{"action":"created","issue":{"url":"https://api.github.com/repos/rails/rails/issues/25095","repository_url":"https://api.github.com/repos/rails/rails","labels_url":"https://api.github.com/repos/rails/rails/issues/25095/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/25095/comments","events_url":"https://api.github.com/repos/rails/rails/issues/25095/events","html_url":"https://github.com/rails/rails/issues/25095","id":156101357,"number":25095,"title":"Provide encrypted secrets","user":{"login":"dhh","id":2741,"avatar_url":"https://avatars.githubusercontent.com/u/2741?v=3","gravatar_id":"","url":"https://api.github.com/users/dhh","html_url":"https://github.com/dhh","followers_url":"https://api.github.com/users/dhh/followers","following_url":"https://api.github.com/users/dhh/following{/other_user}","gists_url":"https://api.github.com/users/dhh/gists{/gist_id}","starred_url":"https://api.github.com/users/dhh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dhh/subscriptions","organizations_url":"https://api.github.com/users/dhh/orgs","repos_url":"https://api.github.com/users/dhh/repos","events_url":"https://api.github.com/users/dhh/events{/privacy}","received_events_url":"https://api.github.com/users/dhh/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rails/rails/labels/railties","name":"railties","color":"8BE06E"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/rails/rails/milestones/49","html_url":"https://github.com/rails/rails/milestones/5.1.0","labels_url":"https://api.github.com/repos/rails/rails/milestones/49/labels","id":1601639,"number":49,"title":"5.1.0","description":"","creator":{"login":"rafaelfranca","id":47848,"avatar_url":"https://avatars.githubusercontent.com/u/47848?v=3","gravatar_id":"","url":"https://api.github.com/users/rafaelfranca","html_url":"https://github.com/rafaelfranca","followers_url":"https://api.github.com/users/rafaelfranca/followers","following_url":"https://api.github.com/users/rafaelfranca/following{/other_user}","gists_url":"https://api.github.com/users/rafaelfranca/gists{/gist_id}","starred_url":"https://api.github.com/users/rafaelfranca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rafaelfranca/subscriptions","organizations_url":"https://api.github.com/users/rafaelfranca/orgs","repos_url":"https://api.github.com/users/rafaelfranca/repos","events_url":"https://api.github.com/users/rafaelfranca/events{/privacy}","received_events_url":"https://api.github.com/users/rafaelfranca/received_events","type":"User","site_admin":false},"open_issues":15,"closed_issues":3,"state":"open","created_at":"2016-02-24T03:19:34Z","updated_at":"2016-05-24T21:45:52Z","due_on":null,"closed_at":null},"comments":17,"created_at":"2016-05-21T13:11:26Z","updated_at":"2016-05-25T07:18:53Z","closed_at":null,"body":"Keeping important secrets in config/secrets.yml isn't a good idea, as all these secrets are stored in plaintext when the file is checked into version control. That's a shame. The application should be able to store actual secrets that it need to talk to internal and external services.\r\n\r\nWe can get there by providing an additional secrets file under config/secrets.yml.enc along with an interface to both edit and read this file.\r\n\r\nTo edit the file, I'm thinking something like:\r\n\r\n```\r\n$ rails secrets:edit\r\n$ Please enter the master key: XXXXXX\r\n$ [Rails opens config/secrets.yml.enc in unencrypted form in EDITOR]\r\n$ [Saving the opened file will encrypt the file back into config/secrets.yml.enc]\r\n```\r\n\r\nTo enable servers and services to read this file, we can set a single environment variable, like RAILS_MASTER_KEY.\r\n\r\nWe should ask for this master key if it's not available when booting the server, if config/secrets.yml.enc is present:\r\n\r\n```\r\n$ rails server\r\n$ Please enter the master key (ENV['RAILS_MASTER_KEY'] is missing): XXXX\r\n```\r\n\r\nNote that config/secrets.yml.enc is in addition to config/secrets.yml. We can still use the latter for secrets that aren't critical, like dev/test secret_base_key. Then it'll become a user-action to add config/secrets.yml.enc (which should be created on-demand the first time `rails secrets:edit` is called). At the initiation time, the user will be asked to set the master key.\r\n\r\nThe two secrets files should then be merged at runtime, with enc taking priority."},"comment":{"url":"https://api.github.com/repos/rails/rails/issues/comments/221492813","html_url":"https://github.com/rails/rails/issues/25095#issuecomment-221492813","issue_url":"https://api.github.com/repos/rails/rails/issues/25095","id":221492813,"user":{"login":"dhh","id":2741,"avatar_url":"https://avatars.githubusercontent.com/u/2741?v=3","gravatar_id":"","url":"https://api.github.com/users/dhh","html_url":"https://github.com/dhh","followers_url":"https://api.github.com/users/dhh/followers","following_url":"https://api.github.com/users/dhh/following{/other_user}","gists_url":"https://api.github.com/users/dhh/gists{/gist_id}","starred_url":"https://api.github.com/users/dhh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dhh/subscriptions","organizations_url":"https://api.github.com/users/dhh/orgs","repos_url":"https://api.github.com/users/dhh/repos","events_url":"https://api.github.com/users/dhh/events{/privacy}","received_events_url":"https://api.github.com/users/dhh/received_events","type":"User","site_admin":false},"created_at":"2016-05-25T07:18:53Z","updated_at":"2016-05-25T07:18:53Z","body":"Agree. Let's start with the straight extension of secrets. We could think about how database.yml could potentially reference an encrypted secret. \n\n> On May 25, 2016, at 08:48, Jeremy Daer <notifications@github.com> wrote:\n> \n> The potential use / distribution of the production master key across development environments raises a red flag, though.\n> \n> Yeah, no. Production secrets floating around dev laptops → 🤐. The unencrypted dev/test vs encrypted prod behavior is what's intended (and proposed). That requires config/secrets.yml to be committed to git for dev/test secrets, presumably of lower sensitivity.\n> \n> Ideally, we could have separate keys for dev/test and prod/staging, suggesting that we have separate secrets files. Database credentials (but not the rest of the database configuration+settings) would be a good fit.\n> \n> This is pretty susceptible to scope creep, though! Limiting this to a straightforward extension of secrets.yml behavior is just enough to ratchet forward a wee bit.\n> \n> —\n> You are receiving this because you were mentioned.\n> Reply to this email directly or view it on GitHub\n> \n"}}
{"actor":{"display_login":"dhh"}}