sksjvsla

10 ms·

1.
by sksjvsla 1y ago
I sincerely appreciate it — and I would never downvote a reply like this. It's clear you’ve been around the block, and I respect the experience and nuance you're bringing to the discussion. On the topic of Hetzner and account risk
2.
by sksjvsla 1y ago
As I wrote elsewhere in this thread: Being able to stay compliant and protect revenue is worth far more than quibbling over which cloud costs a little less or much a monthly salary for an employee is in various countries. The real ratio to
3.
by sksjvsla 1y ago
> Disaster recovery, monitoring, etc The ISO 27001 has me audited for just that (disaster recovery and monitoring) so that settles it, no? Also worth noting that these are the two things you don't really get from the hyperscalers. I
4.
by sksjvsla 1y ago
I wanted to comment on this but mistakenly put the answer here. Sorry. https://news.ycombinator.com/item?id=44335920#44346481
5.
by sksjvsla 1y ago
If you want me to assess what I would be needing the next 5-10 years, I'd make a very different thread here on HN. The defining conditions is my current setup and business requirement. It works well and we've resisted pretending t
6.
by sksjvsla 1y ago
Exactly. Well said. A thing we learned in this process is that there's many levels of abstraction which you can think of rollback and locking down SSH and so on and so forth. If your abstraction level is AWS and the big hyperscalers, i
7.
by sksjvsla 1y ago
I have not experienced this in spite of rumours online. As I mention in these two comments, given these we decided to design our way around it by assuming that they would both go down at some point of time (but not at the same time). 1. ht
8.
by sksjvsla 1y ago
As I wrote elsewhere in this thread: Being able to stay compliant and protect revenue is worth far more than quibbling over which cloud costs a little less. The real ratio to look at is cloud spend vs. the revenue. For me, switching from AW
9.
by sksjvsla 1y ago
I see where you’re coming from — no doubt, services like SQS and S3 make it easier to build reliable, distributed systems without reinventing the wheel. But for me, the decision to shift to European cloud providers wasn’t about wanting to b
10.
by sksjvsla 1y ago
If you were to divide the AWS customer base into a 10% bucket and a 90% bucket, a 90% bucket would not be the ones needing the infinite scale of AWS.
11.
by sksjvsla 1y ago
Yes, web apps all need logging, performance dashboard, redundancy, DB backups and such. This could be a stack that could be parametrised with sound defaults just requiring some terraform provider credentials as well as a path to an executab
12.
by sksjvsla 1y ago
You’re describing exactly the kind of vendor lock-in treadmill I was trying to avoid. What you see as “rapid iteration” looks a lot like redoing the same work every few months because of shifting cloud-native limitations. Also, the idea tha
13.
by sksjvsla 1y ago
People keep comparing cloud costs to employee costs, but I think that’s the wrong metric. The real ratio to look at is cloud spend vs. the revenue you can unlock. For me, switching from AWS to European providers wasn’t just about saving on
14.
by sksjvsla 1y ago
It is more trivial than it seems. How did people manage a Postgres instance prior to RDS? Of the entire feature list, what parts of RDS do you use? 1. Dumping a backup every so often? 2. Exporting its performance via Prometheus, and display
15.
by sksjvsla 1y ago
The network allows relevant ports from the respective IPs and so does the UFW so the servers can communicate between in each other in a restricted way. Needless to say communication is encrypted with certificates. Our logging server will sw
16.
by sksjvsla 1y ago
We did not consider that because we are a lean, small startup. We barely have a premise to put anything on. We talked to a few premium hosting vendors in Denmark and to build our own redundancy beyond what they guarantee, it actually became
17.
by sksjvsla 1y ago
The cloud provider can be compliant with your app being so.. Most apps will not pass an ISO audit unless designed to do so.
18.
by sksjvsla 1y ago
Nice observation. I took for granted that Hetzner and OVHcloud would be prone to failures due to their bad rep, not my own experience, so I wanted to be able to direct traffic to one if the other was down. Doing load balancing ourselves in
19.
by sksjvsla 1y ago
Yeah, the SSH port isn't publicly exposed
20.
by sksjvsla 1y ago
Well said. It reminds me of a story I heard in a podcast once. A database administrator for a drug cartel became an informant for the police. His cartel boss called him in on a weekend due to a server errors. He said in the podcast "I
21.
by sksjvsla 1y ago
Fred Brooks, the author of The Mythical Man-Month said: > “Software is ten times easier to write than it was ten years ago, and ten times as hard to write as it will be ten years from now.” Ansible, Hetzner, Prometheus and object storage
22.
by sksjvsla 1y ago
Read through this list here, it should give you a good sense of what logging and monitoring is sufficient for ISO and valuable to us: https://news.ycombinator.com/item?id=44335920#44337659 If you have any more questions, ju
23.
by sksjvsla 1y ago
Totally valid concerns — I don’t disagree that DIY hosting comes with real risks that managed platforms abstract away (but AWS could close your account too). We didn’t go into this blind though — we spent a lot of time testing scenarios (in
24.
by sksjvsla 1y ago
Before migration (AWS): We had about 0.1 FTE on infra — most of the time went into deployment pipelines and occasional fine-tuning (the usual AWS dance). After migration (Hetzner + OVHCloud + DIY stack): After stabilizing it is still 0.1 FT
25.
by sksjvsla 1y ago
I looked at Kamal, Dokku, and CapRover — all great tools if you want to abstract away server management. But for a HIPAA/ISO 27001 certifiable app, I need a higher level of control and auditability across the entire stack. With Ansible
26.
by sksjvsla 1y ago
Agreed, LLMs helped us with this.
27.
by sksjvsla 1y ago
This comment is great. Upgrade processes should be part of your internal processes if you want to get ISO 27001 certification that is not just checking the boxes but actually something you use for more control of your development and releas
28.
by sksjvsla 1y ago
You can't do single server setup for your workloads if you are ISO 27001 compliant and, further, you must have a separate server for logging and monitoring. No matter load, there is a need for complexity for this certification. Not all
29.
by sksjvsla 1y ago
Here you go. Write me at jk@datapult.dk, if you need more. A.5.25 Security in development and support processes: Safe rolling deploy, rollback mechanisms, NGINX health checks, code versioning, Prometheus alerting for deployment issues A.6.1
30.
by sksjvsla 1y ago
> Techincal I'm trying to share as much technical across this thread as for your two examples: System upgrades: Keep in mind that as per the ISO specification, system upgrades should be applied but in a controlled manner. This lends

More ›