47

Rails 5.2 introduces the encrypted secrets feature through the usage of the awesome credentials.yml. But I'm struggling to get it to work with Heroku.

Is there any Strategy available right now to deploy a Rails 5.2 App to Heroku?

2 Answers 2

75

You should set the environment variable RAILS_MASTER_KEY, either on your heroku web dashboard, or using console:

$ heroku config:set RAILS_MASTER_KEY=<your-master-key>

Example:

$ heroku config:set RAILS_MASTER_KEY=123456789

(The < and > are placeholders)

Rails will detect this variable and use it as your master key (instead of looking for it in master.key file).

8
  • 1
    @Gerry Rails used to have rails secret to generate a new secret key. Is there a way to generate a new master key?
    – Tallboy
    Apr 11, 2018 at 17:47
  • 1
    @Tallboy Yes, you can run bundle exec rails runner "puts ActiveSupport::EncryptedConfiguration.generate_key". Just consider that you won't be able to decrypt any file encrypted with a previous key.
    – Gerry
    Apr 11, 2018 at 17:53
  • Am I supposed to use the same master.key I have locally as I do in production then? What if I don't want local developers being able to encrypt my production secrets?
    – Tallboy
    Apr 11, 2018 at 17:58
  • @Tallboy Generally yes, you will use same master.key in production. If you would like to keep sensitive data private, you could set environment variables in the server, instead of putting them directly on your credentials file.
    – Gerry
    Apr 11, 2018 at 18:55
  • 1
    @BKSpurgeon No, i used those only as placeholders.
    – Gerry
    Sep 7, 2018 at 15:02
23

You could also use the following command to create Heroku RAILS_MASTER_KEY with the contents of your local config/master.key:

heroku config:set RAILS_MASTER_KEY="$(< config/master.key)"

Note: make sure you are in the directory that contains your Rails app.

2
  • 1
    if the key is kept alongside the encrypted file in the git repo then there's no purpose to using the encryption mechanism. if someone gets access to your source control, they get your keys
    – Jason FB
    Apr 20, 2020 at 15:33
  • @JasonFB you are right. That's why you should use Environmental Variables, and configure them like in the example above. You can check details here: devcenter.heroku.com/articles/…
    – Paulo Belo
    Apr 20, 2020 at 20:07

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.