Building VMs?

I can map most of the list but I can't recall what would be the "review environment setup" What did you mean by that?

Pedantically I think GLCI treats every environment the same, but by review environments I meant "disposable copies of the app such that one could interact with it during merge request review" e.g. https://mr-8675.example.com corresponding to /example/-/merge_request/8675 that would be provisioned when the MR was opened and torn down when the MR was merged or closed

<https://docs.gitlab.com/ci/yaml/#environment> plus <https://docs.gitlab.com/ci/yaml/#dynamic-environments> et al

I believe it aligns with this behavior in GitHub: <https://docs.github.com/en/actions/how-tos/deploy/configure-...> with the distinction that it appears from the GH docs that they think of that as "needs administrative approval" whereas GLCI thinks of it as "if the pipeline has permissions to run provisioning, off to the races, because names are free"

GitLab introduced the "deployment tier" I think as a means of communication to other users about the importance of the environment, but control over what credentials were made available to CI/CD was always controlled via <https://docs.gitlab.com/ci/environments/#limit-the-environme...> which partially explains why the only reason to involve a repository administrator would be to install or update a secret needed to deploy successfully

---

it the spirit of "they really, really drink their own champagne," one can see the environments for GitLab itself https://gitlab.com/gitlab-org/gitlab/-/environments

Any recommendations on a rowing machine?

The C2 machine is fine, I use it regularly in a nearby studio besides other training and it's perfect for training. If the studio wouldn't be easily available I would buy a C2. And, by the way, my wife too started to be an avid rower after giving the machine a try.

I was rowing on real boats during my school and university days, but sadly never found the time afterwards to get join a club and row in teams.

Rowing machines with a water container are en vogue, but they are heavier (if filled with water) need regular water maintenance and the training effect isn't better.

Edit: here's a good intro to using such a machine: https://www.youtube.com/watch?v=zHHy0KpFKvE

I think you might be underselling the C2. I only ever row occasionally, but it is my understanding that it is the BIFL model. The type most gyms will buy - way more utilization hours than you will ever hit at home.

Came into this thread looking for a mention of Steve Mann! Man was ahead of his time. More on his 'Visual Filter' and more here http://www.wearcam.org/ieeecomputer/r2025.htm

This sounds fascinating and absolutely alien to me, a Python dev. Any good books or other sources to learn more you can recommend?

You can start here, https://wiki.osdev.org/Expanded_Main_Page

Also regardless of what others say, you can have a go trying to feel how it was to use BASIC in 8 bit computers to do everything their hardware exposed, or even 16 bit systems like MS-DOS, but with Python.

Get a ESP32 board, and have a go at it with MicroPython or CircuitPython,

https://docs.micropython.org/en/latest/esp32/quickref.html

https://learn.adafruit.com/circuitpython-with-esp32-quick-st...

There's always the Minix book!

I apologize this is not directly related to OP, but if you, like myself, get mad at all the "Suggested" posts LinkedIn is pushing on you, you can use the following ublock filter to get rid of these posts:

    www.linkedin.com##:xpath(//span[text()="Suggested"]//ancestor::div/div[contains(@data-id, "activity")])

Combined with carefully managing who I actually follow, it made it for a much more pleasant experience.

here's my cosmetic filter:

  www.linkedin.com##.scaffold-finite-scroll--infinite.scaffold-finite-scroll:matches-path(/feed)
  www.linkedin.com##.feed-follows-module:matches-path(/feed)
  www.linkedin.com##div.mb2 > .artdeco-card

my problem with the wall isn't like with youtube where it's distracting and inviting to waste my time. it's more that most of the posts are so utterly dumb and self-aggrandising that it just makes me angry. thank god for ublock.

Yes I get mad at these posts, and then even madder at me for scrolling through the feed in the first place. But this is great, thanks!

Thank you this makes it so much better!

Another option is Settings & Privacy > Preferred Feed View > Most recent posts.

This is great!

thank you.

> whereas managers are seen as useful in different domains, giving them practical mobility

And this is exactly my problem with becoming a manager. You become fungible, easily replaceable, movable and fire-able.

And they are the people who decide whom to fire.

I worked for a medium size company that served, and still is, ~150 clients (some Fortune 500 included) by deploying prod with docker-compose. It can be done.

> the QA env was not actually setup to mirror the production env

As senior QA, this alone is going to end me one day.

We use Fernet[1] or Ansible vault[2] with the encrypted secrets committed to the code repositories, but I guess we can do that because the code is not public.

The rest we share over a secure, company approved, channel, and save them into local KeePass-es (KeePassXC)

[1] https://docs.ansible.com/ansible/latest/vault_guide/index.ht...

[2] https://cryptography.io/en/latest/fernet/

Is the ansible vault password in the repo too?

Also, anytime I put an ansible vault secret into Bitbucket, I get a yelly email back from BB about “detected secreted in repo!”

So general question, is this within security standards or is it very bad and should be using off-the-repo secret infra like Hashicorp vault etc? Downside there is have to manually update the secrets on Hashi vault side (eg they are not in code/repo) and you still have to have some visibility to the hashi key in any case in your CI/CD/code/ansible in any case right?

Commiting the passwords for decrypting Ansible vaults would render the encryption useless and you should consider all secrets already in the vault when committing and pushing the vault password compromised. Makes for a couple of fun days, if it happens.

Right that’s why I asked OP.

> Is the ansible vault password in the repo too?

No no, this is one of those secrets we share among the team and save to KeePass or whatever.