FTM402 · Infrastructure, Deployment, Security & Ops
Learning materials — teaching, weekly quizzes, weekly tests. Examination paper — timed paper with marking guide.
Credits 8 · Hours 80 · Prereqs FTM301, CS202 · Semester 4
Source material
Section titled “Source material”No university course covers this stack. The real references are upstream docs and one free book:
- nix.dev tutorials — https://nix.dev/tutorials/ (first steps, Nix language basics, packaging, module system), plus https://nix.dev/tutorials/nixos/provisioning-remote-machines.html for the deploy loop
- NixOS manual — https://nixos.org/manual/nixos/stable/ (configuration, administration, service modules incl. PostgreSQL, ACME, BorgBackup)
- Colmena — https://colmena.cli.rs/unstable/ (node tagging, parallel deploy, secrets; upstream README warns error reporting is lacking)
- Nix Pills — https://nixos.org/guides/nix-pills/ (pill 01 for the store model)
- Google SRE Book — https://sre.google/sre-book/table-of-contents/ (ch. 4 SLOs, 6 Monitoring, 10 Practical Alerting, 13 Emergency Response, 14 Managing Incidents, 15 Postmortem Culture)
- Site Reliability Workbook — https://sre.google/workbook/table-of-contents/ (ch. 2 SLOs, 5 Alerting on SLOs, 9 Incident Response, 10 Postmortems)
- Loki docs — https://grafana.com/docs/loki/latest/ (labels vs structured metadata, cardinality explosion, LogQL)
- nginx docs — https://nginx.org/en/docs/ (Beginner’s Guide → HTTPS servers →
load balancer →
proxy_module→limit_req) - MIT 6.858 / 6.566 — https://css.csail.mit.edu/6.858/2024/schedule.html — not an ops course, but lectures 6, 15, 16 and lab 5 (ACME, WebAuthn) explain why privilege separation, TLS and supply-chain signing matter
Honest gaps in every source above: Grafana alert-rule syntax, systemd unit
hardening (ProtectSystem, NoNewPrivileges), and incident response scaled
for a three-person team (SRE assumes an incident-commander rotation). Write
those three from FTM’s own config and postmortems.
Objectives
Section titled “Objectives”- Use every devShell. Write a NixOS option without guessing.
- Deploy to staging and prod, and roll back.
- Explain how a PR gets its own environment.
- Find the log line for any request; triage an incident from signal to cause.
Weekly map
Section titled “Weekly map”| Wk | Source | Topic |
|---|---|---|
| 1 | nix.dev first steps + language | expressions, attr sets, functions, nix develop |
| 2 | Nix Pills 01 + flakes | /nix/store immutability; flake.nix, flake.lock, inputs |
| 3 | backend/default.nix | uv2nix, _pnpmDepsHash, the devShell set |
| 4 | NixOS manual, configuration | modules, options, users, firewall |
| 5 | NixOS manual, administration | systemd units, journalctl -u, nixos-rebuild switch/test/boot |
| 6 | deployment/secrets/ | agenix; root-only DDL lives in postStart, never a migration |
| 7 | Colmena docs + deployment/ | colmena apply, tags, restartIfChanged, rollback |
| 8 | nginx docs + deployment/load-balancer.nix | request routing, the main-site catch-all trap, PR previews |
| 9 | Loki docs + deployment/observability.nix | Alloy → Loki → Grafana, labels, LogQL |
| 10 | SRE ch. 4, 6, 10 + grafana-alerting/ | SLOs, alert hygiene, page vs ticket |
| 11 | SRE ch. 13–15, Workbook 9–10; MIT 6.858 lec. 6, 15, 16 | incident command scaled down; auth boundaries; secrets |
| 12 | — | Reading week |
FTM labs
Section titled “FTM labs”- L1 build the backend devShell from a cold store.
- L2 one-line deployment change, verified with
nix evalbefore deploy. - L3 answer five questions from Loki alone.
- L4 write one alert that fires and one that stays quiet; test both.
- L5 reproduce a historical incident from its logs; write the timeline.
- L6 induce connection-pool exhaustion on staging, read the traceback.
Project (capstone)
Section titled “Project (capstone)”Ship the ticket: preview → staging → prod, instrumented with a log line that proves it works, QA brief written for someone else to run, card closed.
Reading list
Section titled “Reading list”| Book | Author, year | Use | Free |
|---|---|---|---|
| How Linux Works, 3rd ed. | Brian Ward, 2021 | Boot → systemd → journald → processes → networking → containers/cgroups | No |
| Site Reliability Engineering | Beyer, Jones, Petoff, Murphy (eds.), 2016 | SLOs, alerting, on-call, postmortems; sre.google | Yes |
| The Site Reliability Workbook | Beyer et al., 2018 | The practical companion; chapters 2, 5, 9, 10 only | Yes |
| Systems Performance, 2nd ed. | Brendan Gregg, 2020 | The USE method, then CPU/memory/disk/network when something is slow | No |
| PostgreSQL 14 Administration Cookbook | Riggs & Ciolli, 2022 | Roles, monitoring, blocked queries, backups, replication | No |
| UNIX and Linux System Administration Handbook, 5th ed. | Nemeth et al., 2017 | Broad reference when a host question goes off the map | No |
Assessment
Section titled “Assessment”Coursework 45% (L1–L6) · Project 35% (capstone) · Check-off viva 10% · Exam 10%.