A collection of advices to not bang your head against the wall like I did while taming service-oriented architectures.

1. TIPS AND TRICKS FOR YOUR
SERVICE ORIENTED
ARCHITECTURE
CakeFest, San Francisco, Sep 2013

2. WARNING

3. NO
CAKEPHP
AHEAD

4. This talk is for those...

5. Stuck with the legacy

6. dealing with CRONs

7. in the need of a solid foundation

8. rely on web services

9. need a pluggable software architecture

10. SOA

11. Agenda
1. Service Oriented WHAT?!?!
2. Tips, Tricks and lessons learned (the hard way)
3. Conclusion

12. 1

13. SO(A) WHAT?

14. A software design based on discrete software
components, "services", that collectively
provide the functionalities of the larger
software application

15. You typically start with the
infamous web application
which does everything on its own

17. Then you realize that to provide
a chat system to your users
PHP might not be the best...

19. And soon you also decide,
to improve performances,
that your frontend should have its own
in-memory persistence, to be faster
and you put it into another service

21. Then, as always...

22. SCALE.

24. And eventually, your lead architect
will come up and tell you
that your Java-based chat
sucks and should be
replaced with...

25. NODEJS

27. In human-understandable words, SOA is a software design which
embraces splitting a monolithic, totalitarian software
architecture into smaller pieces, thus making them independent,
loosely coupled and more maintainable

28. Ok, but in the real world?

29. A few points...

30. DATA

31. each service might have its own data-layer, but nothing
prevents you from sharing data across the services

32. reads: abstract the data

33. WEBSERVICES

34. Services can request data to other services,
usually through WSs

35. POX

37. SOAP

39. HTTP

40. REST

41. Note to self:
check the difference
between HTTP and
REST APIs

42. Note to self:
check the difference
between HTTP and
REST APIs
(HATEOAS)

43. Note to self:
check the difference
between HTTP and
REST APIs
(HATEOAS)

44. EVENTS

45. services notify the architecture that an event has happened

46. asynchronous messaging queues

47. 2

48. TIPS AND
TRICKS

49. LEARNT THE
HARD WAY

50. 2.1 AVOID SOA

51. DIFFICULT TO TEST

52. COMPLEX

53. SOA would be
overkill for most
of the common
scenarios

54. But if you're handling
a product or a
monolithic software
stack, the added
complexity pays off
on the long run

55. 2.2 FREE
THE DATA

56. CONSIDER ELIMINATING FK CONSTRAINTS

57. A service might need to handle data with
another DBMS, so FKs are virtually impossible

58. ABSTRACT THE DATA

59. You might think in "rows" but the architecture
thinks in "resources"

60. No more FKs and
the ability of
JOINing to retrieve
some related data

61. But you choose
what perfectly fits
each service:
your transactions
over a RDBMS and
your community
over a graph DB

62. 2.3 Standardize

63. Build a vast suite of E2E tests

64. and give your developer a way to easily test

65. EVERY DEVELOPER NEEDS
THE ENTIRE ARCHITECTURE ON LOCAL

66. The architecture needs
to be installed in
~1 hour

67. Setting up VMs
is an hassle and
they are so slow!

68. go #vagrant

69. 2.4 IDENTIFY
WISELY

70. AUTHENTICATION IS KING

71. Centralized authentication = identity service

72. NEVER HANDLE CREDENTIALS IN CLEAR

73. NEVER.
man in the middle

74. NEVER.
man in the middle
SSL

75. NEVER.
man in the middle
SSL
tokenize

76. OAuth

77. OpenID

78. JWS

79. JSON WEB SIGNATURE

80. JSON WEB TOKEN

81. JSON WEB SIGNATURE

82. JAVASCRIPT OBJECT
SIGNING & ENCRYPTION

83. JOSE
http://www.thread-safe.com/2012/03/json-object-signing-and-encryption-jose.html

84. 1. The user enters the
credentials once in your
frontend
JS APP
AUTH
SERVICE
2. The JS app will forward them
to your Auth webservice
3. The Auth webservice will
then generate the encrypted
JWS and set a cookie with
its value
JS APP
4. The JS app can now just
execute calls using
that cookie

85. 1. The user enters the credentials
once in your frontend
JS APP

86. AUTH
SERVICE
2. The JS app will forward them
to your Auth webservice
JS APP

87. AUTH
SERVICE
3. The Auth webservice will then generate the
encrypted JWS and set a cookie with its value

88. JS APP
AUTH
SERVICE
4. The JS app can now just execute
calls using that cookie

89. 1. The user enters the
credentials once in your
frontend
JS APP
AUTH
SERVICE
2. The JS app will forward them
to your Auth webservice
3. The Auth webservice will
then generate the encrypted
JWS and set a cookie with
its value
JS APP
4. The JS app can now just
execute calls using
that cookie

90. setcookie($name, $jws,$ttl, $path, $domain, true);

91. setcookie($name, $jws,$ttl, $path, $domain, true);
HTTPS

92. JWS in PHP?

93. namshi/jose

94. use NamshiJOSEJWS;
$jws = new JWS('RS256');
$jws->setPayload(array(
'uid' => $user->getid(),
));
$privateKey = openssl_get_privatekey("file://path/to/private.
key");
$jws->sign($privateKey);
setcookie('identity', $jws->getTokenString());
use NamshiJOSEJWS;
$jws = JWS::load($_COOKIE['identity']);
$public_key = openssl_pkey_get_public("/path/to/public.key");
if ($jws->verify($public_key)) {
echo "EUREKA!;
}

95. use NamshiJOSEJWS;
$jws = new JWS('RS256');
$jws->setPayload(array(
'uid' => $user->getid(),
));
$privateKey = openssl_get_privatekey("file://path/to/private.
key");
$jws->sign($privateKey);
setcookie('identity', $jws->getTokenString());
use NamshiJOSEJWS;
$jws = JWS::load($_COOKIE['identity']);
$public_key = openssl_pkey_get_public("/path/to/public.key");
if ($jws->verify($public_key)) {
echo "EUREKA!;
}

96. use NamshiJOSEJWS;
$jws = new JWS('RS256');
$jws->setPayload(array(
'uid' => $user->getid(),
));
$privateKey = openssl_get_privatekey("file://path/to/private.
key");
$jws->sign($privateKey);
setcookie('identity', $jws->getTokenString());
use NamshiJOSEJWS;
$jws = JWS::load($_COOKIE['identity']);
$public_key = openssl_pkey_get_public("/path/to/public.key");
if ($jws->verify($public_key)) {
echo "EUREKA!;
}

97. use NamshiJOSEJWS;
$jws = new JWS('RS256');
$jws->setPayload(array(
'uid' => $user->getid(),
));
$privateKey = openssl_get_privatekey("file://path/to/private.
key");
$jws->sign($privateKey);
setcookie('identity', $jws->getTokenString(), ...);
use NamshiJOSEJWS;
$jws = JWS::load($_COOKIE['identity']);
$public_key = openssl_pkey_get_public("/path/to/public.key");
if ($jws->verify($public_key)) {
echo "EUREKA!;
}

98. use NamshiJOSEJWS;
$jws = new JWS('RS256');
$jws->setPayload(array(
'uid' => $user->getid(),
));
$privateKey = openssl_get_privatekey("file://path/to/private.
key");
$jws->sign($privateKey);
setcookie('identity', $jws->getTokenString());
use NamshiJOSEJWS;
$jws = JWS::load($_COOKIE['identity']);
$public_key = openssl_pkey_get_public("/path/to/public.key");
if ($jws->verify($public_key)) {
echo "EUREKA!;
}

99. use NamshiJOSEJWS;
$jws = new JWS('RS256');
$jws->setPayload(array(
'uid' => $user->getid(),
));
$privateKey = openssl_get_privatekey("file://path/to/private.
key");
$jws->sign($privateKey);
setcookie('identity', $jws->getTokenString());
use NamshiJOSEJWS;
$jws = JWS::load($_COOKIE['identity']);
$public_key = openssl_pkey_get_public("/path/to/public.key");
if ($jws->verify($public_key)) {
echo "EUREKA!;
}

100. I can't simply
use the HTTP
basic authentication,
it was so
convenient!

101. ...and flawed.
Modern apps,
modern tech.

102. All my
authenticated
traffic needs to go
through HTTPS:
it will be so
SLOW!

103. Only if you
don't know
about...

104. WebP

105. WebP
lossless compression

106. WebP
lossless compression
30% smaller than PNG

107. And if you don't
know about...

108. SPDY

109. HTTP on steroids

110. (come to my next talk)

111. (that one won't suck)

112. 2.5 EMBRACE
MESSAGING

113. Don't wait, notify instead

114. Different services can intercept an even, separately

115. If one is down, the others keep working

116. Who cares about milliseconds for notifications?

117. The human body is the bottleneck

118. Email?

119. SMS?

120. Be reliable

121. “Daemons are great”

122. “Daemons are great”
- No PHP developer ever

123. SUPERVISOR
http://supervisord.org/

124. SUPERVISE
http://cr.yp.to/daemontools/supervise.html

125. use python ;-)

126. It doesn’t matter...

127. if you talk ‫اﻟﻌﺮﺑﯿﺔ‬ ‫اﻟﺤﺮوف‬

128. Rabbit makes everyone talk the same language

129. chat
Batch processing
frontend
sync daemons
transcoding
agony
ERP
telcom

131. But I PHP

132. Monogamy
is so ‘90
“given a hammer,
everything
becomes a nail”

133. One size doesn’t fit all

134. 2.5 ALWAYS
SUNDAY?

135. Monitor in real time

136. and do retrospectives

138. Talking about retrospectives?

139. Logs are first-class citizens

140. Sharpen as
much as possible

142. Assume things
will break

143. All in all...

144. SOA is complex

145. A puzzle with more pieces

146. More things to keep in mind

147. COMPLEX
IS NOT
COMPLICATED

148. Loose coupling

149. every service is independent, not forced to the
constraints of a monolithic block

150. you have the freedom of changing or replacing services
without the hassle of touching an entire system

151. State-of-the-art defense against outages

152. Fault tolerance

153. if one of the services has an outage, the rest
of the architecture still works

154. if a service, listening for messages, is down,
the publisher doesn't get stuck

155. Cleaner architecture

156. SoC happens at architectural, not application, level and you can perform large-scale
refactorings without the fear of destroying the entire system

157. Perfect ground for advanced tooling

158. ...yawn...

159. Alessandro Nadalin

160. Alessandro Nadalin
@_odino_

161. Alessandro Nadalin
@_odino_
Namshi | Rocket Internet

162. Alessandro Nadalin
@_odino_
Namshi | Rocket Internet
VP Technology

163. Alessandro Nadalin
@_odino_
Namshi | Rocket Internet
VP Technology
odino.org

164. Thanks!
Alessandro Nadalin
@_odino_
Namshi | Rocket Internet
VP Technology
odino.org

165. Image credits
http://www.flickr.com/photos/randystiefer/6998037429/sizes/h/in/photostream/
http://www.flickr.com/photos/55432818@N02/5500963965/
http://www.flickr.com/photos/pamhule/4503305775/
http://www.flickr.com/photos/wili/1427890704/
http://www.flickr.com/photos/nickpiggott/5212959770/sizes/l/in/photostream/
http://www.flickr.com/photos/nomad9491/2549965427/sizes/l/in/photostream/
http://www.flickr.com/photos/amyvdh/95764607/sizes/l/in/photostream/
http://www.flickr.com/photos/matthoult/4524176654/
http://www.flickr.com/photos/kittyeden/2416355396/sizes/l/in/photostream/
http://www.flickr.com/photos/jpverkamp/3078094381/
http://www.flickr.com/photos/madpoet_one/5554416836/
http://www.flickr.com/photos/87792096@N00/2732978107/
http://www.flickr.com/photos/petriv/4787037035/
http://www.flickr.com/photos/51035796522@N01/111091247/sizes/l/in/photostream/
http://www.flickr.com/photos/m-i-k-e/6366787693/sizes/l/in/photostream/
http://www.flickr.com/photos/39065466@N04/9111005211/
http://www.flickr.com/photos/marchorowitz/5449945176/sizes/l/in/photolist-9iAoQ1-8s4ueH-bCWef9-bCWdPh-e48XUm-
bu67nh-a7xaEr-8wLiNh-9aYU1k-9F4VUN-dYqzr1-9vosHb-8BtFuw-8P3h2e-9tqc6M-82qpt4-7UgkBJ-dgSnfS-aJiubZ-9Xji2U-9UVpkC-
7BSh7Y-8GE54k-91GHtB-8VMHJ2-8wiwvo-aCmPCg-925Tg8-bcBv9T-dGUseY/
http://www.flickr.com/photos/blegg/745322703/sizes/l/in/photostream/
http://www.flickr.com/photos/centralasian/4649550142/sizes/l/in/photostream/
http://www.flickr.com/photos/pennstatelive/4947279459/sizes/l/in/photostream/
http://www.flickr.com/photos/tjblackwell/7819341478/
http://www.flickr.com/photos/brainbitch/6066375386/
http://www.flickr.com/photos/nnova/4215594009/
http://www.flickr.com/photos/publicenergy/2246574379/
http://www.flickr.com/photos/andrewteman/4592833017/sizes/o/in/photostream/
http://www.flickr.com/photos/beautifulrevelry/8548004964/sizes/o/in/photostream/
http://www.flickr.com/photos/denaldo/5066810104/sizes/l/in/photostream/
http://www.flickr.com/photos/picturewendy/8365723674/sizes/l/in/photostream/
http://www.flickr.com/photos/danielygo/6644679037/sizes/l/in/photostream/
http://www.flickr.com/photos/ross/7614352/sizes/l/in/photostream/
http://www.flickr.com/photos/75932013@N02/6874087329/sizes/l/in/photostream/
http://crucifixjel.deviantart.com/art/300-Wallpaper-03-66516887