News for hackers. Stuff that matters.
Re:Show HN: Config.ly – Never hardcode your data again by munro on Wednesday November 11, 2020 @12:45PM (#25060662)
I don't understand why people use config servers like this, instead of keeping it in version control. Keeping it in the repository allows me audit changes of everything. If you move it to an external service, you lose that. And even if the external service has an audit trail, now you have two sources of version control. My assumption why people would do this is because 1) they're told that's how it should be done 2) they have a slow deployment processes, where it takes too long to get the change merged & deployed. Anyway, I've very happily never used a config service, and I still remain unconvinced. :)
Re:Show HN: Config.ly – Never hardcode your data again by jeremyis on Wednesday November 11, 2020 @12:55PM (#25060808)
Hey thanks for the insightful comment! I'm sympathetic to your thought here on having an external service and going with a simple approach.

Situations with a slow deployment process has been a big motivator for building Config.ly -- and I've seen it happen at companies with medium-sized eng teams (taking hours to swap values during incident fires), and I know it's a problem _all_ iOS developers have due to the app store deploy process.

I also think there's other value here... For instance having a UI means non-technical folks can update it. A lot of my time as an engineer has been spent making copy tweaks (I've felt existing CMS products were too heavy-weight and difficult to plugin).

Also, having turn-key libraries mean you don't have to copy/paste hardcoded values among many clients (or store on the server build an API for _every_ constant). I'm a big fan of DRY.

Re:Show HN: Config.ly – Never hardcode your data again by bawejakunal on Thursday November 12, 2020 @12:02AM (#25066629)
Big +1 for making it easier for non engineering folks to update the copy strings via UI. This is something very useful for product teams at mid size companies
Re:Show HN: Config.ly – Never hardcode your data again by jeremyis on Thursday November 12, 2020 @12:09AM (#25066675)
Thanks! Curious - why do you state mid sized companies specifically?
Re:Show HN: Config.ly – Never hardcode your data again by bawejakunal on Thursday November 12, 2020 @11:15AM (#25071357)
Some sort of dynamic config management existing via spring cloud or homegrown systems like configbus - easier to implement for larger tech companies, but the small and mid sized may benefit a lot f in their development speed from this off the shelf solution I believe as it evolves further
Re:Show HN: Config.ly – Never hardcode your data again by jeremyis on Thursday November 12, 2020 @11:24AM (#25071448)
Got it. thanks!
Re:Show HN: Config.ly – Never hardcode your data again by specialist on Wednesday November 11, 2020 @03:42PM (#25062740)
Further, a lot of "configuration" can just be the environment (context). Isn't that precisely what DNS is for?

An instance of an app (process, service, whatever) doesn't need to know that it's "dev", "test", "prod". Just have it look for "the database" and change the /etc/hosts (or equiv) as needed.

My impression is that istio (?) is supposed to formalize this approach. That'd be nice.

I'm so done having this conversation with teammates. Yet another reenactment of the "why use version control" war. There's always some stubborn refusal to join the third millennium. Because reasons. It's too complicated. No one knows how to do that. It's hard to debug. Whatever.

Every new cohort believes they're the first to invent configuration management.

Re:Show HN: Config.ly – Never hardcode your data again by kall on Wednesday November 11, 2020 @12:53PM (#25060786)
If you deploy to app stores you have a slow deployment process and there is not much you can do about it.
Re:Show HN: Config.ly – Never hardcode your data again by munro on Wednesday November 11, 2020 @01:01PM (#25060878)
Oh yea, mobile apps are totally a great use case. But honestly I would probably just toss a quick route for `/config` in my backend server that returns my config JSON for the app--and then boom we're back to having version controlled configs in my git repos. And obviously, make sure in the app to cache the last version incase there's no internet connection, unless maybe the app requires an internet connection.
Re:Show HN: Config.ly – Never hardcode your data again by jeremyis on Wednesday November 11, 2020 @01:04PM (#25060911)
Makes sense and you could definitely do that.

I could be wrong, but I think some folks would want their other clients -- even their server -- retrieving that value from that one single source. So when you roll an Android app, you'd also want to implement HTTP + caching... And basically you're on the path to building your own Configly.

Re:Show HN: Config.ly – Never hardcode your data again by kall on Wednesday November 11, 2020 @01:17PM (#25061049)
It’s really not so hard to roll yourself IF you don’t need a web interface.

In my GraphQL api I have a resolver called appConfig. That enables me to fetch the config I need for a screen in the same request as the data and to reuse any caching/offline/http logic the app already has. Zero added latency. No service can beat that, but then it‘s also just me editing postgres to change the config.

Re:Show HN: Config.ly – Never hardcode your data again by michaelmior on Wednesday November 11, 2020 @02:48PM (#25062144)
I think even if you do need a web interface, there are enough plug and play tools that will give you something that works reasonably well. That isn't to say that a service like Config.ly couldn't do a much better job.
Re:Show HN: Config.ly – Never hardcode your data again by asutekku on Wednesday November 11, 2020 @05:14PM (#25063639)
I’m just saying that if a non-developer needs to config something, they for sure would like to have a web interface.
Re:Show HN: Config.ly – Never hardcode your data again by bluehatbrit on Wednesday November 11, 2020 @07:15PM (#25064646)
We do both, to a point. We use Hashicorp's Consul to push config changes to running systems, but we sync it from a repo using an internal git2consul type thing.

It's nice to be able to push things into the system while it's running without hopping through all the hoops of qa, staging, etc. We then usually move it into the applications base configs in the app repo if it's going to stick around for more than a day or two to keep things tidy.

There's nothing wrong with a service to push config into a system at run-time, and you don't have to throwaway the benefits of the git history.

Re:Show HN: Config.ly – Never hardcode your data again by axlee on Wednesday November 11, 2020 @12:49PM (#25060729)
Do you keep your API keys and other sensitive data in the git repo as well, visible to all git contributors regardless of their credential level?
Re:Show HN: Config.ly – Never hardcode your data again by camsjams on Wednesday November 11, 2020 @01:01PM (#25060880)
Do you store your API keys and other sensitive data with a site that doesn't even have a page discussing their encryption or security practices? Their privacy policy mentions they secure data with SSL protocol...

Who has access to each client's database? Is it audited? Is it encrypted at rest? I'm sure it is, but Config.ly would be wise to add this information to avoid fears.

Also you can store encrypted secrets in Git just fine, there are a number of methods to do so very safely.

Re:Show HN: Config.ly – Never hardcode your data again by jeremyis on Wednesday November 11, 2020 @01:14PM (#25061007)
Thanks for the feedback. The goal right now is not to store sensitive data in Config.ly - your read API keys will be on your clients - and so in theory anyone who can read that source code can fetch your keys.

> Who has access to each client's database? Is it audited? Is it encrypted at rest? I'm sure it is, but Config.ly would be wise to add this information to avoid fears.

This is great feedback, thank you.

Re:Show HN: Config.ly – Never hardcode your data again by munro on Wednesday November 11, 2020 @01:03PM (#25060908)
Ohhh, that's such a great idea. I've done that before for TravisCI, now that I remember, it's really slick.

https://docs.travis-ci.com/user/environment-variables/#defin...

Re:Show HN: Config.ly – Never hardcode your data again by munro on Wednesday November 11, 2020 @12:56PM (#25060824)
Vault/k8s secrets for sensitive data--but you know, it really depends on the context for sensitive data, there isn't a simple answer to say what I've done across the board
Re:Show HN: Config.ly – Never hardcode your data again by seer on Wednesday November 11, 2020 @01:27PM (#25061173)
Berglas is great in that regard, as you can keep the unique names to the sensitive data in version control, but have the actual values sit in behind an acl in a secure location.

You’re able to guard secretes as need, but keep the audit-ability of version control.

Re:Show HN: Config.ly – Never hardcode your data again by dharmab on Wednesday November 11, 2020 @04:07PM (#25062985)
We store the vault paths/fields/versions in git and they're dereferenced outside of git (either directly in the software or in an intermediate deploy step).
Re:Show HN: Config.ly – Never hardcode your data again by rad_gruchalski on Wednesday November 11, 2020 @07:14PM (#25064644)
Yes! Ansible Vault encrypted. sops is an alternative.
Re:Show HN: Config.ly – Never hardcode your data again by makach on Wednesday November 11, 2020 @12:50PM (#25060737)
Beat me to it! ;-)
Re:Show HN: Config.ly – Never hardcode your data again by makach on Wednesday November 11, 2020 @12:49PM (#25060731)
Do you check in passwords into your version control? How do you differentiate between different deployment settings?
Re:Show HN: Config.ly – Never hardcode your data again by crispyporkbites on Wednesday November 11, 2020 @01:46PM (#25061429)
Secrets should be in env vars or secret storage like hashicorps vault

You set those on deployment so your engineering team never see production secrets

Re:Show HN: Config.ly – Never hardcode your data again by lukerohde on Wednesday November 11, 2020 @06:55PM (#25064490)
sops is a great tool for version-controlled secrets - plaintext keys and encrypted values using remote KMS to do the encryption. https://github.com/mozilla/sops
Re:Show HN: Config.ly – Never hardcode your data again by rad_gruchalski on Wednesday November 11, 2020 @07:13PM (#25064630)
You can implement the best of both worlds. Have new writes and updates always go through ci/cd but reads from all services.