At Cantarus we deal
with several large DNN websites and develop custom solutions containing large
numbers of modules. We found the deployment process to Live DNN Websites with
solutions of this size to be overly cumbersome so we created a new deployment
platform, PolyDeploy.
PolyDeploy aims to bring deployment convenience back to DNN
developers so that deployments can once again be quick and easy. In addition, we aim
to add additional improvements to allow more flexible deployment solutions.
This includes remote and automated deployments that can be performed by your
continuous integration solution to help streamline the development process.
Why we Created PolyDeploy
Seasoned DNN developers will no doubt have experience of
installing many modules at once by placing their module install files in the
[websiteroot]/Install/Module/ directory and calling [domain]/Install.aspx?Mode=InstallResources.
It was the only efficient way to install many modules together while avoiding
multiple AppPool restarts.
This was not 100% reliable and getting feedback on failed
deployments from an automated process was difficult. It was therefore difficult
to use install.aspx as part of a continuous delivery pipeline.
Unfortunately, due to a security exploit within Install.aspx
it is now removed after the installation of DNN is complete. This leaves the
installation of large numbers of modules a tedious and time consuming task,
fraught with possible human error such as modules being missed or installed out
of order.
PolyDeploy aims to provide stress free automated or manual deployments
that incur less downtime, are secure from end-to-end and are fully auditable.
Features
Security
PolyDeploy has been architected with security in mind from the very beginning. There are
multiple mechanisms in place to prevent the unauthorised use of PolyDeploy to
defend against attackers deploying modules. PolyDeploy combines several
security mechanisms into a comprehensive security strategy. These measures
include:
- IP Whitelisting
- Host Only User Interface
- API Key Authentication
- Encryption of Traffic
Local or Remote Deployments
PolyDeploy
can be used in two logically distinct modes:
Using the Integrated UI on
the website. This allows installation of modules as part of attended
deploys and effectively replaces the in-built DNN Extension installation
wizard. This UI also provides management settings for key generation, IP
whitelisting and the PolyDeploy event log.
Using a Local Client to upload modules
remotely. PolyDeploy comes bundled with a command line tool that can be used as
part of a CI/CD process, module build change or via the command line from any
remote computer that has been IP whitelisted. Due to its remote nature the
local client is subject to more stringent security protocols.
Dependency Detection
When you upload modules through PolyDeploy, it examines the modules' dependencies and
ensures that they can be met. Dependencies are checked against modules that are
already installed as well as modules that are included as part of the current
deployment session. PolyDeploy is also able to detect circular dependencies in
modules and will prevent a deployment from starting if a circular dependency is
found.
During the dependency checks, modules in the deployment session are placed into a suitable
installation order. Modules will only be installed after the modules they
depend on have been installed. For example, if I add Module A and Module B to a
deployment session and Module B has a dependency on Module A, PolyDeploy will
make sure that Module B is installed before Module A during the deployment.
Auditability
PolyDeploy logs events to the DNN Event Log and its own separate log, this is combat the
clearing of the DNN EventLog in the event of an attacker gaining access to the
system. PolyDeploy logs all sessions, module installs, attempted module
installs, authentication or encryption failures when using the API. This gives
administrators notice that their DNN instance is under attack.
Benefits
At Cantarus we have been using PolyDeploy for several months
and have seen an observable reduction in downtime, an average of 50% in the
overall deployment process and a 10x decrease in module installation time over
installing each module individually.
We have also been able to use continuous delivery to
streamline our development and testing processes. Using PolyDeploy as soon as a
development task is finished it is built, tested and deployed to a staging
environment where it can be immediately tested rather than being eventually
deployed as part of a bundle. This ensures that even if an issue fails testing,
it fails quickly and can be passed back to the developer while it is fresh in
their mind.
Donation to the Community
We are donating PolyDeploy to the Open Source DNN community because
we believe that the entire community can benefit from a secure and reliable
deployment process. To echo the messages conveyed at DNN Summit recently we
view the DNN Community as key in keeping the entire DNN ecosystem thriving.
Poly Deploy is available, free of charge, on GitHub and soon on the
DNN Store.