Where do you choose to keep your data, managed DB or a DIY solution?

For prototyping phase and also some finished side-projects - I host everything myself. Just do backups if needed and you should be good. I have no issues at all and use https://dokku.com.

If it’s a serious commercial project and a loss of DB will lose you money - a managed DB is probably better.

Just be very careful deploying this to an online server, because it’s easy to leave it open to the world:

Screenshot from 2021-04-07 09-54-56969×327 65.1 KB

Unless I misunderstanding the warning it seems that we even have a window to be hacked while we setup everything. You can say that is very unlikely, and I will say you that it can happen if an automated script hits your brand new server at the right time, and this type of scripts run 24/7, they never stop, and they do an infinite loop through all public ips. Just launch a brand new server and then immediately tail its logs and you will soon see automated scripts hitting it to iook for known vulnerable systems that can be hacked.

@Exadra37 @egze thank you for commenting!

I’ve never used dokku, I’ve heard good things about it but admittedly, I still don’t quite understand how is it different from, say, just deploying docker on a VM. The vulnerabilities @Exadra37 mentioned sound pretty horrific though! It seems like enough of a put-off to look for alternative approaches, unless I’m missing something here

First I want to make clear that what @Exadra37 wrote is not a vulnerability, but just something to keep in mind. When you setup a VM there are also steps needed to make it secure. And nobody forces you to use a web installer, I didn’t.

Then what is better with dokku than doing it on your own is ease of use. Things like adding a DB to a project, rotating SSL certificates, hosting multiple sites on the same machine is just 1 command. It’s the same like Heroku or Gigalixir, but still under your control and cheaper.

Unfortunately our industry as this type of bad examples everywhere, read MySQL, MongoDB, Elasticsearch and many others are insecure by default(last time I checked), and if we don’t grok how to properly deploy them securely then we will shoot ourselves in the foot pretty dam easily.

Even deployment of VMs tutorials out there tend to be weak in terms of security or to not have any hardening at all.

This is all due to make it easier as possible to adopt a software… aka developer convenience over security.

You know, us humans have a natural tendency to choose whats easy to use, but in our industry this as an high cost in terms of security.

I am a strong believer that security MUST BE opt-out, not opt-in as it is now in the majority of released software.

From my point of view it’s a vulnerability in the way they deploy their software, but this is me that never understood why this mentality of releasing software doesn’t change, despite all data-breaches occurring due to software that is insecure by default. Just use shodan.io to lookup for your software of choice and find some open installations.

In my opinion, software released nowadays shouldn’t give a tool to make it easy for us to shoot ourselves in the foot, and then put a huge warning on the docs as a disclaimer to put the onus on the end user of such software

I don’t trust any database, PostgreSQL included, with port open to the wild. For small scale deployment, I always run the DB in the same VM, through a UNIX domain socket. This is dead easy for PostgreSQL.

I use Pulumi to deploy the Bitnami Postgres helm chart to Digital Ocean.

Ok, so the data resides on the same VM then, right? That’s what I was thinking of doing, but I wasn’t sure if it’s a bad practice

Thanks for sharing! Man, I need to read up on all this infra tech. Right now, I can’t quite tell how is Pulumi different from Dokku. I’ve seen Pulumi compared to the likes of Terraform which I think would be a bit of an overkill for me if all I need is a single VM