DevOps Bootcamp
— Complete Notes

Phase 1 — Foundation (must before anything else)
  Linux basics → Terminal, files, users, processes, networking
  Git → Version control, branching, GitHub

Phase 2 — Scripting & Automation
  Bash scripting → Loops, conditions, cron, functions
  Python basics → Scripts, boto3, file parsing

Phase 3 — Containers
  Docker → Images, containers, Dockerfile, Compose
  Podman → Rootless containers, RHEL environments

Phase 4 — CI/CD
  GitHub Actions → Workflows, triggers, secrets
  Jenkins (optional) → Older pipelines, enterprise

Phase 5 — Infrastructure as Code
  Terraform → Cloud provisioning, state, modules
  Ansible → Server configuration, playbooks, roles

Phase 6 — Cloud
  AWS → EC2, VPC, S3, RDS, IAM, Lambda, CLI

Phase 7 — Orchestration
  Kubernetes → Pods, deployments, services, kubectl

Phase 8 — Monitoring & Observability
  Prometheus + Grafana → Metrics, dashboards, alerts
  Loki → Log aggregation

Phase 9 — Advanced
  GitOps / ArgoCD → Declarative K8s deployments
  Secrets Management → Vault, AWS Secrets Manager

# Process management — what's running, what's eating CPU
ps aux | grep docker
top / htop
systemctl status nginx
journalctl -u nginx -f --since "1 hour ago"

# Network — what's listening, what's connecting
ss -tulnp                    # open ports
curl -I https://example.com  # test HTTP endpoint
netstat -rn                  # routing table

# File operations DevOps engineers use constantly
tail -f /var/log/nginx/access.log   # watch logs live
grep -r "ERROR" /var/log/           # search logs
find / -name "*.conf" 2>/dev/null   # find config files
sed -i 's/old/new/g' file.conf      # replace in file
awk '{print $1}' access.log         # extract columns

# Permissions DevOps needs
chmod 400 ~/.ssh/id_rsa             # SSH key — must be this
chmod +x deploy.sh                  # make script executable
chown -R nginx:nginx /var/www/      # web server ownership

# Disk & performance
df -h                               # disk usage
du -sh /var/lib/docker              # docker using how much?
free -h                             # RAM usage
iostat -x 1                         # disk I/O live

# First time setup
git config --global user.name "Kamran Kabeer"
git config --global user.email "kamran@devriston.com.pk"

# Clone a repo
git clone https://github.com/muhammadkamrankabeer-oss/repo.git
cd repo

# Create a feature branch — never work directly on main
git checkout -b feature/add-nginx-config

# Make changes, then commit
git add nginx.conf
git commit -m "feat: add nginx virtual host config for devriston.com.pk"

# Push branch to GitHub
git push origin feature/add-nginx-config

# On GitHub: open Pull Request → review → merge to main

# Common fixes
git log --oneline          # see commit history
git diff                   # see what changed
git stash                  # temporarily save uncommitted changes
git stash pop              # restore stashed changes
git reset --hard HEAD~1    # undo last commit (dangerous — use carefully)

#!/bin/bash
set -euo pipefail  # exit on error, unset var, pipe failure

# Variables
APP="nginx"
ENV=${1:-"staging"}    # first argument, default "staging"
DATE=$(date +%Y%m%d)

# Conditions
if systemctl is-active --quiet $APP; then
  echo "$APP is running"
else
  echo "$APP is down — restarting"
  systemctl restart $APP
fi

# Loops
SERVERS=("web-01" "web-02" "web-03")
for SERVER in "${SERVERS[@]}"; do
  echo "Deploying to $SERVER..."
  ssh deploy@$SERVER "cd /app && git pull && systemctl restart app"
done

# Functions
check_disk(){
  local THRESHOLD=80
  local USAGE=$(df / | awk 'NR==2{print $5}' | tr -d '%')
  if [ "$USAGE" -gt "$THRESHOLD" ]; then
    echo "WARNING: Disk at ${USAGE}%"
    return 1
  fi
}

# Error handling
deploy(){
  git pull origin main || { echo "Git pull failed"; exit 1; }
  docker compose up -d --build || { echo "Docker build failed"; exit 1; }
  echo "Deploy successful"
}

check_disk && deploy

# Images
docker pull nginx                    # download image
docker images                        # list local images
docker build -t myapp:v1 .           # build from Dockerfile
docker rmi myapp:v1                  # delete image

# Containers
docker run -d -p 80:80 --name web nginx   # run in background
docker ps                                 # list running containers
docker ps -a                              # all containers (including stopped)
docker stop web && docker rm web          # stop and delete
docker exec -it web bash                  # shell inside container
docker logs web -f                        # follow logs

# Dockerfile example
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt --no-cache-dir
COPY . .
EXPOSE 8000
CMD ["python", "app.py"]

# Docker Compose — multi-container apps
docker compose up -d       # start all services
docker compose down        # stop and remove
docker compose logs -f     # follow all logs
docker compose ps          # service status

# Install on RHEL/AlmaLinux
dnf install podman podman-compose -y

# Commands are identical to Docker
podman pull nginx
podman run -d -p 80:80 --name web nginx
podman ps
podman logs web -f
podman exec -it web bash
podman stop web && podman rm web

# Build image
podman build -t myapp:v1 .

# Run as systemd service (Podman feature — Docker can't do this easily)
podman generate systemd --name web > /etc/systemd/system/web.service
systemctl enable --now web

# alias docker=podman (makes all your docker scripts work)
echo "alias docker=podman" >> ~/.bashrc

Code Push (git push)
     │
     ▼
[1] Source Stage
     └─ Checkout code from repo

[2] Build Stage
     └─ Compile code, build Docker image
     └─ Run: docker build -t myapp:$COMMIT_SHA .

[3] Test Stage
     └─ Unit tests, integration tests, linting
     └─ Run: pytest tests/ or npm test

[4] Security Scan (optional but recommended)
     └─ Trivy scan Docker image for CVEs
     └─ SonarQube for code quality

[5] Push Stage
     └─ Push Docker image to registry (ECR, DockerHub)
     └─ docker push myapp:$COMMIT_SHA

[6] Deploy Stage
     └─ Update server or Kubernetes with new image
     └─ Run: kubectl set image deploy/app app=myapp:$COMMIT_SHA
     └─ Or: ssh server "docker compose pull && docker compose up -d"

[7] Verify Stage
     └─ Health check — is the app responding?
     └─ curl -f https://myapp.com/health || rollback

# .github/workflows/deploy.yml

name: Build, Test and Deploy

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      # 1 — Checkout code
      - name: Checkout
        uses: actions/checkout@v4

      # 2 — Run tests
      - name: Run Tests
        run: |
          pip install -r requirements.txt
          pytest tests/ -v

      # 3 — Log in to AWS ECR
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ap-south-1

      # 4 — Build and push Docker image
      - name: Build and Push to ECR
        run: |
          ECR_URI=123456789.dkr.ecr.ap-south-1.amazonaws.com/myapp
          aws ecr get-login-password | docker login --username AWS --password-stdin $ECR_URI
          docker build -t $ECR_URI:${{ github.sha }} .
          docker push $ECR_URI:${{ github.sha }}

      # 5 — Deploy to EC2
      - name: Deploy to EC2
        run: |
          ssh -i key.pem ec2-user@${{ secrets.EC2_IP }} \
            "cd /app && docker compose pull && docker compose up -d"

# main.tf

terraform {
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# VPC
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  tags = { Name = "devriston-vpc" }
}

# Public Subnet
resource "aws_subnet" "public" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "ap-south-1a"
  map_public_ip_on_launch = true
}

# EC2 Instance
resource "aws_instance" "web" {
  ami           = "ami-0abcdef1234567890"
  instance_type = "t2.micro"
  subnet_id     = aws_subnet.public.id
  tags = { Name = "web-server", Environment = "staging" }
}

# Commands
# terraform init     → download providers
# terraform plan     → preview what will be created
# terraform apply    → create the infrastructure
# terraform destroy  → delete everything

# inventory.ini — servers to configure
[webservers]
web-01 ansible_host=192.168.1.10
web-02 ansible_host=192.168.1.11

[all:vars]
ansible_user=ec2-user
ansible_ssh_private_key_file=~/.ssh/id_ed25519

# playbook.yml — what to do on those servers
---
- name: Configure Web Servers
  hosts: webservers
  become: yes          # sudo

  tasks:
    - name: Install Nginx
      dnf:
        name: nginx
        state: present

    - name: Start and enable Nginx
      systemd:
        name: nginx
        state: started
        enabled: yes

    - name: Open firewall for HTTP
      firewalld:
        service: http
        permanent: yes
        state: enabled
        immediate: yes

    - name: Deploy index.html
      copy:
        content: "<h1>Deployed by Ansible</h1>"
        dest: /var/www/html/index.html
        owner: nginx
        mode: '0644'

# Run the playbook
ansible-playbook -i inventory.ini playbook.yml

# Check syntax before running
ansible-playbook playbook.yml --syntax-check

# Dry run — see what would change without changing it
ansible-playbook playbook.yml --check

# deployment.yml — run 3 replicas of nginx
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.25
        ports:
        - containerPort: 80

---
# service.yml — expose deployment to traffic
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
    - port: 80
      targetPort: 80
  type: LoadBalancer

# Apply and manage
kubectl apply -f deployment.yml
kubectl get pods
kubectl get services
kubectl describe pod nginx-deployment-abc123
kubectl logs nginx-deployment-abc123
kubectl delete deployment nginx-deployment

# docker-compose.yml
services:
  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
    ports:
      - "9090:9090"

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=devriston123

  node-exporter:
    image: prom/node-exporter:latest
    ports:
      - "9100:9100"

  loki:
    image: grafana/loki:latest
    ports:
      - "3100:3100"

# prometheus.yml — what to scrape
scrape_configs:
  - job_name: 'node'
    static_configs:
      - targets: ['node-exporter:9100']
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']

# Useful PromQL queries
# CPU usage %
100 - (avg by(instance)(rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)
# RAM used %
(1 - node_memory_MemAvailable_bytes/node_memory_MemTotal_bytes) * 100
# Disk used %
(1 - node_filesystem_avail_bytes/node_filesystem_size_bytes) * 100

# workstation.yml
---
- name: Setup DevOps Workstation
  hosts: localhost
  become: yes

  vars:
    terraform_version: "1.8.0"
    kubectl_version: "v1.29.0"

  tasks:
    - name: Install core tools
      dnf:
        name:
          - git
          - python3
          - python3-pip
          - curl
          - wget
          - unzip
          - jq
          - vim
          - htop
        state: present

    - name: Install Docker
      block:
        - dnf: name=docker state=present
        - systemd: name=docker state=started enabled=yes
        - user: name="{{ ansible_user }}" groups=docker append=yes

    - name: Install AWS CLI
      shell: |
        curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
        unzip -q /tmp/awscliv2.zip -d /tmp
        /tmp/aws/install --update
      args:
        creates: /usr/local/bin/aws

    - name: Install Terraform
      unarchive:
        src: "https://releases.hashicorp.com/terraform/{{ terraform_version }}/terraform_{{ terraform_version }}_linux_amd64.zip"
        dest: /usr/local/bin/
        remote_src: yes
        mode: '0755'

    - name: Install Ansible
      pip:
        name: ansible
        state: present

# Run it:
ansible-playbook workstation.yml --ask-become-pass

# 1 — boto3: stop all dev EC2 instances
import boto3

ec2 = boto3.client('ec2', region_name='ap-south-1')
reservations = ec2.describe_instances(
    Filters=[{'Name':'tag:Env','Values':['dev']},
             {'Name':'instance-state-name','Values':['running']}]
)['Reservations']

ids = [i['InstanceId'] for r in reservations for i in r['Instances']]
if ids:
    ec2.stop_instances(InstanceIds=ids)
    print(f"Stopped: {ids}")

# 2 — Parse JSON config file
import json

with open('config.json') as f:
    config = json.load(f)

db_host = config['database']['host']
print(f"Connecting to {db_host}")

# 3 — HTTP health check
import requests
import sys

def health_check(url):
    try:
        r = requests.get(url, timeout=5)
        if r.status_code == 200:
            print(f"✓ {url} — OK")
        else:
            print(f"✗ {url} — {r.status_code}")
            sys.exit(1)
    except requests.exceptions.ConnectionError:
        print(f"✗ {url} — UNREACHABLE")
        sys.exit(1)

health_check("https://devriston.com.pk")

# 4 — Read environment variables (secrets)
import os

DB_PASSWORD = os.environ.get('DB_PASSWORD')
if not DB_PASSWORD:
    raise ValueError("DB_PASSWORD environment variable not set")

# Store a secret
aws secretsmanager create-secret \
  --name "prod/myapp/db-password" \
  --secret-string "SuperSecurePassword123!"

# Retrieve in your app (Python)
import boto3, json

def get_secret(secret_name):
    client = boto3.client('secretsmanager', region_name='ap-south-1')
    response = client.get_secret_value(SecretId=secret_name)
    return json.loads(response['SecretString'])

secret = get_secret("prod/myapp/db-password")
db_password = secret['password']

# GitHub Actions — use secrets in workflow
# Add in repo Settings → Secrets → New secret
# Then use in workflow:
env:
  DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

# Install ArgoCD in Kubernetes
kubectl create namespace argocd
kubectl apply -n argocd -f \
  https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Get admin password
kubectl get secret argocd-initial-admin-secret \
  -n argocd -o jsonpath="{.data.password}" | base64 -d

# Port-forward to access UI
kubectl port-forward svc/argocd-server -n argocd 8080:443

# Create an ArgoCD Application (YAML)
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/muhammadkamrankabeer-oss/myapp
    targetRevision: main
    path: k8s/              # folder with K8s YAML files
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true          # delete resources removed from Git
      selfHeal: true       # revert manual kubectl changes

# Now: push a change to k8s/ folder → ArgoCD deploys it automatically