4 ms·

Congratulations, you have invented the "facsimile" that tptacek spoke of. Because your "canonical" dump file is just a dump file. At any given moment your serve

Congratulations, you have invented the "facsimile" that tptacek spoke of. Because your "canonical" dump file is just a dump file. At any given moment your server cannot be guaranteed to be in a configuration that is specified by your dump file, or by any version of your dump file. Why? Because the server exposes a tempting non-file-based interface to its internal state, and people who are trying to fix the servers at three in the morning will tend to use this to make "out-of-process changes". If the server is broken, do you dare to naively overwrite its configuration with the version that is in git? The general answer is "no". Because two weeks ago somebody did an INSERT into the server's internal database to make Customer X's site work, and afterwords they didn't take time to properly dump the config and commit the dump to git. Because it was 3AM, and the edit was only one of seventeen switches that they were desperately flipping, and they just forgot. When you restart the server that config setting will be lost and the customer will crash and you will spend hours trying to recapture the lost state of the server. You can prevent all this by making it difficult or impossible to alter the server config without altering the config file. But then why did we bother exposing the non-file-based interface in the first place?

yummyfajitas 16y ago
The non-human readable interface is exposed for experts who wish to have python/ruby/whatever edit the sqlite interface. If you don't like this interface, don't use it. If your sysadmins are desperate to screw things up, they will. If you really want to make it hard, your runmongrel2.py script can store the actual sqlite file in os.path.join('/tmp',str(uuid.uuid4())), thereby making it more difficult for sysadmins to find/edit. Lastly, if you are truly paranoid, you can put something along these lines into your server restart script: $ echo '.dump' | sqlite /tmp/b5497e39-f55a-4234-8f5c-99ea8c1e8ee8 > /tmp/oldconfig.human_readable $ diff /tmp/oldconfig.human_readable main-git-repo/conf/config.sqlite_human_readable
zedshaw 16y ago
> At any given moment your server cannot be guaranteed to be in a configuration that is specified by your dump file, or by any version of your dump file. It's a database, and one that's used by the entire world to reliably store data guaranteed. So this is just false on technical merits. > Why? Because the server exposes a tempting non-file-based interface to its internal state, and people who are trying to fix the servers at three in the morning will tend to use this to make "out-of-process changes". Yet, you say people store things in version control. You have the exact same problem then. People can go and make changes out of band that aren't in version control and forget about them. Happens all the time, and that's a people problem. What you seem to not understand is that you just need to take people out of the equation. Automation is the future of operations, and a system that allows any programming language with sqlite3 bindings manage the config is going to help with automation. Once you don't have humans logging onto machines like it's the 90's then you've actually solved the problem. A config file won't do that.
- tptacek 16y ago
  Your last sentence is hard to argue with, but it's worth pointing out that there's a cost to designing systems as if the universe you want to live in is the universe we actually live in. Let's call it "the Bernstein tax".
  - zedshaw 16y ago
    Ah the old DJB canard. I will counter your DJB with Alan Kay who's work inspired and/or created a huge amount of our modern technological world.
    - tptacek 16y ago
      Huh? I have no idea what this is intended to mean. For what it's worth: I'm an ardent admirer of Bernstein, and happily pay the Bernstein tax on my systems. All I'm saying is that I recognize that I'm paying it.
      - zedshaw 16y ago
        Whenever someone wants to shoot down a new system that is weird, they pull out djb. "DJB did this thing with qmail and everyone hated it, but he wanted it his way and that's why nobody uses qmail." It's another fear buzzword for sysadmins. It's effectively saying, "If you use Mongrel2 then it'll be like qmail. BEWARE!"
        tptacek 16y ago
        If Mongrel2 was like qmail, it would in fact be very likely that I would use it. If you think I'm making up my admiration for Bernstein's work for the sake of argument, here's what 1 minute of Google searching turns up: http://news.ycombinator.com/item?id=890613 http://news.ycombinator.com/item?id=890613 http://news.ycombinator.com/item?id=890558 http://news.ycombinator.com/item?id=890558 (These are a year old). Not myself being a sysadmin, I couldn't tell you what the fear buttons are. I had that job in '96-'97 (the same time period where I read qmail, which I deployed in early beta versions at the rather popular ISP that employed me, because I love qmail), became a developer, and never looked back.

yummyfajitas 16y ago

The non-human readable interface is exposed for experts who wish to have python/ruby/whatever edit the sqlite interface. If you don't like this interface, don't use it. If your sysadmins are desperate to screw things up, they will. If you really want to make it hard, your runmongrel2.py script can store the actual sqlite file in os.path.join('/tmp',str(uuid.uuid4())), thereby making it more difficult for sysadmins to find/edit. Lastly, if you are truly paranoid, you can put something along these lines into your server restart script: $ echo '.dump' | sqlite /tmp/b5497e39-f55a-4234-8f5c-99ea8c1e8ee8 > /tmp/oldconfig.human_readable $ diff /tmp/oldconfig.human_readable main-git-repo/conf/config.sqlite_human_readable

zedshaw 16y ago

> At any given moment your server cannot be guaranteed to be in a configuration that is specified by your dump file, or by any version of your dump file. It's a database, and one that's used by the entire world to reliably store data guaranteed. So this is just false on technical merits. > Why? Because the server exposes a tempting non-file-based interface to its internal state, and people who are trying to fix the servers at three in the morning will tend to use this to make "out-of-process changes". Yet, you say people store things in version control. You have the exact same problem then. People can go and make changes out of band that aren't in version control and forget about them. Happens all the time, and that's a people problem. What you seem to not understand is that you just need to take people out of the equation. Automation is the future of operations, and a system that allows any programming language with sqlite3 bindings manage the config is going to help with automation. Once you don't have humans logging onto machines like it's the 90's then you've actually solved the problem. A config file won't do that.

tptacek 16y ago
Your last sentence is hard to argue with, but it's worth pointing out that there's a cost to designing systems as if the universe you want to live in is the universe we actually live in. Let's call it "the Bernstein tax".
- zedshaw 16y ago
  Ah the old DJB canard. I will counter your DJB with Alan Kay who's work inspired and/or created a huge amount of our modern technological world.
  - tptacek 16y ago
    Huh? I have no idea what this is intended to mean. For what it's worth: I'm an ardent admirer of Bernstein, and happily pay the Bernstein tax on my systems. All I'm saying is that I recognize that I'm paying it.
    - zedshaw 16y ago
      Whenever someone wants to shoot down a new system that is weird, they pull out djb. "DJB did this thing with qmail and everyone hated it, but he wanted it his way and that's why nobody uses qmail." It's another fear buzzword for sysadmins. It's effectively saying, "If you use Mongrel2 then it'll be like qmail. BEWARE!"
      - tptacek 16y ago
        If Mongrel2 was like qmail, it would in fact be very likely that I would use it. If you think I'm making up my admiration for Bernstein's work for the sake of argument, here's what 1 minute of Google searching turns up: http://news.ycombinator.com/item?id=890613 http://news.ycombinator.com/item?id=890613 http://news.ycombinator.com/item?id=890558 http://news.ycombinator.com/item?id=890558 (These are a year old). Not myself being a sysadmin, I couldn't tell you what the fear buttons are. I had that job in '96-'97 (the same time period where I read qmail, which I deployed in early beta versions at the rather popular ISP that employed me, because I love qmail), became a developer, and never looked back.