Live data from Hacker News

Let's deploy via Git

coderwall.com

91–100 of 113 posts

Re: Let's deploy via Git

#91
post #79

Earlier quoted context omitted.

Both Git and Rsync are incompetent deployment tools for many reasons I will not go into in a comment as there are quite a few articles expounding on the virtues of not using your VCS. There are also numerous reasons why rsync is inappropriate too (what if you push up a nasty bug and you have to revert? Op, better go revert to my tagged release then rsync again - this is ugly in comparison to versioned releases combin…

I agree. Benefits of versioned archives over VCS for deployments: easily checksum and cryptographically sign; easily integrate with existing distribution specific package databases; deploy without requiring a VCS (and all its dependencies, including maintained and accessible VCS repo-hosting deployment infrastructure), probable security and speed benefits of the resulting (ie. minimalist) approach (both at the level…

> easily checksum and cryptographically sign

Just as small nitpick: Your VCS should support this, too. (Git does, for example.)

Re: Let's deploy via Git

#92
post #80
post #69

Earlier quoted context omitted.

If there's anything in your repo history that you don't want a hacker to find you can just remove it and force push.

"Just remove it" is hard, because: * It may be hidden in some old commit (e.g: some password) * You'd need to rewrite all history from that point * Force push doesn't necessarily clean the data from the remote

Change the old passwords?

Re: Let's deploy via Git

#93
post #62

I came up with deliver https://github.com/gerhard/deliver to address this very problem. It's bash utility that automates git-based deploys and comes with pre-built strategies for the most common deployment scenarios: generated sites (think Jekyll), shared (WordPress, PHP etc.), ruby, node-js, S3 etc. I did a talk on it at my London Ruby User Group in March: https://speakerdeck.com/gerhardlazu/deliver

That's very cool. I really dig the minimalism of it. I'm currently using a system that involves about the same amount of config and leans on Capistrano for the heavy lifting, but I think I might investigate using deliver for my next project.

Re: Let's deploy via Git

#94

Aaargh ! Build on a build server Scp to live server along with generated config Install with native package tool and hook into native service manager Use salt / puppet / chef to do everything after initial build on your target servers. Be nice.

> Install with native package tool I'm sad that so few people seem to build native OS packages for deployments. My build system creates a release package and sticks it in an apt repo, then puppet installs latest version of package when it runs.

[deleted]

Re: Let's deploy via Git

#95

Aaargh ! Build on a build server Scp to live server along with generated config Install with native package tool and hook into native service manager Use salt / puppet / chef to do everything after initial build on your target servers. Be nice.

> Install with native package tool I'm sad that so few people seem to build native OS packages for deployments. My build system creates a release package and sticks it in an apt repo, then puppet installs latest version of package when it runs.

Would make your deployment system very OS dependent. All other things being equal, I would generally prefer to have a completely platform agnostic mechanism over something platform specific.

Re: Let's deploy via Git

#97
post #79

Earlier quoted context omitted.

Both Git and Rsync are incompetent deployment tools for many reasons I will not go into in a comment as there are quite a few articles expounding on the virtues of not using your VCS. There are also numerous reasons why rsync is inappropriate too (what if you push up a nasty bug and you have to revert? Op, better go revert to my tagged release then rsync again - this is ugly in comparison to versioned releases combin…

I agree. Benefits of versioned archives over VCS for deployments: easily checksum and cryptographically sign; easily integrate with existing distribution specific package databases; deploy without requiring a VCS (and all its dependencies, including maintained and accessible VCS repo-hosting deployment infrastructure), probable security and speed benefits of the resulting (ie. minimalist) approach (both at the level…

Theres many package management systems which sucks at this.

I suppose then that you mean "rpm" or "debs" or the like. Not the "language package management system" as the previous poster mentioned. Because I've yet to see one that truly support more than tar xzf . Even when they have signing support none of the packages are signed, anyways.

Re: Let's deploy via Git

#99
post #92
post #80

Earlier quoted context omitted.

"Just remove it" is hard, because: * It may be hidden in some old commit (e.g: some password) * You'd need to rewrite all history from that point * Force push doesn't necessarily clean the data from the remote

Change the old passwords?

I think the main problem is unknown exposure: Do you audit all old commits to find any sensitive data?

Re: Let's deploy via Git

#100
A beautiful thing that this demonstrates is that no matter how old a concept is, there's always room to explain it clearly so that those who didn't already understand it have the benefit of finally being enlightened. I learned this many years ago as an author, thinking that my most basic ideas weren't worth writing down. It turns out that what's obvious to one person isn't obvious to everyone else.

Thanks for the reminder and for the clear explanation of how git deploy might work!

Post reply on HN