So, welcome to my talk, Clear Skies, no clouds inside, running a business on free and open
source software.
A little bit about myself, my name is Henpieter van Braa, but if you talk to me, please call
me HP, my mom does, and it feels much more at home.
I'm a co-founder of two Godot-related companies, prehensile Tales BV, which is a Godot-consulted
company, and recently Ramatalking Corporate, which is a company that plans to improve the
Godot mobile experience, always be selling, I just heard.
So, you know, I'm also a treasurer of the Godot Foundation, a gigantic nerd, and I started
a free and open source code hosting site called Nutterbug.org around the time when, who was
at Gatorious Shutdown, I think, and my personal blog is at blog.tmm.cx.
So what is this presentation about?
First of all, can you run a business entirely on free and open source software?
Should you run a business entirely on free and open source software?
Are you mad?
And by that I mean me, maybe some of you too, I don't know.
What does it mean to do this, and how can you actually do this?
But this presentation isn't about, it isn't a total lesson on like managing a large fleet
of servers, there's other talks about that, there's other people specializing in running
data centers with thousands of servers, this is not this, this is for a reasonable amount
of people in a reasonable amount of servers.
It's also not a lesson in a flame, I'm starting a flame war about configuration management
systems, so please don't add me if I say something you don't like.
I am going to say some things you don't like if you are a CIS admin for a much larger organization.
So first of all, can you do this?
Well, I've pulled all the speakers on this stage and 100% of them say yes, so that's
a good start, I think.
So why would you do this?
That's I think a question that a lot of people might ask themselves, I mean we're all here
with FastAmp, you're here, so I don't have to talk to you about the benefits of open
source software, why you should use free software, et cetera, et cetera, et cetera.
That's not what I'm here for.
So first of all, while you can use free tier of cloud services for almost everything, you
can get most of the features.
Once you start to get to a certain size, even if you're only as a small company, you end
up with five, six, seven accounts for individual users, and it is very difficult for people
to figure out what user you're going to use, what passwords to use, so you either end up
with people using very insecure passwords, so you end up having to force a password policy
on them, and then they're just going to write it down or whatever.
And someone still has to fix these issues if they happen in your company, now you are
certain suddenly help desk for people forgetting their passwords, at least that's been my experience.
So access control is actually the real big one.
Once you start to mix a bunch of different cloud services on basic tiers or free tiers,
figuring out who has access to what, if everyone has the access that they need, and most importantly
do people have more access than they need, it is very difficult to keep track of which
document was shared with whom, why was it shared with that person, is it an individual
that shared it with another individual, is it someone that maybe left the company now,
but they shared it with their public or private Google accounts, etc., it's very difficult
to keep track of these things.
This could be a problem if you sign non-disclosure agreements with customers, other people that
you work with, and depending on the business that you actually run, it could be a compliance
issue, particularly now with GDPR, etc., there's a lot of things you have to keep track of.
Of course, I see some of you think, but you can already do this, in fact, my company already
does this, yes, it is certainly possible, but usually, if you want these level of features
and these level of integrations, you end up having to pay actually quite a bit of money
for individuals, and only to get this fairly basic level of control over your data.
It also does work if you say, okay, I'm going to pick one SaaS provider, if you say, okay,
I'm going to use only Google products, I'm not going to use anything outside of Google
products, if Google doesn't have it, I'm not going to use it, that, of course, also works.
So, is this all about money?
Well, not really, I will get to that in a minute, but the first thing I usually hear
from anyone who talks about doing something like this is either a knee-jerk reaction
as in, but it's actually more expensive to do it yourself, I don't think that is true
at least, it's not true for me, so at least this means it's not a truthism that is definitely
applies to all cases, or of course the other one, it's only free if your time is free,
that is also fair, but having tried this in a different way, supporting individual people
in a bunch of different time zones in the case of my companies, with, oh, I don't have
access to this document, can you send it to me, or I have people working in North America
who share documents or fail to do it correctly, and a person working in Poland needs it the
next day, due to the time zone difference, they won't get their document until 5 p.m.
because nobody but the person who created it had access to it, this is also a time sink,
and of course if the worst came to worst, failing in a compliance case is probably not
kind of a free either, so what is this about then, if it's not just about money, first
of all I just like being in control of my data, I like to know where my data is, I like to
know where it's backed up, and I like to know that if I need to, I can just stick it on
an external USB drive and take it with me somewhere, sometimes you just want to hack
your data, I like having unsurprising costs, I know exactly how much my infrastructure
is going to cost this month, I know how much it's going to cost next month, if I need to
for a new project, whatever, add five external people to give access to some shared resources,
I know I'm not going to end up paying 150-200 euros more next month, that I don't need to
forget to not cancel again because otherwise I end up keeping paying it.
It gives me a big peace of mind when it comes to access control, what I just talked about,
I know exactly which one of my users have access to what data, I know why they have
access to it because it's based on group memberships, and I know, luckily this has not happened,
but I also know if something went where to go really wrong, I can in fact make sure that
people stop having access to the data that I don't want them to have access to anymore.
By giving people access to just one user ID and one password and one way of logging in,
I feel like I'm making their day just a little bit better and that makes me happy.
Just using free and open source software is nice, I mean most of the people here are here
for a reason as well, so I'm assuming that most of you agree with that.
If I run a laptop with just free software because it's important to me, why would I run my business
on anything else? It feels very good to be part of a community rather than just a customer.
I do pay for a certain software, let's get into that later, sorry, but even there you
end up not really being treated so much as a small customer, you tend to be treated more
like a community member to a certain extent. Also, they appreciate good buck reports more,
which is always nice. But isn't this like super-duper hard? I don't think so. It is true
that you need some things, you need to know some things that you might not need to know
otherwise, particularly not to say you go in all in on Google Workspace or you go in
all in on Office 365, you don't need to know a whole lot about infrastructure at all. For
this you do, I'm not going to lie about that. The most important thing is actually DNS,
tying all of that together, making sure that your emails don't end up in people's spam
folders, et cetera. Most of this actually boils down to a basic knowledge of DNS. You're
going to need to know a little bit about how to run a web server, how to administer a web
server and what web servers do, but not as much as you might think. And of course a basic
understanding of the Linux CLI, or I guess the FreeBSD CLI, if that's what you decide
to do. But it's a similar thing. So most people when I talk about this have a perception
that building something like this ends up with a cognitive overhead that looks something
like this. It's an extremely complicated set of tools where every individual thing that
fails could break everything. But in reality it's really not that bad. You end up with
a bunch of containers running on one or more hosts with a simple set of configuration files
that you stuff into Git and that's basically it. You don't manage 15 things, you manage
six things or seven things. All right. So how do you do this kind of thing? Well, the
most important thing really is to keep things simple. As soon as you start looking online
about managing Linux servers, et cetera, you end up finding a whole pile of wonderful
tools. I'm not trying to tell you that you should not use these tools, by the way. I'm
just telling you that in this case, if you're just managing two or three servers, some of
these tools might not be what you need. And trust upstream. When you use a cloud provider,
you're just trusting that your cloud provider does the right thing at any given time. If
you use a piece of open source software, if you use an open source operating system, if
you use an open source engine X or other web server, trust that upstream tests the stuff
they do. You don't need a five-street test environment just to install a security update
on your operating system. So how do you keep things simple? As I said, there's a lot of
really great tools like PuppetChef, Ansible, Juju CF Engine, BCF G2, SaltStack, and probably
one that I forgot. I think there might even be some in this floor that I forgot to include
in this. My apologies if that's one of your projects. These tools truly are great. I have
been a sysadmin at a large company and without tools like this, I would have absolutely lost
my mind. However, setting up services using these tools is a lot of translating between
documentation you read about the tool into a configuration file format that isn't the
one that is documented on the side of the thing you're trying to configure. And there's
a lot of testing involved, which is great if you need to repeat this on 100 servers,
but if it's one box you need to do and that you maybe need to redo in a year, it's a lot
of cognitive overhead. And if your business grows to the point where this becomes necessary,
then probably the overhead of converting what you did now into a PuppetManifest, Ansible
or whatever is probably not the thing that's going to prevent you from growing. In that
same vein, as soon as you start to look at, okay, how do I run containers? How do I do
that myself? Again, lots of great resources, lots of super great projects. But if you search
on Google, okay, how do I run a server with containers? One of the first links you're
going to find is, okay, you're going to get to set up a Kubernetes, you're going to create
an undercloud and an overcloud, and you're going to set up redundant, I don't know, load
balancers, that was the story I was looking for. And you're going to set all of this great
stuff up, and at some point when you have a thousand services, it's just going to be
just as easy as if you had a hundred. Yeah, and I can understand why if you start reading
that you get incredibly overwhelmed immediately, because that is a lot of stuff to learn. And
again, you're not going to need it for what we're talking about here. Again, I think all
of these projects are great. I have used many of them. This is just not about that. Please
don't add me. So what does it mean to use simple software? So in this case, use what
is supplied by the OS that you use. Every piece of software you install that is not
in the repositories of the operating system use, that is something that you might regret
later because that is something that is not tested by your upstream. This is again when
we come to the trusting upstream part of things. So in this case, we're going to get there,
I'm using Fedora for most of this stuff. Use Spotman, not Docker. Use SystemD, not whatever
else, a nice thing you might come up with. Use WireGuard. Don't try to do anything too
creative and use Git for your configuration management. And this is probably the most
controversial point of this presentation. Use a recent OS. You do not need CentOS. You
do not need Alma Linux. You do not need Red Hat Enterprise Linux. You need something where
if you read the documentation, that it is the last thing that people actually touched.
People are not writing documentation generally speaking on how to set up a modern thing on
an ancient enterprise distribution. Again, these things have their places. I'm not trying
to tell anyone that these things are bad. Again, this is about you managing your time
and making sure you don't spend a lot of time doing this. And upgrading your server every
12 to 18 months really isn't a big deal. Again, trust upstream, DNF system upgrade, release
for the next one 20 minutes later, you have your operating system upgraded. It's not a
big deal. Another thing, use pre-existing containers wherever possible. You can of
course write your own and sometimes you will have to for the demo I'm about to give. I
did have to write one. And don't forget that upstream tends to prefer using their containers
over a different way of deploying their software. So generally speaking, if you have an issue
and you say, okay, I'm running your latest container version, you're actually more likely
to get help than if you installed in any other way. Of course, what do we do about backup
and disaster recovery? Well, if you follow the recipe that I'm going to talk about, then
basically you have two directories to backup on each server. And if something goes wrong,
you have two directories to replace back on the server. And basically your stuff is back.
I will hear the people managing infrastructures for large corporations saying, but this will
take hours. Yes. It also almost never happens. And this way you can be sure that your data
is not gone if something goes wrong without breaking the bank. Generally speaking, I've
been doing this for quite a while now and I've had one server fail due to a hard disk
failure. Of course, the server was just using a rate one mirror. So I just called the people
run the data center. They replaced the disk and there was actually not really a problem
there. I would like to now introduce megacorp.icu. This is a very big company that has graciously
let me demo their environment. Completely non-evil. They let me show you their environment
because prehensile tiles, my own company, the CEO, thought it was irresponsible to have
the internal systems recorded on there free and open source and developers European meeting
thing. I don't know what they're thinking. Megacorp is nine totally real employees. They
were absolutely not AI generated. The thing I'm about to show you is a setup that is roughly
looks like this. There are three hosts running on this laptop, hopefully. Configured as such.
So we have three hosts with an overlay network on WireGuard to make sure that these hosts
can talk to each other over local IP addresses. Reason for that being is when you do something
like this, you're probably not going to be able to afford or want to pay for dedicated
rec space with your servers nicely lined up above each other, connected to each other
over local connections. So you need some way for your servers to feel like a LAN. By doing
a simple WireGuard mesh, any one server can go down and the other two can still talk to
each other, which is a nice feature to have. And now a hopefully non-colossal mistake,
I'm going to try to actually show you what this looks like by using a system like this.
So first of all, this is the basic admin interface. You might see if you're using something
like this. So we have our nine users here in LDAP. And we have a couple of groups here
that you can manage. So I've made a human resources team for which Chatwick and Maxwell
are our members. I made some shared mailboxes that a human resources team can also look
at. So what this looks like here is for instance, let's see, have a new timer tab. This one
I think. All right. So for a little explanation, I'm using a feature of Firefox here called
container tabs. Basically in the top right here you will see the name of one of the fake
users. I mean, totally real users. And basically Firefox will keep all the cookies, etc., separated
so that I can actually show you what it means to log in from multiple systems. Just a private
tab would only give me two Firefox tab containers because it basically give you an unlimited
number of private tabs, essentially. So that's what we're doing here. So the first thing
we can do is, oh, this is the wrong one. This is the real one of my real company. I was smart
enough to make bookmarks and I didn't use them. So the user name of this person is Cadence.
So first of all, this is basically the login screen that every user will see, hopefully
only once a day. The way this works is you log into the system, there is a cookie that
gets set for key cloak in this case and key cloak then does all the authentication with
further back ends. So generally speaking, if everything works properly, your users will
only have to log in once a day, also meaning that your password policies and things like
that can be a little bit stricter because they really only have to remember one and
they really only have to type it in once a day. So, oh yes, this user actually doesn't
have access to this. That was part of the demo, but I forgot that in this case. We will
get there. Let me show you something that the user doesn't have access to, their email
box. So you see that I just switched from the next cloud to the email server and you
also noticed, hopefully, that there was not another login prompt. That is, again, because
these single sign-on systems, if you deploy them properly are in fact single sign-on.
You sign-on once and then it should just keep working. So this is the email box for our
user cadence and we can see we have an address book with all of the people, all of her colleagues
in it. First and here is Chatwig Parsons. These names are also all AI generated, by the way.
So what we can do is we can send an email to Chatwig here. Am I doing the right thing?
Send email. You can send a little email to Chatwig here.
And now, hopefully, when we switch to the Chatwig, there we go, Chatwig there, have received
an email. You see also that the things like, small little things like the fact that all
of the users have their own little profile pictures, et cetera, and these are all consistent
across all of the applications as well. So if you look at the Chatwigs, Chatwigs does have
access to the next cloud. There we go. And you see that this actually shows the same...
If you click the same button twice, the same thing happens. This is very surprising. You
see here that the user has this... Oh, sorry. You see here that the user actually has the
same profile picture as well. These profile pictures all came from Active Directory, thank
God, no. Came from OpenELDA as well. So what can you actually do with this? What is the
big thing that I kept talking about? For instance, here we have a human resources folder that
Chatwig has access to because Chatwig is part of the human resources department. And so
there is... Maxwell is also an HR person. So Maxwell and Chatwig... So far, everything's
still working. Very good. You see that Maxwell here has access to the same document. And
there's not been any sharing here. It's just a matter of being part of the correct group.
I will show that in a second. But if you look at the access that... This is all about Kelly.
Thank you for getting that I made these nice handy dandy. It's not exactly single sign-on
if you're doing a demo with five different users. It is only once per user, not once
per demo, I'm afraid. You see here that the user, Elba here, does not have access to the
shared directory and cannot see it. And trying to just send a link to this other person will
also not work. As you see, you just get a file not found there. Now, what if Elba does
become part of the human resources team? Well, at this point, it's just a matter of
adding the member here. And then, in a couple of minutes, hopefully, maybe immediately,
we'll get back to that. What's the next thing on my list of things to share? I also created
this user, Mary J. What you've seen so far is basically what it looks like for people
who have been working for a while, who already know the system. What does this look like
for a completely new user? Because that's another problem, right? Getting people signed
up on board in your organization. Okay, forgetting I made these. So, let's say you tell your
new user, okay, the first thing you need to do is just go to the chat system to say hello.
So, we have given the user their initial temporary password. I sign in and you see that you get
just this one little prompt for people to change the password. And after that, they're
just signed up like everything else. So, this is basically the only real onboarding that
your users have to do. So, they don't have to create accounts for multiple things. You
don't have to create accounts for multiple things. I don't end up having to type a personal
Gmail account to some kind of Google Drive, nothing like that. And there we are. The same
thing goes for things like the access to, for instance, channels on your instant messaging
server. You see here that at Chatwick, being part of the human resources group, has access
to this channel HR that is not visible to this user, Maria Johnson. So, Maria Johnson
is not part of HR, does not see the group. This is not something that you have to manage
yourself either. We also see here that since Alba was recently promoted to be part of the
HR group, she is now, she now has access to the HR channel as well. Again, this speaks
to this access control that I was talking about previously. You don't have to think
about, okay, what things does an HR person have access to? Did I give them access to
the right folders? Did I give them access to the right chat, email address, et cetera?
It's all just taking care, you only take care of this one time when you set this up, basically.
So, there's a couple of other things that people like to use, like, editing documents
together. We can do that. If I, probably should have kept more tabs open. It turns out that
navigating a computer is much easier when you're writing a talk and you're sitting down
instead of facing a room of 700 UV pool. Well, that's not 700 of you here, but you know.
So we have two people logged in here, and you'll be able to edit things collaboratively
much like Google Docs, et cetera, as well. So you don't really need to lose any features
over any of this either. Let's see. We have the chance. Yes. So these are the services
that I added to the demo for this demo. If anyone has any questions about what other
things you could easily do, we have a question section in a minute. Let me go back here.
So I'm assuming that it went super well when I wrote this. I'm going to give myself three
and a half out of five stars on that one. So can you do this? I think this little demo
shows that for most purposes, what people are used to on a daily basis using their systems
collaborating with each other, et cetera, it is, in fact, possible to do it. I think
the user interface is far more consistent than if you compare this to a hot pot of different
cloud services with different login systems, different access control systems. Again, predictable
and controllable cost, you know how much it's going to cost when you start the month
compared to how much it's going to cost at the end. I think you end up spending less
time managing access control. You just have this one list of groups and members. You look
at who is a member of the group, you know what access they have, and you also know that
if you take them out of the group, they will cease having that access. That way, you also
lose less time on people not being able to access things that they need for their jobs.
So as part of writing this talk, I was setting up the megacorp.icu, various containers, et
cetera, and taking some of the containers that I was ready running in production, kind
of filing off the serial numbers of the specific things that I used them for. And I realized
that maybe these could be useful for other people as well. So I created a GitHub project
called megacorp.icu that has the containers that were used in this talk in it, as well
as some of the tools that I used to manage this. Perhaps if other people are interested
in running their own infrastructures in at least somewhat the same way that I'm proposing,
perhaps we can do some kind of collaboration with each other and do sort of CS admin support
group, I don't know. So questions, I think I'm a little ahead of where I was supposed
to be, but maybe there will be a lot of questions. A little plug, because I was just told that
you should always be selling. My company, Romatuck, is actively hiring people. So if
any of this sounds like it could be you, please contact me.
Okay, so we've got one roving microphone for questions, but we're going to go online first,
because there's some online questions. Yeah, the chat's blowing up with this question
right here. What do you think about so-called totally automatic solutions like Unohost or
Sandstorm? Would they also be sufficient for a small business?
So I actually started off using Sandstorm, but found that the access control that Sandstorm
offers is actually not quite... So with Sandstorm, what usually ends up happening is that you
deploy different instances of the same application that different people will have access to.
What I found is that moving people between groups didn't work properly for that, specifically
if somebody gets kicked out of a container, sharing things between things tended to get
a little weird. I would say that if it works for you, use it. It didn't work for me personally.
So I have another happy story. I started with a small startup. I was the assistant administrator.
I set up. Okay, close up the question, please.
So I started to install all the false infrastructure. It was beautiful. Next cloud, we had Aldo
and many other things. And then the company got bigger, and then the president of the
company said, I don't like how next cloud link calendars to email. And so the next month,
we switched to Google Doc completely entirely and that's where all my work of two years
and I cried. So how do you do with the users? I mean, you are the boss. I'd love to have
you as my boss. But how do you convince users actually to comply?
Well again, do you need me to repeat the question? So in my case, none of that really applies
because I am the boss of these companies. I'm the CEO of both. So to a certain extent,
if you don't like it. But in practice, people tend to do like it. Of course, if you have
someone that says, okay, I only know how to use this one thing and I refuse to use anything
else, if that person is the CEO of the company, that is a problem. I don't really have a good
answer for you other than yet try to convince them that there are some benefits to this.
I mean, in the end, it's their money, right? So if they're willing to pay $30, $40 a month
per user because they don't like how these things are linked, there is only so much you
can do at some point. Okay, we're going to take an online question
and then I'm going to go over there for the next question. Keep your hands up if you want
to ask a question. I've got a chance to keep an eye on you.
Okay, so what do you think of Cloudron? So can you repeat the question, please?
What do you think of Cloudron? I'm not familiar with that.
Have you heard of Cloudron? Are you aware of co-op cloud? That's another question on
the... I am not, no.
All right, some good ideas here from the people.
What do you use for documentation? Can you repeat the question, please?
What do you recommend for documentation, like an alternative for conference or notion?
So it's the question, what do you use for video conference?
No, no, no, for documentation, internal documentation for the company.
Oh, what do you use for internal documentation for the company?
Yes. Yes.
So in the case of pre-hensile tails, I use X-Wiki, which also integrates beautifully
with this whole thing. People get access to subpages based on group memberships, etc.
For user documentation, that's not intended to be changed.
So I wrote a little manual on how to do certain simple things on the mail server. Those are
just files that are in a shared folder on the next cloud that everyone has access to.
Thanks for the talk. Very interesting. One question, I guess, all your services are
publicly available. So does Keycloak support something like a two-factor authentication?
Yes. Keycloak does support two-factor authentication. You can simply add, actually, let's not do
a demo for something I haven't looked at. I will not make that mistake. But yeah, you
can add an authenticator app to your account on Keycloak. And I do that for myself, because
my account tends to have admin privileges, etc., on a lot of stuff. It is possible to
also configure Keycloak such to make it mandatory for every user that logs in to set up a two-factor
with an authenticator app. But yeah, so that's one thing to keep track of though, because
this is something that can, in fact, take you, lose you a lot of time. If you do set
it up, make sure you have an MTP client running on all your servers, because that's going
to take you a while to figure out. Yes.
I have a question. How do you deal with security since you're running NextCloud and Keycloak
on premise? You said in some slides before that you update your systems, like, between
12 and 18 months. That is not a problem. But then again, security issues, like, rapidly
rise up. And especially if you're on the public internet or facing the public internet, you
run into, well, huge risks when you are not on the problem at hand.
I mean, huge risks, sure, in the sense that if a worm were to be developed that goes through
Keycloak directly and it doesn't get patched until it is all wild over the internet, then
that might be a problem, yeah. But in the actual, so far, security updates for things
like Keycloak, NextCloud, et cetera, they come out of cadence of once every month, month
and a half. You basically just tell your podman container stack to pull the new images and
you restart them. It's two, three minutes of work, usually. So again, it is a concern,
but it's not something that's going to, it's not going to be your job to deal with this.
It's two minutes, three minutes to install more security updates most of the time.
Okay. So the question is, how do you know that you need to update something? I just
run these pools and updates like every two, three weeks because I like you pointed out
I don't want it to be my job to figure out all of the security updates that are available
for everything. So I just install everything every couple of weeks.
Next question is, can you use Purely Foss for the non-engineering aspects of the company?
For example, accounting software that is compliant with state requirements for regular digital
submission. So the question is, can you use it for things like administrative software
and stuff? I frankly don't know because I cheat in that regard is that I have an accountant
and every month I send them an email with a pile of PDFs in it and then I get a PDF
back that says how much taxes they have to pay or return. So I don't know. I don't have
the answer to that question. But hiring an accountant, a good idea if you're ever at
a size of one or two people, just get an accountant.
Thanks for the presentation. So since the keyword here is to keep things simple, I believe
in Key Clock you can have all the users created locally and have them in Key Clock. What's
the benefit of having LDAP behind that to keep track of the users and having all the
information is why? If you want to keep things simple, why not just create local users? Because
then you end up with the same problem that you started with, with different cloud tools.
Now you have to manage individual access to different tools yourself again. The fact that
there is a group of human resources that easily works across all the systems means that the
mail server knows who's a member of human resources, next cloud knows who's a member
of human resources, and what else? And RocketChat knows who's a member of human resources. It
just lowers the burden to take that one little bit of extra complexity. In return you get
back this one single thing you have to administer instead of figuring out how to do that across
multiple things. Also from a purely practical point of view, most programs will support
LDAP. Fewer and fewer programs now support things like PAM or anything like that. The
LDAP kind of is what PAM used to be in that respect for good or bad.
You've been talking about using this in small or small age companies. Do you foresee at
which point this would not work anymore? In terms of size of the company?
I think there's going to be an inflection point specifically when vertical scaling stops
to work. If I need more than one piece of hardware to run all of the chat users on,
I think at that point it's going to be a problem. If I get so many files that I cannot reasonably
store them any longer on a server that you can reasonably rent, I mean right now you
can get a rate one NVMe server where it's two times four terabytes of disk space for
like a hundred bucks a month. Once things like that stop scaling, I think that is when
you might start to have a problem. The way I think about that though is by the time I
have that problem, I will also probably have enough people to get a sysadmin to figure
that stuff out for me. How often have you had to report or fix bugs
in the stack that you're using? How often do you have to fix and report bugs?
So that is exactly how often I don't know. I'm not going to lie that it happens with
some regularity. I currently have a bug open with NextCloud, for instance, that sometimes
the avatar icons disappear. That is annoying. Things like that are annoying. But then again,
I also have had bugs open for pieces of software I've paid for that are never fixed. It's
not a panacea, I believe is the word you, is how you pronounce that. But it's not something,
it's not like the things are constantly breaking and I'm constantly fixing things, absolutely
not. A minute ago there was a question up here.
Has it gone away? Just in this front block here. No, right, okay, we'll go over here.
We'll see if it works. Somebody's getting some stabs.
Hi, thanks. That was a really good talk. Like everything that you did say. On the point
about accounting, that was one of the things I was hoping you might cover. So I was just
going to ask if maybe there's anyone else in the room who does do their own bookkeeping
and tax submission and knows free software that can do that in European or particularly
UK contexts. So I think the question is, is there anyone
in the room who does know how to do open source accounting? Because it's certainly not me.
That has a second vote from me as well. Anyone?
Hold up, hand up. PRP next, you say? PRP next. It's not low. Every regulation is in it.
You have to build it yourself, but ERP next is an open source solution to manage your
accounting stuff. Cool, thank you.
Did we have more questions? How much time is needed on average per month
to set up the infrastructure and maintain it? So setting up the infrastructure, well,
I felt like it wasn't too much work to set up an entirely new infrastructure just for
this talk. So I mean, it should give you some indication that it's not like a weeks long
process. As in how much time does it take me per month
to run this? It is a little bit variable. So just installing
steady security updates and just keeping those things running maybe. So it's never consecutive,
right? I think it's fair to say that I spent about an hour a month maintaining the infrastructure.
I don't think I spent a whole lot more than that. Of course, this number can ramp up rather
dramatically if you get a hardware failure. Like a broken hard drive in a server can now
mean that you have to spend two, three hours talking with your data center people, planning
to get the disk replaced, waiting for the disk to be replaced, putting it back in your
rate set. So at that point, you might lose a couple more hours. But yeah, it's in the
order of hours per month, not days. Hi. Have you tried to do it in high availability?
So do you have any problems with like a next layer of the complication? If you have one
key clock in machine A, the second key clock on machine data center B, what's your idea
here? Because if you use, I don't know, Google, it's just one Gmail comment. Yeah, you are
fine. Yeah, so the question is what do you do about redundancy? So that's actually one
of those things where it's very easy to fall into a trap and which is kind of what this
talk was hoped to be about. Is it you don't really need that most of the time? Make sure
that your data is safe. But if you have a company of 10, 15, 20 people, if people can't
log in in the middle of the night, it means that you're also sleeping and all your employees
are also sleeping. So it's not, this is not something that worries me at all. It's not
to say that, again, not to say that you should never worry about it, not saying that anyone
who does worry about it is wrong. But just in the type of deployment that I'm talking
about, a couple of hours downtime is not the end of the world. And we've seen it's not
the end of the world because Azure just went down for like seven hours and, you know, we're
all still here. Okay. Thank you all very much. Thank you, HP, for your talk. That's a great
answer to your question. Thank you for coming.