Live data from Hacker News

The Twelve-Factor App (2011)

12factor.net

101–106 of 106 posts

Re: The Twelve-Factor App (2011)

#101
post #97

Earlier quoted context omitted.

EnvKey[1] can help with process reloading, and can facilitate both restarts and hot reload updates. (Disclaimer: I’m the founder.) The pros/cons of environment variables vs. files (or other approaches) is also something I’ve thought about a lot while working on EnvKey. We use environment variables as a default approach, since it seems to be the most common way to pass secrets/config to a process in the wild and we wa…

EnvKey looks great! Only one thing strikes me as unfortunate, which is it seems like it fragments the development process because now your code history is tracked in git but your config history is in EnvKey. It means everything I do is duplicated (for example, tags, branches etc). It isn't clear to me how I would take, for example common operations such as rebasing one git branch on another and replicate the same on…

Thanks!

I definitely see your point on splitting up the history!

One thing to consider though is that you're already forced to split up the history in order to handle secrets securely.

Given this unfortunate truth, I think you're better off storing all the config and secrets together rather than splitting them up and keeping config with the code.

There's not always a clear line on what's a secret and what's "safe" config, so attempting to split them up like this is asking for trouble: you're almost guaranteed to end up with secrets in your git repo eventually.

All that said, we've thought about adding a git integration that would output a non-sensitive state file ala 'tfstate' so that you can see your EnvKey history baked right into your git history--it wouldn't show values but you could see what keys had changed. Would something along those lines help to address your concern?

Re: The Twelve-Factor App (2011)

#102
post #97

Earlier quoted context omitted.

EnvKey looks great! Only one thing strikes me as unfortunate, which is it seems like it fragments the development process because now your code history is tracked in git but your config history is in EnvKey. It means everything I do is duplicated (for example, tags, branches etc). It isn't clear to me how I would take, for example common operations such as rebasing one git branch on another and replicate the same on…

Thanks! I definitely see your point on splitting up the history! One thing to consider though is that you're already forced to split up the history in order to handle secrets securely. Given this unfortunate truth, I think you're better off storing all the config and secrets together rather than splitting them up and keeping config with the code. There's not always a clear line on what's a secret and what's "safe" co…

thanks for the reply!

You're right about the split situation for secrets. I guess secrets have a different lifecycle generally anyway (just cos you roll back your code doesn't mean the password to production should be what it was at the time of the prior release). For this reason they (nearly) always sit outside of the versioning process for the code.

However our secrets are probably less than 1/10th of the config and even less of the complexity. So I am content to use a separate secrets manager / process for that.

Would be great to think about how to integrate with git workflows. Seems a bit messy but something like you suggest where it dumps it out to a file could be a way. Would be good to solve as incorrect / missing config is one of our major reasons for deployment issues, and so far despite all its evils, tracking them in source control as part of the dev process has been the best solution to minimise it.

Re: The Twelve-Factor App (2011)

#103

Earlier quoted context omitted.

I can’t tell if you’re being sarcastic or not. In case your not, The 12 Factor App was a seminal piece of work that underpinned the foundation of so much we take for granted about “cloud native” today. It was mostly written by the folks who started Heroku and were doing containerisation and elastic scalability before Docker existed. It really isn’t “some guy’s preference”.

I wasn't seminal. All the things in the list were already being done, someone just wrote down what they thought were best practices. Some of the things in the list are widely viewed as bad advice (e.g. using environment variables).

It might not be the most secure method to propagate secrets but the alternatives have significant complexities.

In $DAY_JOB we only ever use single-machine docker-compose for deployments and there they work decently.

Re: The Twelve-Factor App (2011)

#104
post #96

Just today I pondered how you can resell old content as new. One example was a song that I heard as a young teen, strawberry fields by some random Brit on MTV. I liked the song to only find out years later that it's a song by the Beatles. A bloody song by the Beatles with some new drums and some spaz spazzing to the music... Well there you go again... the 12factor app from 2011. A few years ago when I was browsing jo…

I don't feel like the (valid) point you are making applies to this case.

The 12 Factor App describe reasoning and motivations behind many common architectures today (speaking as someone that doesn't work with k8s) and for anyone that was not around in 2011-2015, it could be an interesting read

Re: The Twelve-Factor App (2011)

#105
post #62
post #55

Earlier quoted context omitted.

The best approach I've seen is to have the secrets in a vault and to keep the vault URL in an env var (so different vaults can be used for dev and prod, for example). The secrets location within the vault is held in a variable defined in an application config file which is checked in to source control. At runtime, a piece of code consults the variable and queries the vault using the provided location and then dynamic…

Do you have any particular vault in mind? We are looking for a simple solution which would work exactly like you described. We just need couple of different sets of variables for our web server, workers and other services.

I built onboardbase.com for this exact purpose and it has continuously solved a lot of use cases for me personally. There is also hashicorp vault which is amazing as well.

Re: The Twelve-Factor App (2011)

#106
Onboardbase was built to solve this use case. It manages and syncs your env across every stage of development.(Disclaimer: I’m the founder.)

I honestly started building this out of the need not share credentials and envs over communication channels like slack anymore. I needed a seamless and secure way to work with envs without having it scattered and fragmented across several mediums.

Envs are essential to how you work and i believe a solution shouldn't just be secure but it should also be seamless to how you work

https://onboardbase.com/blog/say-hello-to-onboardbase

Post reply on HN