Comment by speedgoose | Hacker News Reader

Comment by speedgoose | Hacker News Reader

Parent Full thread

I'm looking at the ansible playbooks to setup my favourite beefy baremetal Hetzner server (128GB ram, Ryzen 9 5950X 16-Core, 450Gb fast NVME SSD, 3.5TB x2 NVME SSDs, 155€/month):

- Install Debian 11 while booted in rescue mode.

- Setup the root file system encryption using cryptsetup and dropbear (to enter the key during the boot through SSH). Involves chroot and some fun commands.

- Setup ZFS encrypted mirror filesystem for the two additional SSDs.

- OpenSSH hardening and Teleport installation.

- Kubernetes installation (K3S)

- Connecting kubernetes to my Argo CD instance or an existing Kubernetes cluster.

And then through GitOps:

- Installation of openebs-zfspv

- Installation of kube-prometheus-stack helm chart

- Installation of (many) postgresql instances and other craps

I have been playing with Linux servers for 20 years and I find this fun and rewarding. But I do understand people saying that baremetal Hetzner is not for everyone. Especially if you start to have requirements such as "data must be encrypted at rest".

Our terraform config for RDS is about 50 lines of configuration. We get a much smaller instance for our money, but ultimately figuring out all of what you posted isn't a good use of my time (yet).

I agree, if you don't have the time and don't find it fun, managed services in the cloud is a better idea.

Why are you running cluster orchestration software on a single machine?

My clusters don't necessarily have one machine, but I have a few clusters with a single node.

K3S is pretty lightweight and kubernetes is much more than cluster orchestration, so the pros win against the cons.

Kubernetes is not a cluster orchestration software. It’s an app orchestration software that also supports multiple nodes. If you don’t understand the difference, you’re missing the value proposition of k8s.

Well, yeah. I'm not sure I do see the value prop of k8s.

The fact that it's a supports multi-node means that you get all of the drawbacks of a multi-node system without any of the benefits. It's single node deployment but worse.

If you skip Kubernetes the setup is not that complicated.

I'm not sure. I rather use a lightweight kubernetes or perhaps nomad than do everything that kubernetes does without it. It sounds even more complicated. But I agree that for one single postgresql isolated from everything, kubernetes is overkill.

Yes, that list reminds me of the exaggerated posts about "look how hard it is to install Firefox on Linux!!". Claiming that setting up a Debian Postgres server necessarily entails knowing ZFS and Kubernetes is quite a reach

Not sure about Debian, but I believe Ubuntu Server will let you setup an mdadm mirror, LUKS (with LVM), and install and enable a Postgres server with a few buttons in the install wizard. It can even fetch SSH authorized keys from a Github account, covering by far the most important SSH hardening step (disabling passwords). Most hosting providers will also offer a one-click deploy that may similarly add your keys and do other common config

A better example of something that hosted databases makes a lot easier out of the box would be backup, replication, and monitoring

OMG you do not need this bloatload for just PG hosting. Just harden SSH, harden PG configs and voila :)

> - Installation of (many) postgresql instances and other craps

and you missing part about fault tolerance and fall back which is most complicated.

pg_auto_failover has your back - https://github.com/hapostgres/pg_auto_failover

and you absolutely can't be sure your saas vendor is doing encryption and hardening.

Reply on news.ycombinator.com