14

I have an app on Rails 5.2 and it was previously hosted on DigitalOcean, but I need to host it on heroku. I've been reading that heroku can't read Credentials.yml of because it's on gitignore and of course I don't want it public.

So my key variables are like this (and example with redis):

host: Rails.application.credentials.redis_host,
  password: Rails.application.credentials.redis_password

Heroku can't read this. So my question is what is the best approach to change that in to heroku ENV variables? Do I need to edit all my current keys (there about 340) to ENV['SOMEKEY']?

I'll appreciate you help!

2 Answers 2

40

Create credentials.yml and master key:

rails credentials:edit 

Edit credentails:

EDITOR=vim rails credentials:edit

WORKING WITH VIM:

  • For inserting
  • Press i //Do required editing
  • For exiting Press Esc
  • :wq //for exiting and saving
  • :q! //for exiting without saving

EXAMPLE OF HOW CREDENTIALS.YML can look:

development:
   github:
      client: acascascsacascascasc
      secret: vdsvsvg34g34g
production:
   github:
      client: 34g3rvv
      secret: erberb43

FIND A CREDENTIAL:

rails c
Rails.application.credentials.dig(:aws, :access_key_id)

or if an env variable is used

Rails.application.credentials[Rails.env.to_sym][:aws][:access_key_id]

The credentials.yml file should NOT be in gitignore.

The master key that decrypts the credentials SHOULD be in gitignore.

To set your master key in production:

heroku config:set RAILS_MASTER_KEY=123456789

or

heroku config:set RAILS_MASTER_KEY=`cat config/master.key`

That's all you need to know about credentials in Ruby on Rails. Good luck :)

Update: I've created a screencast covering the topic :)

5
  • 2
    This is the most amazing explantion. Thanks, it worked!!
    – theKid
    May 25, 2020 at 23:00
  • Great answer. My credentials file came with secret_key_base, should it be in your example file ? e.g. should it go before/after the development: github: client etc in the example?
    – stevec
    Nov 29, 2020 at 16:20
  • secret_key_base is always there. just leave it on the bottom of the file, not nested under anything
    – Yshmarov
    Nov 29, 2020 at 16:44
  • I am confused about the credentials. If I add the production credentials via vim, and then save and push to github as a branch, once we merge to master, aren't the credentials gone? If someone needs to test my branch, don't they have to re-add the credentials? Also, is this correct then for the gitignore: /config/master.key /config/credentials/development.key /config/credentials/production.key Apr 8, 2021 at 1:43
  • you don't keep your github password on github, right? the same way master.key is not kept on github. it is a secret. that is shared in development environment and in production environment.
    – Yshmarov
    Apr 8, 2021 at 8:33
3

Rails 6 introduced built-in support for multiple environment credentials

It can be very convenient to keep different secrets for different environments

To create credentials for production environment, we can run the following command

EDITOR=vim rails credentials:edit --environment production

The above command does the following:

  • creates config/credentials/production.key if missing (don't commit this file, add to .gitignore if such record is absent)

  • creates config/credentials/production.yml.enc if missing (cmmit this file)

  • decrypts and opens the production credentials file in vim (you can specify other editor)

And finally we can use these secrets on Heroku

heroku config:set RAILS_MASTER_KEY=`cat config/credentials/production.key`

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.