Taming the beast: A practical guide for taking over a Drupal project

all right hi everyone welcome to taming the big boobies a practical vibe for taking over a Drupal project alright so first hi there I'm Matthew I work at some interests I've been with Drupal since 2010 I'm passionate about technology science in general and I would say I'm a cautious optimist so I try to see the good side of everything but I pace myself alright then I work with some interest here in Montreal so what's what's the story here why we why are we talking about the beast so you have your guy you're a business guy the business is about them doing sell that your company that parts into your office saying good news guys we have a new client he won't he wants us to maintain its current website and he wants us to add new features and then you are you you have your critical Drupal is typical developer is here maxime that first what his thinking is man I love a Baillieu stuff I don't like to take over others people website I want to do cleanup I don't want to fix bugs that I haven't introduced myself so it's not to try to deactivate the project and then the words starts what's in the box so when we open the hood of a new website this is where we uncover the beast so the base is the analogy for which you're picking up from a previous previous provider for your clients and you're never sure what you're gonna gonna see opening the box so what does it mean for you it means maybe the code is 30 versions behind maybe the core is hacked some patches were applied but not documented maybe the application sends emails to clients on every actions when you update a note when you run run maybe everyone who receives an email and you have no way to know about it maybe contribution are ugly managed you remember Drupal 7 features maybe some stuff are in code maybe some stuff are not maybe conviction are not managed at all maybe deployment is are hazardous so you cross your finger each time you put something in production and what it means for the clients it means that maybe the initial core updates and country update you are going to do on the website will cause them thousands of dollars because you don't know what's in the box maybe in the process the site went down 10 times even for short period that could mean something very fine maybe hunter content was lost maybe worse maybe the last customer during that process so it can mean that first improvement to the website arrives 20 weeks later so the time to market may be very low because you don't know what's in the box so you know you understand that it's all about fear and what I'm gonna talk about today I'm gonna talk about managing fear and I think that's the one thing we want to do when we pick up someone else project we want to make sure that we don't live death here we want to manage our own fears and we want to manage the clients fears because maybe if you're left from a previous provider maybe that's because you have a bad relationship with it alright let's greet so now that we went over the hours that we can find in the box let's see what we can do to mitigate that it's all going to be okay I promise you you don't know why how it got like that you don't know why that Drupal websites you in a rivet is as bad as it is and maybe it's not maybe it's just little little stuff that that bounced you but you don't know why it is like that you do know that you're going to find a path forward I'm gonna help you get it all right so it all starts with the work estimate I knew that there was the talk just before me in that same room about a stimulating work often were good at estimating new projects new website the ones that we will build from the ground up were not necessarily so good to estimate the work involved in taking over a new an existing project so here's an alternative scenario kazuya our business guy I wants everything for next week because it's what you talked about with the clients and of course is your name is a real person at our company and is more sensible than this he won't promise stuff like that but it's for the sake of the argument and Max again our enthusiastic about this only one requirement or two you first need to understand what he is taking over and and then leave the fully functional and safe local and test environment you want to make sure that everything is going to do from now on is is able to do it locally on his own computer in a safe space and to be poised on the test environment that is sensible with what the clan has in production if you're happy what do you want he wants comfort he wants to walk away from that fear of every new thing every little CSS adjustments is going to be is gonna deploy introduction will break the whole site you want to live that country let's see how we can do that all right first step calm down documentation you are on a mission to find everything in can put your hands on it could be an old RFP request for proposal so in that original document you're gonna find maybe API integration that you didn't think was in the product you can find automation that you didn't think was in the project you want to see if the client or its past provider as functional or technical documentation about the product you're you're in everything you wanna see the plant as a backwards to a backlog of bugs of bug fixes to address and maybe the old provider as long as well original repositories so if the old provider is kind enough to give you like that get folder of their previous project it could it could help you understand that the journey went through and then you want to understand what's going on with with the kind of the the whole project not only the technical things done with the whole project so you wanna know who are the stakeholders stakeholders of that website who uses it you want to understand the digital environment of the project so you you're getting a simple website what you don't know is is is there a ciarán that connects to that drupal website is there any automation that includes more than one application do the client has ten other providers working on different website do the plan of processes that go through all their different application so to see the digital environment as a whole gives you information about what the site should do or should not do and you wanna know our governance work for that website and is really important write this down write everything down write the telephone numbers of you to contact like the server goes down if the CRM to which content is is is synced if the firewall of this year CRM starts blocking the simple application you want to know who to call if you have a problem with the DNS zone maybe you're not managing it maybe even the client I've lost the email used to register a domain name that's something that can happen and and maybe the client forgot to pay the bill for the domain name that's actually already happened with us so the client site goes down down and after a couple I would say maybe minutes four hours of troubleshooting we found out that the problem was a bill that was not paid and reminders that were ignored by the cloud because locks this email for registration so you want to have a list of phone number and people to call and understand who manages what all right now about the technical environment again assumes who manages it what's in it is there any MX record link to the main domain name or you're working with it's there any sub domains that are registered to IP is that nobody has any idea what what it is and you fall in a white white screen when you visit them so you kind of have to dig for this information and often the client will have no idea at all of what it is so you have to find a technical person that please you can go through to understand everything about that focusing company so who's a single website what kind of infrastructure it's using what ya type of an interactive structure and Vicky as a service level of every nothing to that hosting company so maybe everything is in on let's say an infrastructure as a service at Amazon and your hire to maintain due to qualification but they have no one to maintain in the server the server itself so do you need do you need this assignment and how to take care of this did you cost those those those those hours I work on the server and to the client know what what's the difference between let's infrastructure as a service and platform of the service so is everything manage on that application you want to know software inversions that are used to run your job application because you want to reproduce that on your look on very much you want to reproduce this on your testing environment and you want to know every external integration and dependencies for the website is there any software installed on the server that you want to replicate on your side it could be a solar server it could be some PHP plugins to crawl through PDF or or through Word documents so each an original dependence you must be addressed and is there any build step to to kind of assemble that project so we can think of obviously compose and install and everything but also for the front end are there any tests for honor that were used for the theme I'm thinking about sass and less I won't work on a project where we didn't have access to the previous provider and we only add compiled CSS so where do you go from here if you don't have a satisfy so you can you want to look for all of those things when you're you're looking at taking over a new website and then the application the Beast you want to see is there any automation in the in the website so you're looking for rules workflow country modules or custom modules that were be able to automate stuff linked to the client processes you could look at hooks so yeah rules books mail so for every drupal books there could be a in automation link to that so if only Oh can't it again cert there's some funny business going on there for the big clients internal processes you wanna you want to look for that when you when you kind of do an audit at the color code and then api's you wanna find every API integration with either enterprise software that exists out there we're thinking about Salesforce CRM maybe Microsoft Dynamics AX Arava also custom ideas that were built by maybe the clients technical team and often you will you will you will innovate the mandate from let's say the marketing side of the clients and they did not really talk to their IT guys and maybe there's an integration where with their ERP in apps so you want to look for those integration it could be also commerce integration so make sure you know what is the payment platform that the client uses can you have a sandbox at that payment platform the libraries that could be used and here my best advice is to kind of build a set of keywords look for when you look through the code so at one point hopefully before you can install anything you're gonna try to look through the code custom code custom modules and the theme and you want to look for a bunch of keywords so you can even build a script with those keywords so I'm thinking that stuff that relate to excel so every maybe efforts and mail Google Mail that are in custom modules you want to pick those up and see understand when they are fired and why they're fired for for API integration you can build a list of keyword like soap Jason you could look at turbo HTTP requests that is the the e helper to to access external links so you try to build a list of keywords you can crawl through the site I tend to include as well enterprise software and those lists in that list of keywords so Salesforce is an example Dynamics is an example so you really want to kind of statically assess the code before installing it and and then the last thing to take into a account of the application is user-generated content so if you you have to move around databases if you have to change our hosting company if you want to move the infrastructure you want to understand what is the user-generated content and what what does it mean if you have to have some content freeze on the website because you're changing infrastructure and the the most vicious one in that category is webform because the client account with only web form on their website will always tell you I don't know it's just it just static content we are the only one touching the content etc but they are like to contact form that are linked to business processes that they don't take into account when we're thinking user-generated content all right now you can install the sack locally you've you gather documentation you went through the code you asked around for API integration for business processes and now you're ready to install the cyclo hood maybe it's a good idea before evening the first PHP page on that side to this side from the network why us spinning and so that's a true story an unfortunate one but but when is the true one so we did all those steps we kind of add a bunch of documentation we went through but there's one thing we didn't catch is that emails were sent using cron and they were not sent using the HP may mailer they were sent connecting to an external API so once the site wasn't so locally 10,000 emails were sent to the clients clients telling them that a new account was created for them on the local web site this is the everyone click click on the blank blank page and they received hundreds of emails of oh your email them didn't worry were excessive so even if you use something like like now log that I'm gonna talk about a little bit later maybe the first time you run PHP on website this electron the network just to see what's going on are there some errors that show up etc so can you make the website work locally and can you make it work without being connected to your network so that would be great news that would mean that there is no kind of script blocking integration with with external integrations can you reproduce integrally your production environment locally that would be great and I can catch any potentially dangerous external integration before the trigger locally or on your test servers things you want to worry about if your integration so then again back to my example if the web service is called on me at a custom API built by your client maybe the name of that API will not be very eloquent and you won't see that this particular API will send 10,000 emails and you can catch everything that people send on the local insolation using mail hub if we're out every outgoing emails to kind of a web application where you can see where it's from where it's going cetera there's a docker container for me know know if it's the that's why you want potential dangerous information so we a sin T P module sanguine module and rupa all of those external external net mail integration using country modules in drupal it's a good thing to when you're going through the the country modules come country module if there's one module that you don't know what it's doing just google it go see Anubhava org what's that model what's it doing that's a good point so would it be like a settings so we settings of variety basics in a normal people always use the basic that's a great tips all right now you want to look at non-functional requirements so you've got it installed yeah it works but what what are other thing you want to look for so as a put in a position of a functional requirements which would be when you click here this happens and non-functional requirements is everything else sighs so first security is everything up to date recoverability so this is a big one because you're in everything in a project from a client and you don't know if the client as backups you don't know if they if the clients has kind of a strategy to recover his or her websites when when something happens maybe they could be hacked maybe they did do something wrong themselves using the onion town so we want to make sure that the client has a strategy to recover the website if they don't have one maybe it's your job to tell them to put something in place interoperability to also this one is is looks and you kind of stuff to do last-minute to take to fix it so let's take the to go website needs to talk to an internal IP we can evaluation and that internal you're easy on the firewall and that firewall what is idea to it so maybe you don't have this information and you learn about that like five minutes before the going be the one was hoping for so you want to want to go through this and even if you've got the opportunity to work with that client from the listing marketing division let make sure that you have the process so you do they already had one do you make the same or do you want to build it from scratch or two such as M one all right - L four modules that can I help you kind of audit the security of Drupal security reviews to see is there any unsecured configuration on your installation and module hacked that will give you a div of every country module to see if a password was applied without you knowing it I think security review there's no Drupal 8 release for now but if you enter the website it's probably gonna be a Drupal seven unless something went really bad with the last provider all right can you go further than that sure you can build a do not list so that could be really helpful for anyone who starts working with the project maybe you haven't secured the whole project yet and you want to make sure someone doesn't send those ten thousand emails so it's always useful to know what you should know do it could be stuff as simple as do not use the do pole what's a Drupal backup and migrate to export the database because XYZ do not step module it could be a simple Tomatis for the time you secure the application you could build a test plan so what are the steps you want to take to make sure once you deploy that snippet of CSS you are not breaking the whole system MyMusic CSS and as an example understand that it's not really functional but it would be crazy if you just deploy one line of CSS and all the website breaks so you wanna you wanna have test them and you want to make the application here your own you want to really go into the application and remove every my test module dot BC cade 2015 dot module file you know all those artifacts dead that you don't know how or why they exist on the website and you don't want to touch them because it's not yours that's this is the time to make it yours and you to to delete that file I promise you this is a great feeling to get rid of those artifacts and maybe you want to go over the risk mitigation strategy that you have in place with the client you want you want to you want your plan to understand that the work you're doing that the steps you take to make yourself safe and to make your plans safe our work worth the buck they're investing in your work and this is crucial and often as developers we don't want them we're kind of a shame that the to put on work that's not immediately observable by the client and you we won we want that every hour that we stand is added value to the client and yes they will get their new counsel yes they will get in which mitigation is value you are bringing this value to your client and then remember that compassion and transparency wins over fear you want to be compassionate and transparent with the client you want you want to be there for their fears you want to be able to listen to them your honor you want to be able to tell them to wait for that deployment because they are taking a big risk to deploy this Friday 5:00 p.m. on the website that you've never touched before immediately on production so you become compassionate with them and to understand why where their fear come from comes from you want to be compassionate with the prettiest prettiest thing the one that built the monster the one that built the beast you don't know you don't know what were the condition in which this beast was was put into life you don't know you don't know the friction they had you know if it was given to someone who never worked with Drupal before you don't know if the client maybe was cheap at first and they didn't understand the the work and the hours that we need to put in a website to make it stable and secure so you don't want to start like using those guys are your scapegoat you want to be compassionate with them because you've been in that situation before and and you want to be compassionate with yourself you don't want to put yourself in a position where you're gonna fail you don't want to set yourself for failure and that's a big thing because we always want to please a plant we want quick wins we want we want the claim to be happy with the service we provide but if you put yourself in a position where if you put your developers in a position where they get they're going to fail you're doing you're cutting on and suffering to your developers to your clients and maybe to the end user of the client so if you're interested about this idea of compassion in tech there's a great talk by up in April winter about reducing suffering in tech and how compassion can can be used to reduce suffering I encourage you to to hit listen all right so how do you manage here the first question of this top so you estimate what it takes to be comfortable working on the system so all of these activities that you can do to make sure that when you're going to deploy that line of CSS that will take you 15 minutes to to write and ten seconds to the boy you want to share that this 15 minutes you've put in all the hours you needed to make sure you're comfortable to deploy it without any fear and then you want to mitigate risks using all the these strategies explained before and last you wanna stay compassionate and transparent with your clients with yourself and with the previous team and now you're a happy little dog all right any question comments insults yeah so to document everything you discover so one of the main point is to be able to install it locally a lot of people will be very happy to have all this in a great we meet Andy at the at the root of your repository because it's one file that most of developer are comfortable opening and going through the points for everything technical that's a good place you could so if you have a project management tool often there's a good key that comes with it so either you use a zero confluence etc or in-house we use redline in the wiki part we have kind of a structure to document those in from those information and that's the first thing that we show to every employee that comes as a mattress is what's that structure what pages you've got to read it before entering in a project etc so that's a little bit different than let's say the appointment process where you can give permission to only one person to deploy the application in production so there your said you're safe because it's gonna be your I don't know your your your main developer on the project that's different because you want you want to make sure that even the people will solid hopefully understands the risk they're exposed to especially if you don't sit here yet the application so down the line you're gonna let say a separate configuration you're gonna make sure that when it's unsolvable E is not connecting to any dangerous API etc but for the time that you're not safe you want to make sure that everyone goes through those static documentation pages and we resent all right what one of the things that I haven't they are going to is you've got to solve each of these problems individually so let's say you found a list of problems with that side when you install locally it does this and that etc so at each step of the way you want to solve those problem before starting the points up to two to the production environment in real life the thing is the clients will always try to nudge you one way so oh yeah but can we get this done by so it's always that's a good moment to implicate the clan and to the client and to make sure the client understands the rest and maybe is he won't be as comfortable with taking this risk but that's make it their decision and not yours and if you kind of if you succeed convince them behind that the risk they are taking is theirs at one point you're all good because if the client isn't above and any categories is all right I hope you enjoyed the top