DevOps for a Dummy*
Rory Gibson, CTX
* yes I know DevOps is a cultural thing. But I like bad puns.

 Developer, architect, consultant, agile person, CTO
 Not a sysadmin
 “DevOps groupie”
 Mostly interested in getting things done.
Who?

 Wanted to have a side project
 But wanted to make it have a purpose - a “side hustle”
 Existing idea that I couldn’t shake
 What does knowledge management look like in 2017
(post-Slack)?
 $DEITY save us from SharePoint and Confluence
What?

CTX – cloud search for digital teams
https://getctx.io

 Solo founder aiming for revenue, not just a fun tech project
 Time poor
 Need efficiency
 Use sharp tools (Tim Ewald)
 Automate (but don’t polish the wheel-nuts)
 Use what you know
 Reduce incidental complexity
Principles

 Search index
 Some kind of relational storage
 Simple backend
 Easy-to-change front end
 Secure
 CM, CI & CD from the beginning
 Configuration management
Basic outline
 Elastic Search
 Postgresql
 Clojure
 ClojureScript
 Lots to learn!
 CircleCI
 Ansible

 Everyone defaults to AWS in startup land
 But experience says it’s worth modeling your costs
 Example: image processing service
 2x high memory + 2x high CPU per AZ
 £1000/m+ on AWS per AZ
 But only £150/m with physical tin and some thought.
 Shop around
 Hetzner
 Online
 ScaleWay
Hosting choices

 Encrypt all traffic (VPC / VPN)
 Encryption at rest
 SSL everywhere
 Principle of least privilege
 Keys > passwords
 Just because you’re paranoid…
 If you don’t have it, you can’t lose it
Security – “other people’s data”
 PeerVPN
 EncFS
 Let’s Encrypt & Caddy
 harden everything
 fettle SSH
 fail2ban
 Auth0, Metadata Service on hosts

 Clojure makes this easy
 Use the same tool in CM & CI
 Automated after the git push
 Notifications everywhere
Dev / deploy workflow
 Uberjar
 Ansible playbook
 GitHub & CircleCI
 Slack

 Simple masterless model
 … so it’s easy to run from CircleCI (or Jenkins or whatever)
 Works over SSH and relies on OpenSSH config
 …which means things like a bastion host are trivial
 Declarative configuration – not scripting
 Doesn’t hide the underlying Unix concepts
 Ansible Vault for secret management
Ansible

 Single large cluster
 Shared security
 Centrally controlled encryption
 Ingest to immediate import
 Shared commodity cloud
Where next?
 Multi-cluster
 Isolated environments
 Provide your own keys
 Lambda architecture
 Enterprise deployments

 Any questions?
 Email: rg@rorygibson.me
 twitter, github, Sheffield.Digital slack: @rorygibson
 CTX
 twitter @getctx
 or visit https://getctx.io
 Beta testers wanted!
Q&A