Hacker News Reader

Comment by CommitSyn | Hacker News Reader

This is the second time I've seen this today. I'm a hobbyist hacker and do small projects. I'm still SSHing into servers to install and configure things. How does it work with cloud infrastructure... Do you not SSH into your server in the cloud and install things? Do you just rely on ready-made scripts to run what you need?

View on HN

It varies a bit, but here are three approaches I've seen.

1. You build custom VM images that have everything you need baked in. You don't upgrade these VMs, instead you build new ones and delete the old ones.

2. You use cluster management tools like Kubernetes or Nomad and run your software as containers. You upgrade by running a new version of the container. (If you choose to manage your own nodes in the cluster, you manage them as VMs using method 1.)

3. You don't run your software on servers you manage. You use so-called "serverless" services where your software doesn't have to think too hard about the OS it's running on.

Right, and the goal is to be able to easily deploy the same thing. Every time you SSH into a server and install something, you may not be getting the same packages due to updates or packages becoming unavailable. If you’re using an image, most likely you can easily tear stuff down and re-deploy it. Also you’ve got the code used to build the image and can modify it if necessary.

But you need to create: 1. A Custom vm image, so how do you do it?

2. A container: here is a bit simpler since you may use docer-compose...

Hashicorp Packer is the tool to build VM images with the same idea as building a container image. I used it some years ago before moving to K8s completely

Someone told me that our public facing dns server running bind has 3800+ days of uptime and despite bind is up to date, the Linux version is really old... it's running on a dl360 g4 server. Since they also proposed to have a different master/slave configuration my idea was to use ansible to have all the stuff reproducible. Then packer seemed to be necessary, then started to look at some more complex configurations and found that in many cases you just create gigantic bash script that apply the configurations. So I should go to my wiki page with all the commands to create my server and transform them into a script that I should test several times. Ok if you have 100s of identical servers, but when you have just 4?

I used to use this automation pattern when I only had 2-3 of each type of server, and it paid off massively. Regular tasks that previously took a long time like OS upgrades, audit data collections and temporary dev access only took seconds or minutes, and ticket turnaround times dropped massively.

For 1. Hashicorp Packer

For 2. You don't even need compose. Just build a container image from a Dockerfile.

Answer for both, really, look at docker config files. Essentially you specify what version of what distro to download, what to apt-get, what to download/git clone/... and you get out a VM image.

I use a mix of ssh'in in and running my services as docker images / docker-compose multi images.

My "deploy script" is simply a Github CI/CD action that builds the new docker images, pushes them to the GCR, and then logs into my VPS via SSH, pulls the images in, and restarts services. Works pretty good for small scale deployments and I get all the configuration and pinned versioning stuff into the images while not needing to go fullscale kubernetes which seems imho overkill for a single vps setup.

In the 'outside' real VPS the only thing I have, if those service need HTTP(s) ingress, is set up a simple ssl enabled webserver to reverse proxy shit back to the containers, and for that I use Caddy which auto handles generating ssl certs for your internet facing domains etc.

For home labs, NixOS is the easy recommendation if you are up for it. It really does just work once you understand it and get over the initial bootstrap of a single machine. I'd say it's easier than k8s and can also manage physical hosts.

Usually no. Sometimes, when you need to debug something, e.g network problem or run some tests - you do SSH, but solely for debugging purposes, and not for configuring / installing software.

For VMs you build image with everything baked in (think packer) or use cloud-init and do that on the fly on top base Linux image. For other apps serverless or sort of k8s solution.

Then Terraform or Pulumi to configure and push above to the cloud and maintain state.

The main selling points for Ansible and similar tools is that its automated, reproducible and can be audited via version control.

In a typical cloud deployment, you can have many servers and you need to quickly configure them and deploy software. Doing it manually through SSH may not scale and can be error prone. So, automation helps and as a bonus you get to leverage existing expertise.

While many of the ready made scripts do get the work done for standard tasks, I've seen lot of custom scripts depending on the environment and business needs. So, its a mix.

Reply on news.ycombinator.com