Hasty Briefsbeta

All tags

#devops

131 stories total

Bilingual

OpenGitOps
4 months ago
- OpenGitOps is a set of open-source standards, best practices, and community-focused education for GitOps adoption.
- GitOps Principles include: Declarative desired state, Versioned and Immutable storage, Automatic pulling of desired state, and Continuous reconciliation.
- Upcoming events include ArgoCon EU 2025 in London, England.
- Past events include GitOpsCon NA 2024 in Seattle, WA, and ArgoCon EU 2024 in Paris, France.
Show HN: VaultSandbox – Test your real MailGun/SES/etc. integration
4 months ago
- VaultSandbox enables production-like email testing without mocks, ensuring real TLS, DNS, and SPF/DKIM validation within your VPC.
- Supports major email providers like Postmark, SendGrid, and SES, with deployment possible in 5 minutes using Docker Compose.
- Eliminates common testing pitfalls such as fake SMTP environments, polling loops, and shared public inboxes that lead to production failures.
- Provides isolated, encrypted inboxes for secure testing without exposing customer data, with auto-provisioned TLS and DNS.
- Features include real SMTP + TLS termination, full message validation (SPF, DKIM, DMARC), and true isolation with encrypted storage.
- Designed for CI/CD pipelines with ephemeral, in-memory storage, automatic cleanup, and disposable inboxes for high-velocity testing.
- Includes a CLI for real-time email monitoring, SDKs for automated tests, and supports deterministic testing without sleep() statements.
- Open-source core (AGPLv3) with commercially safe SDKs (MIT), no artificial limits, and built-in quantum-safe cryptography.
- Future roadmap includes enterprise features like SSO and audit logs, with current focus on core stability and documentation.
- Addresses common concerns like spam protection, data persistence, and key management, ensuring secure and efficient testing.
I Cannot SSH into My Server Anymore (and That's Fine)
4 months ago
- The author decommissioned their expensive VPS (moana) and set up a more cost-effective successor (tinkerbell).
- Tinkerbell operates without SSH access, automating updates via container image pushes to a registry.
- The setup uses Fedora CoreOS, Ignition, Podman Quadlets, and Terraform for a container-centric, declarative, and low-maintenance approach.
- The author explored alternatives like Docker Compose, Ansible, and Kubernetes before settling on CoreOS for its immutable infrastructure benefits.
- Podman Quadlets and auto-updates were key in simplifying container orchestration and ensuring automatic updates.
- The final setup includes a reverse proxy (Caddy) and a static website container, with communication facilitated via a shared pod network.
- The author acknowledges the trade-offs of immutable infrastructure, such as redeploying for changes, but finds it manageable for their use case.
- Future plans include improving observability and possibly moving TLS certificates to block storage.
Sei (YC W22) Is Hiring a DevOps Engineer (India/In-Office/Chennai/Gurgaon)
4 months ago
- Sei is an agentic AI platform for financial services, live with large enterprises across the US, Europe, and APAC.
- Backed by top investors including Y Combinator, Tribe Capital, PayPal, Picus Capital, & Hashed.
- Founders have 20+ years of experience in fintech and tech products at companies like Deutsche Bank, PayPal, and Amazon.
- Looking for a senior DevOps engineer to scale their V1 platform, with expertise in AWS, Kubernetes, Terraform, and AI/ML.
- Tech stack includes Typescript backend, React frontend, Python for AI agents, and AWS infrastructure with Terraform.
- Responsibilities include auto-scaling, managing monitoring tools, integrating security tooling, and scaling various server deployments.
- Core values include continuous feedback, product-mindedness, action-oriented work, and humanity-centric approach.
- Ideal candidate has built from 0 to 1 or 1 to 10, strong DevOps and AI/ML experience, and a bias towards action.
- Offers competitive pay and benefits with flexibility between cash and equity.
- Not suitable for those who want minimal work, cannot handle intense work, lack ambition, or are not team players.
- Requires presence in Gurgaon or Chennai office at least 4 days a week.
Remails: A European Mail Transfer Agent
4 months ago
- Remails is a European Mail Transfer Agent (MTA) designed for transactional emails like verification codes and password resets.
- The project started with a single VPS and evolved into a high-availability Kubernetes setup with managed PostgreSQL.
- High availability is ensured through multiple replicas of components, load balancers, and independent backups.
- Remails uses a 'bring your own IP' (BYOIP) approach to manage email reputation and avoid spam filters.
- The architecture includes separate inbound and outbound SMTP services, with outbound services running as DaemonSets for IP control.
- A lightweight message bus facilitates communication between components, with fail-safes to ensure eventual email delivery.
- Remails is in public beta with a free tier and plans for future features like email notifications and privacy enhancements.
Why Twenty Years of DevOps Has Failed to Do It
4 months ago
- DevOps aimed to create a feedback loop between developers and production but failed due to inadequate tools.
- AI now enables effective feedback loops for median engineering teams, changing the game.
- Developers and operations teams have different perspectives and concerns, requiring tailored approaches.
- Traditional instrumentation and telemetry tools are complex and not developer-friendly.
- AI simplifies instrumentation and analysis, making it accessible and efficient.
- Future development shifts from writing code to validating and understanding its impact in production.
- DevOps isn't dead; it laid the groundwork for better tools and practices now possible with AI.
You Need More AWS Accounts Than You Think
4 months ago
- Using multiple AWS accounts is not overkill but necessary for security and operational efficiency.
- A minimal AWS setup requires 9–10 accounts for proper isolation, addressing specific needs like logging, artifacts, and automation.
- Adding accounts later is complex and costly due to migrations and untangling initial architectural decisions.
- Multi-account setups prevent future complexity by establishing clean boundaries early.
- AWS accounts provide hard IAM boundaries, essential for developer autonomy and security.
- Proper tooling and frameworks make managing multiple accounts as easy as managing fewer.
- Starting with a multi-account setup is deferred simplicity, avoiding months of retrofitting later.
Building Robust Helm Charts
4 months ago
- Helm charts are used to deploy similar application stacks in various configurations across different environments.
- Helm's built-in linter (`helm lint`) checks for YAML syntax, template rendering, missing files, and best practice violations.
- The `helm template` command ensures templates render correctly before deployment.
- Helm templating is compared to front-end templating (like JSX), where reusable components abstract complexity.
- Conditional logic in Helm templates (e.g., for persistent storage) must be thorough to avoid errors or data loss.
- Helm unit tests (using `helm-unittest`) validate template outputs for different configurations.
- Native Helm tests run post-deployment to confirm chart functionality and valid Kubernetes manifests.
- Integration tests (e.g., using Hurl) verify real-world behavior, such as HTTP redirects.
- Documentation is auto-generated using `helm-docs`, with descriptions added via comments in `values.yaml`.
- A robust Helm workflow includes linting, unit tests, integration tests, and documentation generation, all integrated into CI/CD.
GitHub - hashicorp/vault: A tool for secrets management, encryption as a service, and privileged access management
3 months ago
- Vault is a tool for securely accessing secrets like API keys, passwords, and certificates.
- Key features include Secure Secret Storage, Dynamic Secrets, Data Encryption, Leasing and Renewal, and Revocation.
- Vault provides a unified interface for secrets with tight access control and detailed audit logs.
- Documentation, tutorials, and certification exams are available on HashiCorp's platform.
- For development, Go is required, and the repository can be cloned outside the GOPATH.
- Testing involves Docker, and acceptance tests can be run with specific environment variables.
- Vault Enterprise features are detailed on the Vault Enterprise site.
- Experimental Docker-based testing is available for both OSS and Enterprise versions.
Reflex (YC W23) Senior Software Engineer Infra
3 months ago
- Reflex is an operating system for building mission-critical enterprise applications.
- It replaces the fragmented enterprise stack with a single, unified platform for building, deploying, and managing applications end-to-end.
- Teams can own the entire app lifecycle without needing specialized infrastructure or DevOps teams.
- Reflex provides reusable abstractions at both the framework and infrastructure layers.
- Applications can be built securely with AI, standardized on Reflex's open-source framework, and deployed with a single click.
- Reflex has powered over 1 million applications, earned 28,000+ GitHub stars, and is used by 30% of Fortune 500 companies.
- The founding team includes open-source maintainers, competitive programmers, and ex-devtool unicorn founding members.
- Reflex is growing rapidly and recently raised additional funding.
PyInfra: Infrastructure Deserves Real Code in Python, Not YAML Soup
3 months ago
- PyInfra is a library, not just a CLI, and can be embedded in frameworks like Django and FastAPI.
- It uses standard Python, allowing integration with tools like Terraform and implementing deploy freezes.
- PyInfra is up to 10x faster than Ansible due to SSH multiplexing and parallel execution.
- Simplifies package installation with fewer lines of code compared to Ansible's YAML.
- Uses Python's native features like ternary expressions and for loops instead of complex YAML syntax.
- Offers better debugging with clear error messages and supports pytest for testing.
- Provides full IDE support with autocomplete and refactoring, unlike Ansible's YAML.
- Encourages code reuse by importing modules instead of copying roles from Galaxy.
- Reduces code by 70% and is easier for junior developers familiar with Python.
- Has zero target dependencies and integrates with Terraform and Docker.
- Suitable for server provisioning, deployment, configuration, and container management.
- MIT licensed, production-ready with stable APIs and active maintenance.
I spent 5 years in DevOps – Solutions engineering gave me what I was missing
3 months ago
- The author spent five years as a DevSecOps engineer but felt a shift in year four, leading to a transition to Solutions Engineering.
- Key issues in DevOps included repetition, stagnation, and isolation, with predictable tasks and limited human interaction.
- Solutions Engineering offered new challenges, constant learning, and more human interaction, addressing what was missing in DevOps.
- The role involves diverse tasks like discovery calls, demos, troubleshooting, and workshops across various industries.
- The author became a bridge between customers and product teams, influencing product development based on customer feedback.
- DevOps experience proved valuable in Solutions Engineering, providing credibility and shared experience with customers.
- The role requires adapting to constant context-switching and building new skills like demoing, but offers rewarding challenges.
- Solutions Engineering may not suit those who prefer deep technical focus or solitary work, but is ideal for those seeking variety and human connection.
- The author encourages DevOps engineers feeling stuck or unfulfilled to consider Solutions Engineering as a potential career path.
Bash scripts are brittle – simple error handling in bash
3 months ago
- Bash scripts are commonly used as system glue in CI/CD pipelines or CronJobs.
- Default behavior in bash is to continue executing commands even if one fails, unlike other programming languages.
- The `-e` option in bash can be used to exit immediately if a command fails.
- Exit codes in bash: 0 means success, any other number indicates an error.
- Error handling techniques include `if else` statements, logical operators (`&&`, `||`), and the `trap` command.
- Pipes (`|`) in bash can hide command failures unless `pipefail` is enabled.
- Undefined variables can cause issues; use `-u` to treat unset variables as errors.
- Combining options like `set -eEuo pipefail` provides robust error handling.
- Alerting on errors is crucial, especially for cron jobs, using tools like Slack webhooks or Notifox CLI.
Show HN: I built managed OpenClaw hosting with 60s provisioning in 6 days
3 months ago
- OpenClaw is an open-source AI agent framework that functions as a self-hosted AI assistant across multiple platforms.
- Setting up OpenClaw manually is complex and time-consuming, prompting the creation of ClawHosters for simplified hosting.
- ClawHosters uses a four-layer security model, pre-booted VPS instances, and dynamic routing via Redis for fast deployment.
- Snapshot-based provisioning reduces setup time from 5 minutes to 60 seconds by pre-installing necessary components.
- A prewarmed VPS pool ensures instances are ready in 15-20 seconds, improving user experience.
- Security measures include Hetzner Cloud Firewall, host iptables, fail2ban, and Docker daemon hardening.
- Users can SSH into Docker containers for customization, but this voids support guarantees.
- Container commit functionality preserves user changes across restarts by saving container state as a new image.
- Traefik with Redis enables dynamic routing for subdomains without reloading configurations.
- Lessons include avoiding unnecessary complexity like virtual currencies and automating snapshot management.
Kubernetes Failure Stories
3 months ago
- Compiled list of Kubernetes failure stories from various companies.
- Includes incidents like global outages, high latency, and security issues.
- Common issues involve CPU limits, DNS problems, and conntrack errors.
- Contributions encouraged to share more failure stories.
- Aims to help the community learn from past mistakes.
Lexega Turns SQL into Signals
2 months ago
- Lexega transforms SQL into deterministic signals for policy enforcement.
- It tokenizes, parses SQL, extracts semantic facts, and emits signals.
- Signals describe actions like unbounded writes or policy changes.
- Rules match signals to assign severity and messaging.
- Policies decide enforcement actions like block, warn, or allow.
- Lexega handles semantic diffing to catch high-risk SQL changes.
- Supports Jinja/dbt-templated SQL with context-aware rendering.
- Custom rules can be defined in YAML for org-specific risks.
- Deterministic analysis ensures repeatability and auditability.
- CI-friendly decisions with machine-readable outputs.
Stop Putting Secrets in .env Files
2 months ago
- The article discusses the risks of storing credentials in plaintext .env files.
- A solution is proposed to use secure stores like 1Password or macOS Keychain to manage secrets.
- The pattern involves fetching secrets at runtime and injecting them as environment variables, avoiding plaintext storage on disk.
- 1Password CLI allows using secret references in a file that can be safely committed to version control.
- macOS Keychain can also be used as a built-in secrets manager with a bit more manual setup.
- Benefits include a single source of truth for credentials, simpler onboarding, and better auditing.
- The approach is language and framework agnostic, working with any tool that reads environment variables.
- A demo repository is provided to try both 1Password and Keychain implementations.
Cracking the Python Monorepo
2 months ago
- A monorepo is a single repository containing multiple projects, used by large companies like Google and Facebook.
- Monorepos solve the problem of local dependencies between projects, ensuring compatibility and reducing technical debt.
- Challenges of monorepos include slow CI/CD pipelines and complex dependency management.
- Modern tooling like `uv` and `Dagger` simplifies Python monorepo setup and maintenance.
- `uv` provides workspace support for managing dependencies in monorepos efficiently.
- `Dagger` enables modular and cached build pipelines, improving performance.
- The approach outlined allows for granular copying of source code and efficient caching.
- Downstream steps like testing (`pytest`) and type checking (`pyright`) can be integrated seamlessly.
- Combining `uv` and `Dagger` results in a flexible, high-performance build process for Python monorepos.
Reflex (YC W23) Is Hiring Software Engineers – Python
2 months ago
- Reflex is an operating system for building mission-critical enterprise applications.
- It replaces the fragmented enterprise stack with a single, unified platform for building, deploying, and managing applications end-to-end.
- Teams can own the entire app lifecycle without needing specialized infrastructure or DevOps teams.
- Reflex provides reusable abstractions at both the framework and infrastructure layers.
- Applications can be built securely with AI on Reflex's open-source framework and deployed with a single click.
- Reflex has powered over 1 million applications, earned 28,000+ GitHub stars, and is used by 30% of Fortune 500 companies.
- The founding team includes open-source maintainers, competitive programmers, and members from dev tool unicorns.
- Reflex is growing rapidly and recently raised another round of funding.
Devenv 2.0: A Fresh Interface to Nix
2 months ago
- devenv 2.0 introduces a polished Nix developer experience with interactive features.
- Terminal UI provides structured progress and error details during Nix operations.
- Native shell reloading allows background rebuilds without freezing the terminal.
- Built-in Rust process manager replaces process-compose with declarative process management.
- Performance improvements via C FFI backend and incremental evaluation caching.
- Polyrepo support enables referencing outputs from other devenv projects.
- Out-of-tree devenvs allow configurations to serve multiple repositories.
- Automatic port allocation and SecretSpec for secure secrets management.
- MCP server for package and option search, and language server support.
- Breaking changes include JSON output for devenv build and deprecation of devenv 0.x.

first prev5next

About|Login

#devops

OpenGitOps

Show HN: VaultSandbox – Test your real MailGun/SES/etc. integration

I Cannot SSH into My Server Anymore (and That's Fine)

Sei (YC W22) Is Hiring a DevOps Engineer (India/In-Office/Chennai/Gurgaon)

Remails: A European Mail Transfer Agent

Why Twenty Years of DevOps Has Failed to Do It

You Need More AWS Accounts Than You Think

Building Robust Helm Charts

GitHub - hashicorp/vault: A tool for secrets management, encryption as a service, and privileged access management

Reflex (YC W23) Senior Software Engineer Infra

PyInfra: Infrastructure Deserves Real Code in Python, Not YAML Soup

I spent 5 years in DevOps – Solutions engineering gave me what I was missing

Bash scripts are brittle – simple error handling in bash

Show HN: I built managed OpenClaw hosting with 60s provisioning in 6 days

Kubernetes Failure Stories

Lexega Turns SQL into Signals

Stop Putting Secrets in .env Files

Cracking the Python Monorepo

Reflex (YC W23) Is Hiring Software Engineers – Python

Devenv 2.0: A Fresh Interface to Nix