Skip to content

Commit 78bdd79

Browse files
jordifierrojordifierro
committed
Post infra
1 parent ae0dade commit 78bdd79

8 files changed

+740
-0
lines changed

‎_posts/2020-08-10-building-my-own-infrastructure-1.md

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
---
2+
layout: post
3+
title: "Building my own infrastructure I"
4+
date: 2020-08-10 10:00:00 +0100
5+
categories: development
6+
comments: true
7+
---
8+
9+
![Mur's Castle](/assets/images/infrastructure_castle_1.png)
10+
11+
I used to have my projects spread in different systems:
12+
13+
* [Github pages](https://pages.github.com/)
14+
for my [Jekyll](https://jekyllrb.com/) personal blog.
15+
* [Heroku](https://heroku.com) for my [Django](https://www.djangoproject.com/)
16+
apis and also a [React](https://reactjs.org/) web application.
17+
* External services for databases
18+
([Postgres](https://www.postgresql.org/), [Elasticsearch](https://www.elastic.co/)...).
19+
* Other static hostings...
20+
21+
I decided to start the trip of building my own infrastructure
22+
and migratinf all projects to a centralized system.
23+
24+
What do I gain with this?
25+
26+
* Costs reduction
27+
* Easier customization
28+
* Services are centralized & you gain control
29+
* Lots of learning!
30+
31+
And what do I lose?
32+
33+
* Time and speed.
34+
35+
Is it worth? Maybe...
36+
In my case I was willing to introduce my self in systems world
37+
so I decided to put my hands on work to figure it out!
38+
39+
The first thing I did was improve my linux skills with two
40+
[lpic-1](https://www.lpi.org/our-certifications/lpic-1-overview) courses.
41+
It is always really useful to have a good operating system knowledge,
42+
even if you are not working as devops nor system administrator.
43+
44+
Before starting the migration of any project I though about what I needed and
45+
how to structure my server.
46+
These are the projects I had:
47+
48+
* [jordifierro's](https://jordifierro.com) My personal blog.
49+
It uses Jekyll framework and was hosted on Github pages
50+
(which has Jekyll automatic building integrated).
51+
* [Taddapp](https://taddapp.com) A simple landing page for an Android application.
52+
I don't want to remeber where it was hosted...
53+
* [Pachatary](https://pachatary.com) An Android & iOS application.
54+
I had the api in Heroku and was using heroku plugins (external services)
55+
for databases, mailer, etc. Images were (and are) stored on AWS S3.
56+
* [Llaor](https://llaor.com) A dictionary web. Same as pachatary:
57+
api and web where hosted on Heroku.
58+
59+
_(Heroku is a great service to quickly/easily deploy and scale anything,
60+
but it is a bit expensive...)_
61+
62+
So, I must implement a multiple domain hosting server
63+
that can deliver statics, respond RESTful api requests,
64+
store databases and connect to external services...
65+
66+
To achieve that, projects have to be prepared:
67+
* Dockerize them (for both testing and running).
68+
* Make them configurable. Setup variables must be injectable (eg: `env.list` files).
69+
* Write an strong README documentation.
70+
71+
Once I'd had the schema in my mind I defined the pieces.
72+
I should pick a linux distro ([Ubuntu server](https://releases.ubuntu.com/20.04/)).
73+
Use [Nginx](https://www.nginx.com/) as a server
74+
(to deliver statics and also as reverse proxy for api's).
75+
[Docker](https://www.docker.com/) plays a very important role:
76+
to build statics, run applications and test, store databases, etc.
77+
making dependencies management much more easy.
78+
And [Jenkins](https://www.jenkins.io/) to handle tests, deploys, backups...
79+
80+
And... to complicate it a little bit I added a requirement:
81+
zero-downtime deployments.
82+
So [Haproxy](http://www.haproxy.org/) comes into the equation.
83+
Putting Haproxy before Nginx allows you to have multiple instances of an app
84+
and load balance between them.
85+
86+
I already had the domains (at [namecheap](https://namecheap.pxf.io/4bR69))
87+
so I opened an account on [digital ocean](https://m.do.co/c/8edd7aed3fee)
88+
(it is a cheap and easy ,I didn't want any complicated features).
89+
I created a server instance there choosing Ubuntu 20.04 (LTS) x64 as image.
90+
91+
Here starts the journey!
92+
93+
Follow me to the [next post](https://jordifierro.com/building-my-own-infrastructure-2)!

‎_posts/2020-08-10-building-my-own-infrastructure-2.md

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
layout: post
3+
title: "Building my own infrastructure II"
4+
date: 2020-08-10 12:00:00 +0100
5+
categories: development
6+
comments: true
7+
---
8+
9+
![Door lock](/assets/images/infrastructure_door.png)
10+
11+
At the [first post](https://jordifierro.com/building-my-own-infrastructure-1)
12+
of this series I have explained the background and planned the system.
13+
14+
Once I had a running instance of ubuntu server,
15+
first thing I did was secure it a little bit.
16+
What I wanted was to avoid intrusions and decrease risks in case of them.
17+
To do that, I created a sudo user, closed root and password ssh logins,
18+
changed ssh port to prevent sniffer scripts to find it easily
19+
and setup a firewall.
20+
21+
Here are the steps:
22+
23+
Login as root on your server.
24+
25+
Create your user, add a password to it and make it sudoer:
26+
```bash
27+
useradd -m -s /bin/bash myuser
28+
passwd myuser
29+
usermod -aG sudo myuser
30+
exit
31+
```
32+
33+
Generate your ssh key (if not already done), add it to your server user trusted keys
34+
and ssh into server:
35+
```bash
36+
ssh-keygen
37+
ssh-copy-id myuser@serverip
38+
ssh myuser@serverip
39+
```
40+
41+
Configure and activate firewall:
42+
```bash
43+
sudo ufw allow ssh
44+
sudo ufw allow 80/tcp
45+
sudo ufw allow 443/tcp
46+
sudo ufw allow 322/tcp # for ssh later use
47+
sudo ufw --force enable
48+
```
49+
50+
Edit ssh config to make it more secure
51+
(close password and root login and change ssh port):
52+
```bash
53+
sudo vim /etc/ssh/sshd_config
54+
55+
----------------------------------
56+
Port 322
57+
PasswordAuthentication no
58+
ChallengeResponseAuthentication no
59+
PermitRootLogin no
60+
----------------------------------
61+
62+
sudo systemctl restart ssh
63+
exit
64+
```
65+
66+
Now you can log in again and delete ssh ufw rule:
67+
```bash
68+
ssh -p 322 myuser@serverip
69+
sudo ufw delete allow ssh
70+
```
71+
72+
Once that was done, I installed all the needed software:
73+
* Docker
74+
* HAProxy
75+
* Nginx
76+
* Jenkins
77+
* AWS cli _(to store db backups)_
78+
* Letsencrypt certbot _(to generate ssl certificates)_
79+
80+
Commands to install all these packages are explained in detail
81+
on [project README](https://github.com/jordifierro/server-setup)
82+
but almost all of them were installed using `apt install`.
83+
84+
Keep it reading how I
85+
[built my own infrastructure](https://jordifierro.com/building-my-own-infrastructure-3)!

0 commit comments

Comments
 (0)