It enhances the Credentials feature introduced by Rails v5.2.0.
Add this line to your Rails application's Gemfile:
group :development, :test do
gem 'rails-env-credentials'
end
And then execute:
$ bundle
RailsEnvCredentials manages credentials and key pairs with the following:
config/credentials-development.yml.enc
config/credentials-test.yml.enc
config/credentials.yml.enc
master-development.key
master-test.key
master.key
It also manages environment variables for each env.
RAILS_MASTER_KEY_DEVELOPMENT
RAILS_MASTER_KEY_TEST
RAILS_MASTER_KEY
You can use appropriate credentials depending on Rails.env
.
$ rails env_credentials:show -e development
# config/credentials-development.yml.enc
aws:
bucket: foo-dev
$ rails env_credentials:show -e production
# config/credentials.yml.enc
aws:
bucket: foo-prod
$ rails runner -e development 'pp Rails.application.credentials.aws.bucket'
"foo-dev"
$ rails runner -e production 'pp Rails.application.credentials.aws.bucket'
"foo-prod"
It automatically generate encrypted file and the master key when you starts editing credentials at first:
$ rails env_credentials:edit -e development
You want to see decrypted contents, use env_credentials:show
:
$ rails env_credentials:show -e development
For example, if the config/environments/staging.rb
exists, you will generate config/credentials-staging.yml.enc
.
$ rails env_credentials:edit -e staging
You can’t directly compare encrypted files between two versions, but it turns out you can see a diff using Git attributes.
Put the following line in your .gitattributes
file:
config/credentials*.yml.enc diff=env_credentials
Then configure Git to use env_credentials:show
:
$ git config diff.env_credentials.textconv 'rails env_credentials:show --file'
This tells Git that encrypted files should decrypt by the env_credentials:show
task when you try to display a diff.
Credentials is a good feature, but we cannot use it on development and test environment.
DHH wrote as follow in the pull request for initial implementation:
It's only in production (and derivative environments, like exposed betas) where the secret actually needs to be secret.
refs: rails/rails#30067
However, I have to manage secrets and a master key different from production for testing in the staging environment.
I do not have the confidence to explain explicit use cases to Rails team, so I implemented as a gem.
After checking out the repo, run bin/setup
to install dependencies. Then, run rake spec
to run the tests. You can also run bin/console
for an interactive prompt that will allow you to experiment.
To install this gem onto your local machine, run bundle exec rake install
. To release a new version, update the version number in version.rb
, and then run bundle exec rake release
, which will create a git tag for the version, push git commits and tags, and push the .gem
file to rubygems.org.
Bug reports and pull requests are welcome on GitHub at https://github.com/sinsoku/rails-env-credentials. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.
The gem is available as open source under the terms of the MIT License.
Everyone interacting in the Rails::Env::Credentials project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.