simplecto

No, the Postgresql container is exposed only on the VPN interface (Zerotier).

The only exposed containers are (usually) Traefik (80, 443). There is a docker network where traefik talks to all containers handling HTTP traffic.

Other containers run in their own separate docker networks.

I had not seen that. Is it fair to say it is something similar to a Rules Engine like Drools?

Putting them in the same container means I have to manage the processes myself with something like supervisord. A docker-compose file makes this trivial because it is just a matter of a few lines of YAML that link the services together. It also means I can ship updates to my application and restart it without touching the rock-solid Postgres image.

OP here: I already tried the Dokku way of things, and it was not to my taste. I like being a bit closer to the native docker commands if/when things go sideways.

Dokku is an abstraction I don't want.

If I have the competency and like it, then why not? Also consider this is in the context of personal projects and small operations where scale is not the issue.

I get way more bang for the buck in terms of compute, storage, and memory with self-hosted/dedicated.

Interesting that you talk about gluing together some things around docker-compose. I've done something similar but on the command-line. Specifically, I use Makefile as a task-runner [1]. It is in there that I keep a lot of my custom settings for deployments, hosts, and one-off taks.

[1] - https://github.com/simplecto/makefile-taskrunner-template

That is explicit. Now that I think about it, I should update the article with how I do it now.

I explicitly bind the external port only to the ZeroTier interface. In fact, my configs have changed a bit:

instead of:

    ports:
        - 5432:5432

I now use the IP of the zerotier interface:

    ports:
        - 192.168.111.123:5432:5432

Now the only way to reach that port is via the vpn.

Thank you! At no point do I have to touch systemd, unless you want to change the default behavior of the docker daemon (which I dont).

You can simply apt-get install docker-compose. I am not familiar with other distributions. I suppose you could also pip install docker-compose as well.

Fortunately most of my systems remain in the default state. All the magic happens in docker/docker-compose.

No. It seems quite complicated at such a small scale to do that.

Wow, lots of good questions coming out of this :-)

1. I chose Postgres because I have the need to remotely manage as well as pull metrics into grafana and metabase. That is simply not possible with SQLite.

I realize this post should be a series of posts where I go deep on all parts of the SimpleCTO stack, so to speak.

2. My monitoring is quite limited because. Generally I use netdata to get a quick overview on health, and I export that into grafana. I rely on Hetzner for actual healthcheck and uptime monitoring. Sentry tells me if my code starts throwing too many exceptions or errors.

hah. Same here. Upgrading traefik is one of my more popular posts: https://www.simplecto.com/migrate-from-traefik-1-x-to-2-x/

There is a Discord for HTMX and Intercooler (another one-developer-show)

https://htmx.org/discord

OP here, thanks!

It is fun to learn, but it sucks to yak-shave [1] all the time.

The simplicity of the stack lets me walk away for days (or years) at a time, come back, and easily ship changes. No need to remember esoteric commands, configs, or get bitten by strange infrastructure upgrades.

I'm lazy, and I'm just looking for ways to be lazier. :-)

Exactly this. Developers and their managers and the CTO must accept most likely their work/company does operate a huge scale.

Once you internalize that your priorities change from all the tech hype (k8s, react, whatever) to actually working on the business problems. Not solving technical ones.

I'm quite opinionated here, but these things only matter at significant scale. Most one-person-SaaS or SMEs never really graduates out of the first pricing tier for this stuff.

You might want to check out https://gobuffalo.io/en

This feels very hand-wavey to me. I can patch and ship my docker images the same way I might patch a server.

apt-get update && apt-get upgrade

rinse, repeat.

Secondly, all this cargo-culting around small containers is fine if you are cramming resources. I am not.

The reality is that my projects and many others are really, really over-provisioned. Looking at my graphs right now, I am on the front page of HN and my server load is still only 20%.

Thanks for the kind words. I should update the part about the queues. I started using this pattern for SKIP LOCKED and it works well for multiple workers (search engine crawlers).

https://www.2ndquadrant.com/en/blog/what-is-select-skip-lock...

And implemented in Django:

https://docs.djangoproject.com/en/3.1/ref/models/querysets/#...

Man, you just put another 5 things on my list to write up! thank you

Django drives the choice here. Batteries included, huge community support, and AMAZING documentation. Half the software I write is from stackoverflow. LOL

I dont see dockerizing as a problem. Once copied out from my template I never think about it. I do admit that familarity with the underlying Image OS (Debian in this case) makes debugging / fussing about a non-issue.

Exactly -- it is that "something in between"

The nice thing with zero-tier is that it is literally two commands to get your network up and connected.

hide your eyes if curl|bash makes you cringe...

curl https://install.zerotier.com|bash

Then zerotier-cli join <your_network>

Go into the Zerotier web admin, check the box, and boom, that machine is on the network, securely.

Now I can spin up a bunch of containers for exploration/testing/or non-essential like grafana, prometheus, various exporters, metabase, etc.

I try to keep traefik clean and only serving secure traffic to "live" and customer-facing things on 80/443.

I disagree, docker-compose is just a wrapper around docker. It is in fact just a python package.

The daemon itself is just plain docker.

Good question. I ship logs and metrics back to my home server that runs grafana and loki. I also run some proxies to machines in other places.

>75% of my visitors and users are in the US. The latency is simply not an issue. And surprisingly many in Malaysia.

I run my blog and some small SaaS utils. I've never had a complaint ever about speed, responsiveness, or latency.

I thought it was because I eschewed bloated front-end frameworks. ;-)

A dedicated server at hetzner is about 30-35 dollars / month. That will get you a ryzen5/64 gigs/512 RAID-1 NVME on linux.

Heroku at that spec really starts to hit the wallet.

More than engouh for a lot of applications. Hell, I ran a E-commerce company with 20MM USD/year in sales on a dedicated server from 2005-2013.

Most things are plain vanilla and rock stable. I can go from new server to running my first services is less than an hour. Ansible or cloud-init go a long way to turning my pets into cattle, so to speak.

I spend nearly no time "managing it" -- I have grafana dashboards and Hetzner monitoring the critical things.

Happy to share more.

Well done. I’ve added this to my own bookmarking tool. :-)

https://www.curabase.com/org/curabase/bookmark-managers

Lots of room for multiple winners in this space because there are so many ways to solve niche use cases.

best of luck!

Possibly. Context is fuzzy when nesting comments like this.

Ahem...

https://thenextweb.com/shareables/2010/02/27/newsweek-1995-b...

https://blogs.mprnews.org/newscut/2012/02/the_internet_futur...

1. e-commerce. I changed the notification sound on my email to play a cash register whenever I made a sale.

I was literally using the internet to make money on things that didn't have to ship.

2. Crazy sharp knives -- in the kitchen and on the worksite. The difference between a dull knife and sharp one gives me the same feeling of, "How did I live like that before?"

Many organizations who run like this have enough staff to rotate in and cover a 24x7x365 availability.

Off-hours / unsocial hours are there for triage until the full staff can come online and address the issues.

Also, the week of your rotation where you "wear the pager" means that you will often have the "on-call" hangover day. Essentially that is a day off of rest as to not exceed the 40/hrs week.

Obviously this differs company to company and country to country.