• Home

  • Episodes

  • About

  • Login
    •

    David Kimura PRO
    Joined 7/18/2015
    Drifting Ruby Owner
    David Kimura PRO said over 1 year ago on Kamal 2 :
    Here's an example of what the accessory for Postgres could look like. It would rely on you updating the .kamal/secrets to also pass the POSTGRES_PASSWORD for the initial setup. Also, you would want to take care because in this situation, you're exposing port 5432 to the world as well. This shouldn't be an issue if you have a firewall, but you still want to take precautions. You could do something like

    127.0.0.1:5432:5432

    to expose it only on the localhost, but could have issues if you ever outgrow a single server setup.

    # config/deploy.yml
accessories:
  postgres:
    image: postgres:17
    port: 5432:5432
    host: IP_OF_THE_SERVER
    env:
      clear:
        POSTGRES_USER: APPLICATION_NAME
        POSTGRES_DB: APPLICATION_NAME_production
      secret:
        - POSTGRES_PASSWORD
    directories:
      - data:/var/lib/postgresql/data
    0 0 0
    David Kimura PRO said over 1 year ago on Kamal 2 :
    Running kamal setup will install docker for you automatically as it does detect if it doesn't exist. In the episode example of the DO Droplet, I didn't do any pre-setup or hardening. Kamal installed docker and everything it needed.

    0 0 0
    David Kimura PRO said over 1 year ago on Kamal 2 :
    Ah, yes that makes sense. Unless there is a remote builder set up, that is correct.
    1 1 0
    David Kimura PRO said over 1 year ago on Kamal 2 :
    In Kamal 2, the secrets were moved from .env to .kamal/secrets. Be careful as this file is included in your version control by default (not added to .gitignore).
    1 0 0
    David Kimura PRO said over 1 year ago on Kamal 2 :
    It's basically enabling UFW

    # installing and configuring ufw
sudo apt-get install ufw
sudo ufw status
sudo ufw allow 22/tcp
sudo ufw allow www/tcp
sudo uff allow 443/tcp
sudo ufw enable

    This will block incoming requests except the SSH port, and ports 80 & 443. For server hardening, I also like updating all of the packages on a fresh install and installing fail2ban. I'll also typically update my SSH config (or verify it) that password authentication is disabled, so you can only use a SSH key to authenticate.

    sudo apt update && sudo apt upgrade -y
sudo apt install fail2ban
    1 1 0