I've created a small gem called multa_arcana (latin for "Many Secrets") which allows one to store all Rails secrets in one file, which should not be checked into revision control, but other files then can be. Source is on https://github.com/skandragon/multa_arcana Usage: add to Gemfile: gem 'multa_arcana' Create a file to hold the secrets: config/secrets.yml While the filename can be changed, it is somewhat hard to do so without modifying a file that is loaded fairly early, like application.rb. I just use the default. Currently to change this, one must pass in a file to load on the first call to retrieve a secret. API suggestions welcome. Place in this file the various secrets your rails app needs to keep secret: db_username: john db_password: my-super-secret-db-password secret_token: lkasjdlkqjlkas...la9u9203udkd redis: redis://user:password-for-redis@host devise_pepper: 239ru2ij3jf9u02dhis...92930d02hdhdlka3 Use it wherever you need to: config/database.yml: production: adapter: postgresql encoding: unicode database: thing_production pool: 5 host: 127.0.0.1 username: <% MultaArcana::secret_for(:db_username) %> password: <% MultaArcana::secret_for(:db_password) %> config/initializers/secret_token.rb: Thing::Application.config.secret_token = MultaArcana::secret_for(:secret_token) -- (Ruby, Rails, Random) blog: http://blog.flame.org/
on 2013-02-21 17:44
on 2013-02-21 18:22
Michael Graff wrote in post #1098246: > I've created a small gem called multa_arcana (latin for "Many Secrets") > which allows one to store all Rails secrets in one file, which should > not > be checked into revision control, but other files then can be. Source > is > on https://github.com/skandragon/multa_arcana Interesting, but what advantage does this have over... https://github.com/binarylogic/settingslogic
on 2013-02-21 18:29
Probably none, but "settingslogic" didn't appear in my search when I looked for ways to store secrets in a single file. :)
on 2013-02-22 09:05
Why not just use environment variables?
on 2013-02-22 15:16
Michael Graff wrote in post #1098252: > Probably none, but "settingslogic" didn't appear in my search when I > looked > for ways to store secrets in a single file. :) Sure there is advantage to writing your own gem. You wrote it, and shared it with the community. That's AWESOME! I considered doing something similar, until I ran across SettingsLogic. > Posted by unknown (Guest) on 2013-02-22 09:05 > Why not just use environment variables? Yes, environment variables are certainly an option, but I really like the consistent API, and baked-in support for different environments that SettingLogic provides.
on 2013-02-24 03:03
Because environment variables show up in process lists.
on 2013-02-24 16:24
If it's an issue of security...if somebody is already looking at your processes, what's keeping them from cd'ing to your application's config directory and reading secrets.yml?