Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

blog.mccartie.com

Post reply on HN
Print view View original

21–30 of 49 posts

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#21

Post by donw »

akbar501 wrote: post #8

Also worth noting that you should run a firewall as part of the basic configuration. AWS includes this via the Security Groups, but with DO you'll need to use iptables or ifw.

Or `ufw` if you're on Ubuntu -- very easy to set up, much easier than crafting rules by hand.

I'm also a fan of running `sshd` on an off-numbered port to add another layer of protection against zero-day attacks. Most worms spread by compromising a service on a host, and then hitting everything around that host, but (to my knowledge) most of these depend on targeted services living on their default ports.

It won't buy you anything against a direct attack, but security is all about layers of defense, not just having a hard outer shell.

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#22

Post by sespindola »

threeseed wrote: post #16
thejerz wrote: post #4

I wouldn't recommend running Nginx, Unicorn, Rails, Redis, and PostgreSQL all on one instance. Better to offload the databases onto their own VPS's.

Even better idea is not to host the databases at all. Only those who have never experienced a corrupted backup or failed slaves think a database is something that is relatively trivial to manage. You're much better off looking at platforms like RDS, MongoHQ, Cloudant etc.

In my experience, hosted database providers are almost always either cost or latency prohibitive.

Nowadays, in PostgreSQL is quite simple to replicate a db via log shipping[1]. You can even stream the WAL to an S3 bucket.

[1]: http://www.postgresql.org/docs/9.3/static/warm-standby.html

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#23

Post by donw »

davidlumley wrote: post #5

I used to prefer the flexibility and efficiency of having my VPS setup, and it's certainly cheaper. Over the past 2 years though, I've saved so much time and sanity using Heroku. I certainly can understand saving thousands of dollars and improving performance by moving from Heroku to a VPS or bare metal solution, but $90 is not uncomfortable enough for me to warrant the change. Interesting article!

Question -- do you have any background as a sysadmin? If not, then I can totally understand the attractiveness of something like Heroku. It really does take care of a lot of nastiness.

From my side, I've got a fantastic Ansible setup for databases, security, ssl certificate distribution, and so on, and so Heroku doesn't really buy me anything for the extra money.

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#25

Post by yeukhon »

latch wrote: post #15
xtrumanx wrote: post #10

Quick question; I don't know much about setting up a Linux server but I found it interesting the post had nothing related to security besides setting up a ssh key and separate user for deployment. What security-related tasks do you do when setting up a new server? Besides the above, the only things that come to mind for me are: 1. Change ssh port from default. 2. Block unwanted traffic via iptables. 3. Protect ssh wi…

#2 and #3 in your list are rather sweeping (fail2ban does more than protect ssh). I'm no expert either, the only thing I'd add is to disable password-based logins and root-login [1] [1] http://www.unixlore.net/articles/five-minutes-to-more-secure...

I personally have a mixed feeling about disabling password-based login. What if you've lot your key and you need to access the server for reasons such as getting the data out, how do you do it without root and without login password? Is there a way to go around this issue? Let me know if there is because right now, I have login password that I don't re-use. Well, I guess for real deployment, serving real users, you'd have shading and a good central logging system so losing an instance is not a big deal, but for me I run a personal server and this is so far the way I protect myself (have login and ssh) in the case of lossing my key :(

Anyhow, DO droplets allow people to "reset" root password and it is important to protect your DO account.

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#26

Post by e12e »

xtrumanx wrote: post #10

Quick question; I don't know much about setting up a Linux server but I found it interesting the post had nothing related to security besides setting up a ssh key and separate user for deployment. What security-related tasks do you do when setting up a new server? Besides the above, the only things that come to mind for me are: 1. Change ssh port from default. 2. Block unwanted traffic via iptables. 3. Protect ssh wi…

Most important: disable password login to ssh. Optional: disable direct login for root. Optional: limit hosts that can login with whitelist for sshd in hosts.allow (and ALL:ALL in hosts.deny). On Linux I generally don't lock down ports w/iptables - better to not have anything listening on a public interface that's not supposed to be publically available (most distros have sane defaults when set up as a server config these days).

As for DO upload your/a pubkey for root access to the control panel and have it installed for you in new images.

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#27

Post by michaelbuckbee »

While I appreciate the time and effort put into both this hosting move (and the subsequent writeup), I really can't help but feel the time and effort would have been better spent on gaining more traffic and users than on the move.

OP is saving $90/mo, less than the cost of adding just one new monthly subscriber at his 'Premium' plan.

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#28

Post by davidlumley »

donw wrote: post #23
davidlumley wrote: post #5

I used to prefer the flexibility and efficiency of having my VPS setup, and it's certainly cheaper. Over the past 2 years though, I've saved so much time and sanity using Heroku. I certainly can understand saving thousands of dollars and improving performance by moving from Heroku to a VPS or bare metal solution, but $90 is not uncomfortable enough for me to warrant the change. Interesting article!

Question -- do you have any background as a sysadmin? If not, then I can totally understand the attractiveness of something like Heroku. It really does take care of a lot of nastiness. From my side, I've got a fantastic Ansible setup for databases, security, ssl certificate distribution, and so on, and so Heroku doesn't really buy me anything for the extra money.

None as a fulltime sysadmin, most of my experience has been in operations, and in configuring servers for my own projects.

I've used Puppet and Chef before, haven't checked out Ansible. My main dissatisfaction with those tools was that there wasn't a super easy way to get started on a new VPS. I had to configure roles and settings to install Puppet or Chef, and _then_ I could get started automating things. It's certainly not hard, but I've never been in a position where it was something I did full time so have really valued platforms that do a lot of this for me.

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#29

Post by jonmccartie »

michaelbuckbee wrote: post #27

While I appreciate the time and effort put into both this hosting move (and the subsequent writeup), I really can't help but feel the time and effort would have been better spent on gaining more traffic and users than on the move. OP is saving $90/mo, less than the cost of adding just one new monthly subscriber at his 'Premium' plan.

It didn't take long ... and I wanted to take a break from staring at my non-performant Facebook ads and making cold calls.

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#30

Post by davidlumley »

brettskiii wrote: post #20
davidlumley wrote: post #5

I used to prefer the flexibility and efficiency of having my VPS setup, and it's certainly cheaper. Over the past 2 years though, I've saved so much time and sanity using Heroku. I certainly can understand saving thousands of dollars and improving performance by moving from Heroku to a VPS or bare metal solution, but $90 is not uncomfortable enough for me to warrant the change. Interesting article!

Heroku apps aren't performant in many areas of the world e.g Australia like where I am, Amazon EC2 has an Australian region which is amazing

I'm also Australian, but we have a fairly international customer base so the ~150ms difference for requests that hit the application hasn't been that big for us in the scheme of things.
Post reply on HN