13

There is an excellent document called the "Twelve-Factor App" (http://www.12factor.net/) in which the authors attempt to define the perfect way to design, build, and deploy a modern app-as-a-service.

The document is very general and in many cases the practices described are not optimal, not easily possible or in contravention of Microsoft's best practices. eg: The document discourages using config files but rather to use environment variables for config. This would seem incorrect in the .NET where it is common (best?) practice to use XML config files.

In an ideal world (i.e. forget budget/technical/skills constraints) in an organisation where the Microsoft platform has been chosen as the platform of choice for all deployments and .NET/TFS the development environment/tools of choice how would one follow the guidance in the Twelve-Factor App?

Are there any good examples of such an application (perhaps an open source one that has an excellent reference architecture)?

4
  • What steps exactly do you feel are not optimial and/or not easily done with the .NET Framework. I don't see a single one. Currently this question is very broad. Get rid of your "suggestions for tools" as that is offtopic. Jun 18, 2012 at 15:50
  • I'm not sure what you mean by "suggestions for tools". I am looking for an explanation of how one would design/build/deploy a twelve factor app if the tools are explcitly defined as Visual Studio and TFS and the platform is explicitly defined as Microsoft stack (.NET/MSSQL etc) Jun 18, 2012 at 15:56
  • 12Factor App Hi Adrian, thank you for the interesting link, I found the website pretty interesting. That said, are you sure you grokked their take on config files right? .Net config are internal app configuration, you shouldn't really use them for credentials, resource names, config strings and the sort.
    – aledeniz
    Jun 29, 2012 at 9:21
  • @aledeniz: I take your point, however don't forget that the .NET xml config files can also be used at an environment level. Ultimately they are the same files that are used to configure Microsoft environments such as IIS. That said, I agree that these wouldn't be stored in source control for the app itself. Surely storing credentials, resource URLs etc is app level config? I still like the idea of using app.config files for these with transformations as part of the deployment or installation process. It would be nice if this was neatly rolled into the tools though. (If it is I didn't know!) Jun 29, 2012 at 12:13

4 Answers 4

12
+50

I have read the part about configuration, and the authors clearly don't understand the use of configuration files in .NET. The issues they express are issues we used to have with .ini files. These issues do not exist with .NET because:

  1. A "desktop" application will have a single config file per deployment. "app.config" will exist as program.exe.config deployed to the same folder as the application.
  2. In a web application, a hierarchy of web.config files will exist, again, in well-defined locations, and with a well-defined name.
  3. The web.config transforms feature in Visual Studio 2010 permits the main configuration file to be checked into source control, along with transform files which specify how to automatically edit the main file for each build configuration (environment). All of these files may be stored in source control.
  4. While it is the default for credentials to be stored in such files (and therefore checked into source control), this is not necessary.
  5. At least in the case of web applications, the MSDEPLOY feature of IIS along with the Web Publishing Pipeline of Visual Studio 2010, permit the deployment to be parameterized. By default, this includes parameterization of connection strings, one of the main areas where credentials are likely to occur. This can be extended to include parameterization of all credentials or other sensitive data, so that developers do not have access to this information. The parameters may be filled in as part of the deployment process.
1
  • Thanks for this useful comparison of that specific aspect of the 12 factor app methodology. I have up-voted it but in reality it doesn't answer the whole question so haven't marked it as the accepted answer. Jun 28, 2012 at 10:46
8

12 Factor has 3 "requirements" for configuration.

  1. Don't store configuration in code
  2. Don't put your configuration in source control (or in a format that's likely to end up in source control). They want a "single codebase".
  3. Put your configuration in a format that's accessible to any technology stack (.NET/Java/Ruby/.. etc).

I'd say that .NET config files comply with half of these.

  1. Config files aren't in code (pass).
  2. Config files don't have to be in source control, but they often end up there (fail).
  3. Despite being in XML format and accessible to other technologies, .NET config files have a lot of .NETisms. Schema for configsections are provided by .NET types, so a Java app couldn't verify the schema. (half-credit).

While I can agree with the intent of their requirements, I think that their suggestion of Environment Variables is a bad suggestion. They chose Environment Variables because they view them as a lowest common denominator and available on all platforms, but they really might not be available on all platforms. If you're running in a partial-trust web app (common on a shared hosting platform), you might not have access to get/set environment variables.

Environment variables are set per machine. If I have to make a configuration change to my production environment I want to make it once, in one place, for all servers. Environment variables don't let you do that.

While I can see their point that you don't want secrets stored in version control that are accessible to all developers. There are definitely benefits to version controlling your configuration. When your production environment goes down because of a configuration change, it's easy to ask .. "what changed"? The audit trail left by someone just ssh'ing to a prod machine and setting an environment variable might not be so easy to trace. Having said that, I often don't store my configuration files in the same part of version control as the rest of the code. I put them in a folder that has restricted security so that only the necessary people need access. You could conceivably take that a step further and put them in a different project.

I'd be willing to bet that they violate their own rules of not putting configuration in files. For example. The first bullet point on their home page is "Use declarative formats for setup automation, to minimize time and cost for new developers joining the project;" I'm betting that all those config settings that aren't supposed to be in a file anywhere are in a chef recipe. To achieve the goal of automation, you have to persist them in some file somewhere. And I'd be surprised if someone that spent a lot of time getting a chef recipe right didn't store it in version control somewhere.

I think they could have written the configuration page differently and just said keep your configuration separate from your code. Keep it in separate files (don't embed it in code), and store it somewhere separately (don't put it in the same repository). Your deployment process will bring these back together (code and config) into one deployable package, but they should be separate until that point.

My suggestion for configuration would be to treat the configuration as an "attached resource" and store it in a backing store (a database). This makes your app tier even more stateless which is another one of their goals.

6
  • Whhy do they want application-specific configuration stored so that other applications can read it? Jun 29, 2012 at 1:37
  • I think your analysis (first 2 paragraphs) is unfair on the .NET way of doing things. XML config files are great specifically because they are technology agnostic. .NET comes with convenience types for working with these files but there's no reason why these couldn't be reproduced in your technology of choice. I like the pattern of packaging config with your code and providing defaults for configurable values. Code can halt if required when finding a default. The beauty of XML config is that you can also easily produce a config file for a specific environment as part of the deployment process. Jun 29, 2012 at 8:29
  • 1
    "Environment variables are set per machine." This is just flat-out incorrect. Even windows supports per-user environment variables.
    – GDorn
    Apr 4, 2014 at 22:14
  • 2
    Yes, you can set them per user on ONE machine, but that's even more narrow than per machine. My point was that it's hard to set an environment variable all at once on 1000 servers. Apr 9, 2014 at 17:19
  • 1
    In cloud environments (such as Cloud Foundry) it is easy to set an environment variable for all 1000 servers with one or two commands. Working in a 12-factor system is easy and straightforward when fully adopted. It can be hard to imagine the benefits if you are used to managing individual servers by hand rather than using a higher-level system to abstract that away. Jan 8, 2018 at 17:09
5

There are numerous issues with the design that I think are a bit naive.

For example in the Backing Services section they state that you should be able to swap out datastores without regard for code changes.

The problem is that in order to leverage the performance and capability benefits of any particular data store you will naturally gravitate towards utilizing the specific features of the store you've started with.

Further, not every datastore supports a common set of commands such that you could easily move from one to another. Their particular example of using MySql or CouchDB is, well, interesting because those two DB systems are conceptually very different: one is more of a traditional RDBMS, the other is document based. You can't just take your table structure and apply it directly to a CouchDB and expect to throw SQL commands at it.

Which means that you have to put a front end in place to essentially wrap each particular datastore with a set of commands exposed as a web service... Which, imho, makes development much more difficult for very little (if any) benefit.

Now, if they are limiting it down to exchanging a like server (local mysql) to a remote one (Amazon RDS) then the requirement that the datastore resources be accessed via a url is immaterial. Further the requirement that no code changes occur for that move is unnecessary as you shouldn't have to change code just to support having your exact DB running on a different server.


The above is just the first area I honestly looked at. As John Saunders said, the config one also shows a complete lack of understanding of tech like .Net. Quite frankly the whole thing looks like it was written by someone who has been in the Ruby world for awhile, and hasn't looked at what else is out there.

2
  • 2
    Thanks, Chris this is valuable criticism. Based on the answers so far from yourself, Matt and John I would suggest that the 12-factor methodology is great for "decoupled" environments with a mix of interchangeable technologies (PHP, Ruby, MySQL etc) but not for a strongly connected stack like the MS stack where each tier has benefits that can be realised by sticking to environment specific best practices. Jun 29, 2012 at 8:21
  • 5
    Chris, the example used in the Backing Services section says one should be able to swap out a malfunctioning data-store with a new instance restored from a backup. To me, this implies that it would be the same flavor of data store, as your penultimate point addresses.
    – Ryan Long
    Jul 7, 2012 at 18:14
0

I think to follow their guidance on a Microsoft Windows platform, one must have a strong understanding of the platform.

Following your lead about the 3rd factor, the suggestion of storing the configuration in the environment, we should ask ourselves what exactly are environment variables in the Windows platform. The answer is the Windows Registry. Now, I do ply my trade developing a server application which makes use of the Windows Registry, and given my role (I do care about the continuous integration, the build and the installers), I do truly hate with a vengeance that we have to use the Windows Registry, but that's what you do in the Windows platform.

Windows Registry obviously fail on the language- and OS-agnostic standard, but even if you resort to use plain vanilla environment variables, on the Windows Platform those are implemented in Windows Registry keys.

I do from time to time commit the sin of storing credentials in the SCM (by the way, in recent years mostly TFS), but never for the application itself, mostly for the build infrastructure (that is, stuff which will never be deployed on customer sites or deployments, and which is fully segregated from the application code).

You could use the app/web.config to store credentials (there are also encryption functionalities), but that's generally a bad idea.

Also, if you use a database as back-end (relational, non relational, any kind of database really), some configuration may well end up there, some configuration may even more suited to be stored there (i.e. on a multi-tenant application, you really wish to segregate tenant related configuration, and more often than not shared configuration end up lumped in a tenant 0 special store), as long as you can store and retrieve (i.e. in the Registry) the key to open the door that brings you there.

About the second question, being new to the 12factor manifesto (but from what I could read so far, not to the underlying concepts), I'd not be able to give you at this point a suggestion for a reference architecture on .Net.

UPDATE about the 2nd question

Also, about the other question, I'd say the 2nd factor, dependencies, is what may prevent us to find a good reference implementation on Microsoft platforms, if we take a literal and strict approach.

Stuffs like Windows Installer and higher level install authoring tools (Wix, InstallShield, ..) aren't really comparable with RubyGems or CPAN, and NuGet is not yet there in terms of popularity.

You could look for a reference implementation looking at NuGet feeds, even if the authors didn't knew of 12factor, the manifesto is requesting pretty sensible things, good developers will have mostly followed those or pretty similar concepts anyway.

As an example of this approach, I would advise you to give a look at Ayende's RavenDB, you may get it through NuGet, and I suspect it would tick most, if not all, the 12factor guys boxes (intro, features and source code).

3
  • Agree with you re the registry. It's a horrible way of storing config and very ugly to transport between systems. I would agree that there could be many legitimate reasons to put config in the DB especially if it is complex (i.e. A relational DBMS may be much better suited to the schema of your config data than a flat XML *.config file). I still like the idea of connection strings being stored in the config file and using trusted authentication for your DB security (why re-invent the wheel, this allows you to leverage Active Directory for managing permissions across many environments). Jun 29, 2012 at 12:24
  • Non AD envs Hi Adrian, I think one of the reasons is the software I work with get shipped to some environments on which Active Directory is not used, so we cannot just take that for granted. The other is deployment, you don't really wish your users to have to deal the config file themselves, as long as it is avoidable. We may dislike the Registry, but that's what the HKLM\SOFTWARE is for on Microsoft platforms.
    – aledeniz
    Jun 29, 2012 at 14:51
  • Autonomic I have to confess I often act as a dam trying to stop fellow developers in the teams I have worked with from using the Registy, as long as there is not an evidence of a convincing trade off. I just do like databases so much more for this sort of things, I'd not try to implement stuff like autonomic computing (research.ibm.com/autonomic/research/papers/… or en.wikipedia.org/wiki/Autonomic_computing) using only the Registry or worst the File System, but I may have a go, partial given my own limited resources, with a database backend.
    – aledeniz
    Jun 29, 2012 at 14:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.