We went to meet Damien Cavaillès, founder of WeLoveDevs.com, to talk about the strategic and technical challenges of his solution. Our approach is to better understand the specificities of our clients' businesses and how our solutions fit into their activities.

A growing solution for devs

Developers and recruiters who use WeLoveDevs.com appreciate above all being in the best conditions to meet. Each party feels valued, listened to and considered. And this leads to a number of specific features in the software product. For example, the solution is deployed several times a day, so that it can evolve with the use of the developers.

Today, WeLoveDevs is a recognised media and job site, visited by more than 90K techs who think about their careers every month. Their main challenge today is to offer them even more job offers by meeting and registering new companies one by one.

Data hosting in France and performance

To meet the needs of their clients, WeLoveDevs needs to have servers in France, and good performance, and they were not satisfied with the containerized PaaS offers, proposed by Heroku for example.

Being in France is crucial because we keep the personal data of many developers who are very demanding and they deserve it. And for performance, it's also important for SEO.

Damien Cavaillès, founder of WeLoveDevs.com

0% admin sys, 100% agility

Not wanting to be burdened with system administration, Damien has always used PaaS services. In the same logic, WeLoveDevs has therefore mainly adopted SaaS or serverless tools.

"We don't want to get up at night to do SSH and connect to a machine.
If it works on your machine, it works a few minutes later on the PaaS."

Damien Cavaillès, founder of WeLoveDevs.com

His challenge is to keep a small tech team, as agile as possible. The objective: to be able to put a feature into production within a day, after talking to a client, and therefore to keep this proximity with their clients. As a result, a solution that allows them to do without backend devs or ops suits them very well.

Why did you choose Clever Cloud?

Damien: "CleverCloud is the only player that meets our performance requirements and allows us to deploy continuously via Git. Also we didn't need to make any special efforts to adopt the platform, our NPM build was working from day one. I think we come for the deployment, but we stay for the quality of the customer service. It is technically competent, human and accessible."

"At Clever we know better what we're going to have as a machine in front of us and we're on bare-metal: an application that is on Heroku, will necessarily go twice as fast on Clever."

Damien Cavaillès, founder of WeLoveDevs.com

How did the migration go?

Damien: "GIT PUSH… That's it! We stacked things up one by one afterwards. The biggest change was adding Cloudflare and it really changed the performance of our Node server and our Wordpress."

Why use Clever Cloud?

Damien: "If you are already on another PaaS, your application will surely be faster by migrating it to Clever. And if you already have a build/deployment that is continuous and automated, you will have no effort to migrate. It costs nothing to try!"

If you too would like to test our solutions, create your Clever Cloud account or log in with your Github account here and get 20€ of free credits.

We are delighted to announce the arrival of our new support system: the Ticket Center. In order to continue to provide one of the best support services on the market, we remain attentive to our customers' feedback on our quality of service. In this context, we have received numerous requests to implement a system that better distinguishes each conversation.

We therefore considered how best to continue to provide a fast and quality service and the introduction of a ticketing system seemed to be the most appropriate solution to meet the needs and expectations of our users.

What's new

Ticket-oriented use

Now, the platform usage is more "ticket" than "chat" oriented. This allows for a unique authentication of each request to ensure better follow-up.             

Adding participants to the conversation

You can now choose to automatically add members of the relevant organisation when opening a ticket. This improves your Crisp experience by ensuring that the response from our support team is accessible to all your organisation team.

When you open a ticket :

• If you are an admin, the other admins in the organisation will be added
• If your role is different of admin, members of the organisation with the same role as you will be added

How does the Ticket Center work?

Accessing the Ticket Center from an organisation

We have integrated a new button "Contact support team" in the console, at the top of an organisation. It will allow you to open the Ticket Center directly in the context of the organisation you are in. This allows support to know at a glance which organisation you are opening a ticket for.

Accessing the Ticket Center from the console's main menu

The button used until now, which was called "talk to a human" still exists, under the name "contact support". You can find it as before, at the bottom left of the main console menu. A "Select your organisation" page will then open to allow you to specify the organisation for which you wish to create a ticket.

Create a ticket

When you open the Ticket Center, you will find the history of your previous tickets. Please note that all your previous chat conversations with support have been converted into a single ticket, so you will be able to access all your former discussions if required.

Here you can also: get information on the status of your request, view the associated conversation and open a new ticket.

Giving your feedback

Once the ticket is closed, you will receive an email as usual to give your feedback, this is the time to give us your opinion on the service that was provided to you by the support.

What it allows

With the old way of working, conversations between support and a user often contained several different topics. Today, each request counts, in a unique way, which brings : 

• Better follow-up of requests.
• A more collaborative tool, by allowing you to add participants to the conversation
• A more efficient response thanks to the unique identification of each ticket.

We are confident this new Ticket Center will allow us to continue to provide a fast and quality service. Feel free to contact us and give us your feedback and ideas regarding this new system.

You use Kubernetes in your usual workflow and you wish to keep it this way all while using Clever Cloud?
We designed the Kubernetes Clever Operator for this exact purpose! You get to keep on using the tools you're familiar with, while enjoying the performant features Clever Cloud provides, such as automatic scalability or monitoring tools.

Why a Clever Operator?

We began to work on the Clever Operator following feedbacks from some of our clients using k8s or Openshift who weren't really satisfied about the database management solutions provided by these platforms. Then, we released this operator to answer these needs and now we are proud to announce you can even find it on Operator Hub! The Clever Operator is the best way for our customers to migrate from Kubernetes or Openshift to Clever Cloud managed solutions.

How does it work?

At Clever Cloud, we provide an HTTP API to interact with the managed services we expose. This API is located at api.clever-cloud.com. The Clever Operator works as an interface between the Kubernetes Apiserver and the Clever Cloud API. It exposes Clever Cloud's add-ons through custom resource definition. For now, it can expose the following add-ons: PostgreSQL, Redis, MySQL, MongoDB and Pulsar.

The Clever Operator is compatible with k8s v1.21.0 or above, make sure to use one of these.

How to install it? Three steps to go:

1. First, install the Clever Operator. Either build it from the source code on Github or use our docker image on Docker Hub.

1. Then, configure it. It boils down to setting up CLEVER_OPERATOR_* environment variables. For example, you need to create a token to connect to the API.

1. Finally, create your custom resource definition. Here is a YAML example of what it looks like, for a PostgreSQL database:

apiVersion: api.clever-cloud.com/v1
kind: PostgreSql
metadata:
  namespace: default
  name: postgresql
spec:
  organisation: orga_xxxx
  options:
    version: 13
    encryption: false
  instance:
    region: par
    plan: s_sml

Once, the resource is created you could use the Secret created by the operator as a file directly mounted in your Pod or through environment variables. You have examples of how to do it through the examples folder or following those documentations "Using Secrets as Environment Variables" or "Using Secrets as Files from a Pod".

Now you know how the Clever Operator works! We would be happy to have your feedback about this tool. Please feel free to create an issue here, for any suggestion of enhancement you might have.

We are delighted to announce the appointment of David Legrand as Chief of Hardware Evaluation. David's arrival accompanies an important phase in our company's structuring. Indeed, with a third data center in Paris coming up, brand new servers, innovation and R&D projects, we continue to strengthen our team to support our sustained growth in the cloud market. He will report directly to Clever Cloud's CEO, Quentin Adam and will work in collaboration with Steven Le Roux, Clever Cloud's CTO.

Clever Cloud is a French company founded in Nantes, France, which has created its own software technologies since 2010 and is a pioneer in Europe in the automation of application deployment. It has a large number of customers in 80 countries around the world. With a turnover that has almost doubled again in one year, Clever Cloud has experienced significant growth since its creation, due in particular to its ability to regularly bring innovations to its customers. For example, in October 2021 alone, Clever Cloud was the first cloud provider in Europe to launch Apache Pulsar as a managed service, followed by Jenkins with per-second pricing, and the time-stamped data optimised database TARDIS, which is charged on a per-use basis.

About David Legrand

David was the Editorial Director of Next INpact and a journalist specialized in hardware and new technologies for the past 20 years. He also developed tools, participating and supporting open source projects which you can learn about on his Github. Through his previous experiences he developed a strong passion for writing, which he used as a tool to inform and share with others about open and distributed technologies among other subjects he takes very much at heart. Passion-driven, with optimistic yet critical opinions on the digital news, no wonder why his values match like clockwork with the ones we defend everyday at Clever Cloud.

"I am very happy to be working with David, he's someone I hold in high regard. He brings to Clever Cloud his solid hardware knowledge, his devotion to problem solving, but also a renowned style of writing and the will to share and promote our project", says Quentin Adam, co-founder and CEO of Clever Cloud.

About Clever Cloud

Founded in 2010, Clever Cloud is a company based in Nantes specialising in IT automation. It creates and provides the software building blocks necessary for the flexible deployment of applications on self-service SaaS architectures. Its clients include such big names as Airbus, AXA, Caisse d’Épargne, Cegid, Docaposte, MAIF, McDonald’s, Solocal, SNCF, TBWA,....

Today we are officially announcing the opening of a new Clever Cloud zone located in Jeddah, our first in the Middle East region. This comes in addition to our existing Paris, Roubaix, Warsaw, New York City, Montreal, Singapore and Sydney zones.

The launch of this new zone in Jeddah has been made available thanks to our supplier Oracle Cloud. It has the special characteristics of running on a virtualized infrastructure: beyond the technical achievement for us, it will enable faster and more scalable expansion in new regions in the future to answer your needs.

How the create an app on this new Jeddah zone

In the console

When creating an application, in the Zone dropbox you should be able to select them:

In the information tab, you can change an existing zone to another and this will trigger a redeployment in the new zone:

With Clever-Tools

If you are using clever-tools, or the API, the region flag is as follows:

$ clever create appNameJeddah --region jed -t dotnet -v

What will be the prices of services there?

As infrastructure is more expensive in the Middle East than in Europe, mainly because of the necessary cooling systems and network connectivity, our pricing in Jeddah will be higher in the future (approximately +50%).

However, to support the launch of this zone and help you test it at a more attractive price, we have decided to exceptionally set the same prices as in our other zones for some months. We will publish the new prices on our pricing page.

You can now easily start you first applications and databases on this new Middle East zone: login to the console.

Few days ago, Marak Squires, the developer behind the open-source npm libraries colors and faker, decided to corrupt the libraries, to denounce issues in open-source projects' funding system.

The infinite loop introduced by the developer broke several apps using these libraries by printing the text 'LIBERTY LIBERTY LIBERTY' and non-ASCII characters in the apps' logs.

It causes a lot of trouble as the colors library receives over 20 million weekly downloads on npm alone and has almost 19,000 projects relying on it. Whereas, faker receives over 2.8 million weekly downloads on npm, and has over 2,500 dependents.

How to check if your Node.js app is impacted?

The first thing to do is to check if your app is using the npm libraries 'colors' or 'faker'. To do so, run either:

npm ls colors

Or

npm ls faker

You will get an output like this:

my-project@1.2.3 /home/me/my-project
├─┬ @storybook/addon-docs@5.3.18
│ └─┬ vue-docgen-loader@1.5.0
│   └─┬ jscodeshift@0.7.0
│     └── colors@1.4.0  deduped
├─┬ @storybook/vue@5.3.18
│ └─┬ @storybook/core@5.3.18
│   └─┬ cli-table3@0.5.1
│     └── colors@1.4.0  deduped
└── colors@1.4.0

With this output, we can identify that this project uses 'colors' directly with version 1.4.0 and through transitive dependencies, also in version 1.4.0.

Your app uses 'colors' or 'faker', what can you do?

If your app uses one of these npm libraries, we invite you to check three thing:

Check the version

First of all, you need to check if you're using one of the compromised versions of these libraries:

• colors: 1.4.1, 1.4.2, and 1.4.44-liberty-2
• faker: 6.6.6

Check the package-lock.json

Do you have a package-lock.json? If you don't we invite you to read the documentation and add one to your project.

If you do, you need to force a version which is not compromised (1.4.0 for colors and 5.5.3 for 'faker'). You're using npm? You can try with the module npm-force-resolutions. You're using Yarn? You can use the process described in this documentation.

Update your tools to their latest version

We also invite you to check if the dependencies you use released an update. As an exemple, if you use Storybook, the v6.4.10 released earlier yesterday fixes the issue.

A note for Clever Tools users

By the way, if you use our CLI, the clever-tools, and if you installed it via npm, please upgrade to v2.8.1.

The year 2021 was marked by the arrival of the covid 19 vaccine. A hope for many, announcing the end of this pandemic that will have marked the beginning of our century. Haha. Well, actually, no. Indeed, on the eve of the year 2022, we discover the fascinating capacity of the variant named Omicron to spread. Vaccination campaigns then resume, to inoculate the so-called "booster" doses to stem this new wave of contamination.

Hey, we'd like to help

At Clever Cloud we are trying to act - in our own way - in the face of the situation. As was the case previously with Makair (the respirator co-designed by our CEO Quentin Adam), for example. And, at the beginning of the school year 2021, we came across the Covidtracker teams almost by chance. They were in the middle of working on Vite Ma Dose. This was an opportunity to discuss their needs. And since the beginning of the fall 2021, we have been providing instances for the algorithms of the Vite Ma Dose. To goal is to detect vaccination appointments.

With the ViteMaDose volunteer team, we are investing our time to serve a vaccination campaign that we believe is essential for our fellow citizens. Fortunately, we are not the only ones: several French public services and companies have also lent a hand to the product by contributing the know-how of their teams or access to their technology. This is the case of CleverCloud, which has generously offered to help us by hosting the core of the product: the algorithm for finding vaccination slots for covid-19.

Florent Jaby

A short story of migration

We are delighted to be able to help the Vite Ma Dose teams today. We provide the necessary resources to enable the service to function properly. As much as the frontend is quite simple, the backend, which aggregates appointments from a small number of different platforms, is a different story.

Clever Cloud offered us hosting specific to our needs and our architecture thanks to its managed Gitlab Runner offer. We were able to entrust them with all of the operational complexity of the platform, which otherwise required our constant attention, not always possible in a voluntary capacity. This also frees up our time for other matters such as the progress of the 3rd dose of vaccination or the vaccination of the youngest children, which are changing daily. In fact, the migration to the Clever Cloud runner was completed in a weekend, painlessly and perfectly as planned.

Florent Jaby

Today, the service is running like clockwork. We congratulate the Covidtracker and Vite Ma Dose teams for their efforts.

To find your 3rd shot : https://vitemadose.covidtracker.fr

Christmas is next week and you probably heard about the “Secret Santa” tradition. Loïck Piera, Web Consultant at JoliCode, developed an app called Secret Santa to help you organise yours with your colleagues, friends or family. Secret Santa has been hosted by Clever Cloud since 2018.

What is a Secret Santa?

In a word, Secret Santa is a Christmas tradition where each person of the group is randomly assigned someone to offer a gift to, and nobody knows the author of the gift they will receive until the D-day.

How does the app work?

It allows you to simplify the organization of your Secret Santa. In other words, it automates the assignment of a person to whom to offer a gift for each participant. Of course, to simplify its use, you can connect the app to Slack or Discord and now a beta version for Zoom is also available.

How to install Secret Santa?

• At first, go to their website, then choose the application to which you want to connect Secret Santa.

• Next, select the group members you would like to add to the participants. In addition, you can also set-up a personalized message to send to each participant.

• Then, you're all done, the app shuffles and assign each participant to another one and sends the message you previously set-up. Finally, all you need to do now is to buy the gift for the person you have been assigned to! 

Why did Secret Santa choose Clever Cloud?

We asked Loïck Piera, the Web Consultant at JoliCode which developed the app, what he thinks about the solution we provide. This is what he replied:

Clever Cloud : "What are the main assets that made you choose to be hosted by Clever Cloud?"

Loïck Piera : "Well, it's a solid platform which operates without having to overthink it and with no need of maintenance from our side. It's simple and fast to deploy in production, and there is no service interruption, which is crucial. Secret Santa is a Symfony application with PHP 8 and the Clever Cloud infrastructure fits our needs perfectly."

Clever Cloud : "What do you appreciate the most in our solution?"

Loïck Piera : "What we appreciate the most in this hosting solution, is the simplicity of use. We only have to indicate the webroot directory, and that's all, the version of PHP and the Composer dependencies are detected automatically! Furthermore, there is also an interesting list of addons. Clever Cloud is a platform really adapted to most web projects."

Interested in learning more about our solutions? Visit our technology page.

What is Log4Shell?

You probably heard about Log4Shell (or CVE-2021-44228), the vulnerability which impacted log4j, a famous log library written in Java.

This critical vulnerability allows to remotely execute code on the servers of a company or to display the environment variables of an application.

What has been implemented at Clever Cloud?

At Clever Cloud, we worked all weekend to resolve this issue.

All our Elasticsearch add-ons were secured quickly, and many of our customers are secured by the most recent versions of JDK. Edit (13/12 16:41 UTC+1) : Even the most recent versions of Java are now vulnerable to RCE (Remote Code Execution) due to a bypass. The only viable solution is to patch and update log4j directly.

Please also note :

• Java 8 (or later) users should upgrade to release 2.17.0.
• Users requiring Java 7 should upgrade to release 2.12.2.
• Otherwise, remove the JndiLookup class from the classpath in a post build hook (you have to execute the hook in the file where the log4j jar is):

CC_POST_BUILD_HOOK=zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class "

For the others, we have initiated a thorough monitoring and analysis policy.

We are also in the process of updating the Java image with the following Log4j configuration property: Edit (14/12 14:04 UTC+1) : The Java image has successfully be updated and all Java applications have been redeployed with the following Log4j configuration property:

log4j2.formatMsgNoLookups=true

Please note that this flag only work on versions superior or equal to Log4j v2.10.0.

We upgraded the New Relic Java Agent to the 7.4.1 version and the apps on which the agent was deployed have been redeployed.

We also patched the Pulsar cluster.

How to mitigate the risks?

We urge you to update your dependency to Log4j v2.17.0.

Then, depending on the environments and add-ons you work with, here's what you can do as well:

For Docker

If you are using Docker, you can do either :

• Update to Log4j v2.17.0 (recommended)
• Or setup the following Log4j (v2.10.0 minimum only) configuration property: log4j2.formatMsgNoLookups=true

For Jenkins

The Jenkins security team has confirmed that Log4j is not used in Jenkins core. However, it can be used in some Jenkins plugins. You can identify if Log4j is included in a plugin by using the following command in the Script Console:

org.apache.logging.log4j.core.lookup.JndiLookup.class.protectionDomain.codeSource

Support team

Of course, our support team remains available if you have any question regarding the current situation. You can reach them via the chat or send an e-mail at support@clever-cloud.com.