The document provides 10 tips for building battle-tested Atlassian Connect add-ons: 1. Automate deployments so they are a single button press. 2. Create rules for deploying to production to make it easy and safe. 3. Understand dependencies and implications of what is built and used. 4. Use other services where it makes sense to avoid reinventing the wheel. 5. Monitor components, servers, applications, users to know where failures happen. 6. Have recovery plans tested regularly to prepare for failures. 7. Handle failures by focusing on fixing issues with notifications and status updates. 8. Plan for traffic patterns to ensure scaling is possible when needed.

1. Ten Battle-Tested Tips for your
Atlassian Connect Add-on
DANIEL WESTER | CHIEF PRODUCT ARCHITECT | WITTIFIED | @DWESTER42A
4/13/17

2. 1 Million
10,000
60
Server and Cloud Add-Ons
Customers
Downloads

3. This talk
Creative Commons
Image By Benjamin Horn (Flickr)

4. How do you get started?

5. There is no “one size fits all”
Creative Commons
Image By Angus Fraser (Flickr)

6. Select your
frameworks
and hosting

7. Research your choices
and understand what
they mean to you.
TIP #1

8. How do you ship your add-on?

9. First time
Automate
More automation
New Servers
cd /opt/applications
mv the-app the-app.050717
mkdir the-app
curl http://my-build-server/artifact/12.tar.gz
tar xvf 12.tar.gz
/etc/init.d/the-app restart
Deployments

10. Automate
First time
More automation
New Servers
Deployments

11. Automate
First time
More automation
New Servers
Deployments

12. Automate
First time
More automation
New Servers
Deployments

13. First time
New Servers
More automation
Automate
Deployments

14. First time
More automation
Automate
New Servers
Deployments

15. First time
New Servers
Deployments
Automate
More automation

16. The Add-On

17. Automate your
deployments so that it’s
a single button press
TIP #2

18. Do you track your
deployments?

19. Automation
The same deployment on
testing as in production
Deployment Rules
Never on Friday
Know when you
should not deploy
Track
Know what commits are
deployed and when

20. Peter Lely
(University of Cambridge)
Newton’s First Law of Motion: Inertia
An object will not change its motion
unless acted on by an unbalanced
force

21. Create rules for yourself
to make it easy to
deploy to production.
TIP #3

22. How do you know what
you add-on does?

23. Dependency exercise

24. Understand the implications

25. Know what you’ve built, what
you’re using and it’s impact
on your product and yourself.
TIP #4

26. When should you use
other services?

27. Don’t reinvent the wheel
Creative Commons
Image By Elliott Brown (Flickr)

28. Understand support options

29. UNDERSTAND YOUR SLAS
Daily or Monthly?
Are the uptime ranges a
running monthly or a daily
basis.
Trigger points
When are the SLAs triggered?
Remedies
What does the remedy mean
for your product?

31. server
{
listen 443;
location ~/hipchat/current-room-counter/([0-9]+)/([0-9]+)
{
error_page 404 500 = 200 @counternotfound;
set $memcached_key “$1:$2”;
memcached_pass a-memcache-server.example.com;
}
location @counternotfound
{
add_header Content-Type text/plain;
return 200 ‘’;
}
Nginx Configuration

32. “searchForNewUpdate“: function()
{
if( this.updateInterval ) { return; }
this.updateInterval = window.setInterval( function()
{
AJS.$.get(‘/hipchat/current-room-counter/‘ + wittified.callcenter
‘/‘ + wittified.callcenter.roomId, function( val )
{
if( wittified.callcenter.currentUpdateTicker != val )
{
wittified.callcenter.currentUpdateTicker = val;
AJS.$.get(‘/hipchat/rest/get-recent-calls?jwt=‘ +
wittified.callcenter.currentJWT, function( data )
{
Javascript: Fetching new content

33. var refreshInterval = 3000;
window.setInterval( function()
{
if( wittified && wittified.callcenter && wittified.callcenter.cur
{
AJS.$.get(‘/hipchat/utils/regenerate/jwt?
jwt=‘+wittified.callcenter.currentJWT, function( config )
{
if( config && config.jwt )
{
wittified.callcenter.currentJWT = config.jwt;
AJS.$.ajaxSetup(
{
“headers”: { ‘Authorization’: ‘JWT ‘+ config.jwt}
Javascript: Updating configuration

34. Use other services where it
makes sense. But plan ahead.
TIP #5
http://nginx.org/en/docs/http/ngx_http_memcached_module.html
Helpful Resources

35. How do you know when
failures happen?

36. Component
Micro service, single
end point
Server
VMs
Application
All of the services
that make the
deliverable
End User
The end user’s
experience
What do you monitor?

37. Test script

38. Monit component

41. Make sure you’re monitoring
the right things. Also, make
sure to monitor your monitors.
TIP #6

42. How do you prepare
for failures?

43. FEMA News (fema.gov)

44. Creative Commons Image by
steffypeeageayemm; Source (flickr.com)

45. Multiple
Providers
Don’t get tied to a
single provider.
Backups
Daily, Deployment
and manual updates.
Continuous
Delivery
Allows us to recover
somewhere else
Monitoring
Know when and how
large the impact is.
Some of our mitigation tactics

46. Region 1
Region2

47. Region 1
Region 3
Region2

48. Your Descriptor

49. Your Descriptor

50. Your Descriptor

51. Your Descriptor

52. Your Descriptor

53. Your Descriptor

54. TIP #7
Helpful Resources
https://www.ready.gov/business/implementation/continuity
Have a simple recovery plan.
Test it!!

55. How do you handle failures
when they happen?

56. JIRA Service Desk
CENTRAL NOTIFICATIONS
StatusPage.io
Blogs, Wiki, etc
Please remember
Don’t always need the line or text at all.

57. When disaster hits - you
want to focus on fixing
things. Plan ahead.
TIP #8

58. Are you ready for the traffic to
your add-on?

59. Scaling is easy

60. Scaling is easy

61. Scaling is easy

62. Scaling is not easy

63. Caching is important

64. Cache-Control
Cache-Control max-age=31536000, public
ETag "97152ffeb243b0f115749f71726b59e8"
Expires Thu, 08 Mar 2018 16:11:37 GMT
Set your
headers

65. location /
{
set $jwt_uri $args;
if ($jwt_uri ~ (.*)(?:&|^)jwt=[^&]*(.*))
{
set $jwt_uri $1$2;
}
set $jwt_uri $is_args$jwt_uri;
if ( $jwt_uri ~ ^&(.*))
{
set $jwt_uri $1;
Nginx Configuration

66. location /installed
{
default_type ‘text/plain’;
lua_need_request_body on;
access_by_lua ‘
local cjson = require “cjson”
local b = ngx.var.request_body
local data = cjson.decode( b )
local clientKey = data.clientKey
local publicKey = data.publicKey
local sharedSecret = data.sharedSecret
Nginx Configuration

67. location /secure
{
access_by_lua ‘
local jwt = require “luajwt”
local args = ngx.req.get_uri_args()
if not args.jwt then
return ngx.exit( 401 )
end
local token = jwt.decode( args.jwt )
local redis = require “redis”
local client = redis.connect( “127.0.0.1”, 6379 )
Nginx Configuration

68. WebHooks

69. WebHooks

70. Scale your application
by planning out your
traffic patterns.
TIP #9
https://openresty.org/en/
https://github.com/SkyLothar/lua-resty-jwt
Helpful Resources

71. Are you secure enough?

72. Security
Access
Backups
Network traffic
Block everything!

73. Backups
Access
Security
Network traffic

74. Security
Backups
Network traffic
Access

75. Network traffic
Security
Backups
Access

76. Network traffic
Security
Backups
/usr/bin/ssh
-i /home/tunneluser/.ssh/id_rsa
-f -p 1321 -N
-L 8080:41.25.18.24:8080
tunneluser@41.25.18.24
Access

77. TIP #10
https://wiki.ubuntu.com/UncomplicatedFirewall
http://www.linuxjournal.com/content/ssh-tunneling-poor-techies-vpn
https://www.imagescape.com/blog/2015/12/18/encrypted-postgres-backups/
http://docs.aws.amazon.com/AmazonS3/latest/dev/example-policies-s3.html
Helpful Resources
Be paranoid.

78. Creative Commons Image by
Moyan Breen; Source (flickr.com)

79. Thank you!
DANIEL WESTER | CHIEF PRODUCT ARCHITECT | WITTIFIED | @DWESTER42A