Recently Deployed n8n on ECS fargate on AWS

I recently deployed n8n on ECS fargate on AWS eith Terraform by keeping the n8n UI accessible with in the VPN and webhook endpoint to be publicly accessible.

Happy to answer questions and discuss if someone is facing issues with the n8n deployment.

https://redd.it/1uyt5v3
@r_devops

What cleanup proof do you expect after an agent runs tests locally?

For people who care about reproducible dev/test environments: where do you draw the line for "done" when an automated helper runs tests?

I do not mean whether the test passed once. I mean what happens after: Docker containers, simulators, browser processes, temp files, dev servers, occupied ports.

I have had a test run leave a dev server on an old port, and the next debugging session made no sense until I noticed I was hitting the wrong process.

With human-run scripts, this is already annoying. With AI agents, it feels easier to miss because the tool says the task is complete and you move on.

Would you require a teardown log or post-run check before accepting the result? Or is that too much for local development?

https://redd.it/1uyqljo
@r_devops

How to combine MD5 hash + code sign

We build and package our installer files using Advanced Installer. Up until last years version, we code signed using a .pfx and had the AI(Adv. Installer) also embed MD5 into the files. So both hashing and code signing is handled by the same tool, bing bong works fine.

But now, our team wants to move away from using a dedicated .pfx file, and instead wants to code sign it using a signtool.exe on the buildmachine, with the private key stored on a remote KMS. Thus, i integrated our pipeline to also have a task that code signs the installer. Now, when i tested installing with the installer,it is corrupted. Looked up on release notes, the custom signing via 3rd party does exist,but its on v17, my company is on v16 💀.

I tried disabling hashing via the AI, and let the build machine handle it (ofc via the preset task in pipeline), but just found out im only calculating MD5 hash value for the files, not embed the values IN the actual files

I really need some ideas, i feel like im trying to do the impossible here.

https://redd.it/1uyvds8
@r_devops

How do you keep release notes from just dying after a few sprints?

Hey,

I'm a developer looking into the way other teams create release notes and weekly updates together when the work is scattered across different tools e.g. Jira, GitHub and Azure DevOps.

We start with good intentions once every couple of months but after a while nobody updates the release notes anymore. It takes to much time and nobody enjoys to create them and it's not published to the stakeholders so nobody feels the urge to keep the release notes up to date.

How do you guys manage this?

https://redd.it/1uyv825
@r_devops

DevOps professionals in Australia - how much should I ask?

Been working as a DevOps / Cloud engineer for just over 6 years. Mostly in AWS shops. Know a bit of everything but quite good with linux, AWS, containers and orchestration, GitHub actions, Python / Node / PHP. Hold following certifications. AWS Solutions Architect Associate, DevOps Engineer Professional, LF Certified Kubernetes Administrator, Hashicorp Certified Terraform Associate.

Based in Melbourne, VIC, and currently paid AUD 100,000 + super. Wanting to see if I could demand more.

TA

https://redd.it/1uz25xp
@r_devops

How do small teams manage shared AI context without losing their minds?

Hey, we're building a project with 3 people using Cursor and Claude Code and keep tripping over the same thing.

One dev changes a port or finds a bug in a library and patches it with a workaround, the other has no idea and burns three hours figuring it out. The AI in the IDE has zero clue about team context and keeps suggesting stuff we already moved past. How's everyone dealing with this? Running some shared MCP server, a team version of something like claude-mem, or just dumping everything in Slack Telegram Discord manually?Curious especially from tech leads and small teams how do you not lose your mind to context chaos.

https://redd.it/1uz6jw9
@r_devops

How do teams using multiple git provide (github, gitlab, bitbucket) manage their daily workflow?

I'm curious how teams working across multiple Git providers manage their day-to-day work.

If your organization uses GitHub + Bitbucket or GitHub + GitLab (or more), how do you:

Track pull requests?

Find stale branches?

Monitor releases?

Keep track of work across providers?

Is it a pain point, or is it basically a non-issue?

https://redd.it/1uz8gk8
@r_devops

Mobile to backend end-to-end tracing: worth it? How do you keep the public ingest from being a DDoS target?

We're adding tracing to our mobile app and want the spans to connect to our backend traces (same trace\_id, so a user action in the app links to the API calls it triggers).

Backend goes OTLP -> Alloy -> Tempo already.

However, the mobile ingest endpoint has to be public, so it's an open, unauthenticated write endpoint which is an obvious DDoS/abuse target.

For now it's a simple one shared Tempo, and push all the protection to the edge instead: Cloudflare rate limiting, per-IP limits at the proxy, plus a sacrificial Alloy gateway that samples, memory-limits, and strips high-cardinality/PII attributes before anything reaches Tempo.

Questions for anyone who's done this:

* Do you actually ingest **mobile app traces end-to-end into your backend tracing**, or keep them separate (RUM-style) and just link by ID?
* Is chasing the unified mobile to backend waterfall worth it, or should we just drop it?
* How do you protect a public OTLP endpoint in practice?

Genuinely curious what's held up for people in production. Thanks.

https://redd.it/1uza6ko
@r_devops

standing api keys vs scoped tokens for ai agents in prod — what are you actually doing?

disclosure up front: i build an ai agent product, so i live this from the vendor side of security reviews.


been through a few enterprise reviews this year and the credential question is the one that keeps stalling. the reviewer asks what the agent authenticates with, and the honest answer for most teams is the same standing api keys a human would get, just never rotated and never scoped. one compromised prompt and the agent can do anything those keys can.


what actually moved reviews for us was short-lived scoped tokens the agent never sees in the clear, plus a per-action log the reviewer could replay. suddenly the question had a real answer instead of a promise.


curious what this sub is doing. still standing keys, scoped tokens per run, or something in between that actually works?

https://redd.it/1uzc66o
@r_devops

What is the one automation you have added, that you are proud of?

As DevOps, we all work on automating tasks to make our lives easier. What is the most satisfying automation you have ever implemented that truly saved you time?

https://redd.it/1uze2sz
@r_devops

Anyone considered code signing as a problem with respect to the P-Q transition?

Most of the discussions I ve heard regarding postquantum cryptgraphy fcus on TLS or key exchange protocls. I’d argue that code signing will probably be a much bigger problem. There are too many things associated with code signing, such as artifacts, build pipelines, firmware signing, package repositories, EV certificates, HSMs, delegated signing, legacy clients, rollbacks, and long-lived binaries. In fact it is possible that transport encryption will be subject to renegotiation in each session. But the signed artifact can continue to be checked many years later by systems that rely on a specific algorithm or certification chain. As I delved into the topic, I’m still quite hesitant in case I’m missing something fundamental.

https://redd.it/1uzorvm
@r_devops

Solve you kubernetes cluster issue using kubeagnet.
https://www.reddit.com/r/kubernetes/comments/1ux1g6w/weekly_show_off_your_new_tools_and_projects_thread/oy8fsq6/

https://redd.it/1uzuacq
@r_devops

Which sites do you actually find DevOps/SRE jobs nowadays?

I've been job hunting for DevOps/SRE/Platform Engineer roles and I'm curious where people are finding the best opportunities today. Besides LinkedIn, what websites, job boards, recruiters, communities, or other sources have worked well for you? I'm interested in answers from anywhere in the world to compare different markets, but if you're from Chile or Latin America, I'd especially appreciate your recommendations since that's where I'm currently looking. Thanks!

https://redd.it/1v04nvj
@r_devops

How much DevOps implementation is expected from a Freshie to know?

Starting to step in this field because development is seen as some random AI stuff now. I think I am too late. I just know abt the tools their names and work, not implemented much more than simple CI/CD pipelines on Github Actions, Docker. Implemented k8s, prometheus, grafana once, not confident.
What should be the bare minimum implementation and land a package. Or a good tutorial/project suggestion would be very helpful.

https://redd.it/1v060es
@r_devops

CVE-2026-63087: Grafana Oncall is EOL

Heads up if you're running Grafana OnCall's plugin-install flow, CVE-2026-63087 lets anyone reconfigure it with zero auth. Repo's archived, so there's no patch coming from upstream.

If you're still migrating off it and need some time, there's a small fix you can apply yourself and build from source in the meantime. Wrote up the actual vulnerable code + a verified patch: emphere.com/blog/cve-2026-63087-grafana-oncall-install-bypass

The install endpoint has zero auth on it - no token, no check, just the two public default IDs (stack_id 5, org_id 100) mint you a fresh one. The fix proposed adds an install secret only the operator holds, plus stops trusting a client-supplied admin role during the token bootstrap.

One caveat if you apply it: the secret is a contract change, so your own install clients (Helm, provisioning) have to start sending it too, or they'll lock themselves out. That's in the writeup too.

https://redd.it/1v07ef4
@r_devops

How should developer automation handle commands that never exit?

I am running into a boring automation question that matters more now that coding agents run local commands.

When a tool says "the command is still running", that is not enough information. Is the parent process alive? Did a child process inherit stdout? Was there any output in the last five minutes? Is this a watcher that should never exit, or a test that is actually stuck?

I have had an agent start a dev server during a small web task, then sit on "running" long enough that I had to check the port and process list myself.

For normal scripts this is annoying. For an agent, it is worse because the whole review gets blocked behind a vague status line.

What would you want in the run log before trusting it: process tree, last output timestamp, timeout policy, and cleanup result? Or is that too heavy for local dev automation?

https://redd.it/1v0fjbn
@r_devops

Terraform visualizer project

Hi everyone

I'm looking for an idea for my semester project, and I thought about building a Terraform Visualizer.

The idea is simple: it takes a Terraform state file, visualizes the infrastructure, and lets you save it as an image.

My question is if I build this, would you find it useful?

I'm asking because I would like to be able to justify the project's usefulness when presenting it to my teacher.

Also, I plan to keep it open source, so anyone can use it.

https://redd.it/1v0luip
@r_devops

Does anyone actually test their database restores on a schedule?

Every backup thread ends with "an untested backup is not a backup," everyone upvotes, and then (in my experience) nobody has an automated restore test anywhere.



Genuinely curious about the state of practice:

1. Do you restore-test on a schedule, or only when something breaks / an audit demands it?
2. If you automated it, what did you build? (ephemeral instance? scripts like pgbackrest_auto? CI job?)
3. If you didn't, what stopped you? (time? nowhere safe to restore to? nobody asked?)
4. For those with SOC 2/ISO: did the audit change anything, or did you just produce a doc that says you test quarterly?



Trying to understand if this gap is real or if I just keep landing in teams that are bad at it.

https://redd.it/1v0m5nh
@r_devops

Development Environment

Hi everyone,
I have a question about development environments and would love to hear how others handle this.

Our current stack is:
\- Ruby on Rails (authentication)
\- React (frontend)
\- Flask/Python (API)

Right now, every developer has to run all three services locally. I’m considering moving the Rails authentication service to a shared Linux development server and having developers run only the React dev server and Flask API locally. The goal is to reduce the number of services each developer needs to keep running.

For those of you using a similar architecture:
Is this a reasonable approach?

How would you set it up for multiple developers?

Would each developer have their own Rails instance and environment variables, or would you share a single authentication service?

Are there any pitfalls (performance, debugging, authentication issues, etc.) that I should be aware of before going down this path?

I’d appreciate any advice or examples of how your team handles a setup like this.

Thanks in advance!

https://redd.it/1v0swf4
@r_devops

Free Kubernetes beginner course. Learn K8s in an interactive web based terminal with lessons, labs, quizzes, and flash cards. [Free / No email required / 100% mobile friendly]
https://redd.it/1v0us6z
@r_devops