4 ms·
Cool for AWS. I still like Digital Ocean better.
by tkinom 11y ago
Cool for AWS. I still like Digital Ocean better.
- rubiquity 11y agoIt's certainly easier to launch a droplet on Digital Ocean but Security Groups and VPCs save so much time for just about any application I've ever put in production. I badly want Digital Ocean to have a service similar to Security Groups and VPCs so I don't have to munge my Ansible scripts to setup iptables rules and PKI for encryption between droplets.
- ju-st 11y agoCould you please explain why this is so important for you? I googled a little bit and the only use cases I found were (1) blocking communication between web & db servers and (2) to whitelist SSH only for your corporate network. Thanks!
- rubiquity 11y agoDroplets without private networking communicate over the public internet. Your traffic can be listened to and if it is plain text and if you have sensitive data (every app I've ever worked on always has) then that sensitive data is flying around free and clear. If you have Droplets with private networking you can communicate within that data center but other Droplets in the data center could still eavesdrop on your packets. To feel secure you need to encrypt data that goes between your droplets. As for iptables: if you don't need a port open, don't open it.