The document outlines best practices for navigating from development to production, focusing on infrastructure choices, deployment automation, continuous integration, performance considerations, monitoring, and security. Key recommendations include utilizing server stacks and cloud services, employing tools like Capistrano and Jenkins for automation, and ensuring robust performance monitoring and security measures. It emphasizes the importance of speed, repeatability, and vigilant security measures to prevent data theft and ensure compliance.

1. Text
From Dev to Production
navigation guidelines
Samuel Fuentes for Startup Institute - 2014/06/13

2. Samuel Fuentes, 2014 - @samufuentes
Topics
Choose infrastructure
Automate deployment
Prepare for continuous integration
Mind performance
Monitor your platform
Don’t forget security

3. Samuel Fuentes, 2014 - @samufuentes
Choose Infrastructure
Pick server stack: nginx, unicorn…
Infrastructure
Heroku - out of the box solution
Amazon Web Services - easy and powerful
Self-managed - full control
Hybrid approach
Load balancing (HAProxy). Mirroring
Document it!

4. Samuel Fuentes, 2014 - @samufuentes
Automate deployment
Why?
Speed
Repeatability
Capistrano for R&R
Docker
SaltStack

5. Samuel Fuentes, 2014 - @samufuentes
Continuous Integration
What?
Automate build, test, lint
Why?
QA
Jenkins
Travis

6. Samuel Fuentes, 2014 - @samufuentes
Mind performance
Why?
Guarantee good UX
Caching and compression
Separate statics. CDN
Use server compression functionalities
memcached. Varnish
Browser cache. ISP cache
Cache invalidation
Remember mobile clients and 3G
Load testing. Bottleneck identification

7. Samuel Fuentes, 2014 - @samufuentes
Monitor your platform
Why?
Availability. Performance. Quick response to incidents. Debugging
Availability
Pingdom
Availability. Debugging. Alerting
New Relic
Server metrics
Munin
Alerting
Nagios
Web performance
Yottaa

8. Samuel Fuentes, 2014 - @samufuentes
Don’t forget Security
Why?
Data theft. Fraud. Privacy
OWASP top 10
SQL injection
Broken auth
XSS
Insecure references to objects
Insecure configuration
Sensitive data exposure
Missing access control in server - forged requests
CSRF
Using components with known vulnerabilities
Unvalidated redirects and forwards
PCI compliance
DDoS

9. Questions?
Samuel Fuentes
VP Engineering Delivery Hero
!
@samufuentes
!
info@samuelfuentes.com
samuel@deliveryhero.com
!
http://www.samuelfuentes.com