that is registered into octopus deploy via agent or via octopus deploy inventory mechanism

2. Deploy targets means you can't deploy to more than x servers at once but there is no limits total servers that can be deployed to.

I ask because while we have 100s of servers, they are only clustered in groups of 2-4 depending on the app. If the second licensing structure is what they follow, i can use the free edition. Otherwise I need to find an alternative.

https://redd.it/kb4snf
@r_devops

Red Hat UBI - updating or installing new packages

We have a docker file where we run a couple yum commands - yum update, yum install telnet.

The problem is that when we try to build the image from a Windows 10 machine via Docker Desktop commands, we get a message saying "This system is not registered with an entitlement server. You can use subscription-manager to register."

I tried this same build on a RHEL machine, and we were able to install telnet.

Does this mean it's impossible to build docker images on a Windows 10 machine where we install new packages?

Red Hat said it's not possible and directed me to this document: https://access.redhat.com/articles/2726611

That document is pretty dense, and I read through it but didn't specifically see anything disallowing what we are trying to do.

https://redd.it/kb32pa
@r_devops