{"action":"created","issue":{"url":"https://api.github.com/repos/rails/rails/issues/25095","repository_url":"https://api.github.com/repos/rails/rails","labels_url":"https://api.github.com/repos/rails/rails/issues/25095/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/25095/comments","events_url":"https://api.github.com/repos/rails/rails/issues/25095/events","html_url":"https://github.com/rails/rails/issues/25095","id":156101357,"number":25095,"title":"Provide encrypted secrets","user":{"login":"dhh","id":2741,"avatar_url":"https://avatars.githubusercontent.com/u/2741?v=3","gravatar_id":"","url":"https://api.github.com/users/dhh","html_url":"https://github.com/dhh","followers_url":"https://api.github.com/users/dhh/followers","following_url":"https://api.github.com/users/dhh/following{/other_user}","gists_url":"https://api.github.com/users/dhh/gists{/gist_id}","starred_url":"https://api.github.com/users/dhh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dhh/subscriptions","organizations_url":"https://api.github.com/users/dhh/orgs","repos_url":"https://api.github.com/users/dhh/repos","events_url":"https://api.github.com/users/dhh/events{/privacy}","received_events_url":"https://api.github.com/users/dhh/received_events","type":"User","site_admin":false},"labels":[{"id":107195,"url":"https://api.github.com/repos/rails/rails/labels/railties","name":"railties","color":"8BE06E","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/rails/rails/milestones/49","html_url":"https://github.com/rails/rails/milestones/5.1.0","labels_url":"https://api.github.com/repos/rails/rails/milestones/49/labels","id":1601639,"number":49,"title":"5.1.0","description":"","creator":{"login":"rafaelfranca","id":47848,"avatar_url":"https://avatars.githubusercontent.com/u/47848?v=3","gravatar_id":"","url":"https://api.github.com/users/rafaelfranca","html_url":"https://github.com/rafaelfranca","followers_url":"https://api.github.com/users/rafaelfranca/followers","following_url":"https://api.github.com/users/rafaelfranca/following{/other_user}","gists_url":"https://api.github.com/users/rafaelfranca/gists{/gist_id}","starred_url":"https://api.github.com/users/rafaelfranca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rafaelfranca/subscriptions","organizations_url":"https://api.github.com/users/rafaelfranca/orgs","repos_url":"https://api.github.com/users/rafaelfranca/repos","events_url":"https://api.github.com/users/rafaelfranca/events{/privacy}","received_events_url":"https://api.github.com/users/rafaelfranca/received_events","type":"User","site_admin":false},"open_issues":23,"closed_issues":16,"state":"open","created_at":"2016-02-24T03:19:34Z","updated_at":"2016-11-05T22:22:00Z","due_on":null,"closed_at":null},"comments":32,"created_at":"2016-05-21T13:11:26Z","updated_at":"2016-11-14T16:51:22Z","closed_at":null,"body":"Keeping important secrets in config/secrets.yml isn't a good idea, as all these secrets are stored in plaintext when the file is checked into version control. That's a shame. The application should be able to store actual secrets that it need to talk to internal and external services.\n\nWe can get there by providing an additional secrets file under config/secrets.yml.enc along with an interface to both edit and read this file.\n\nTo edit the file, I'm thinking something like:\n\n```\n$ rails secrets:edit\n$ Please enter the master key: XXXXXX\n$ [Rails opens config/secrets.yml.enc in unencrypted form in EDITOR]\n$ [Saving the opened file will encrypt the file back into config/secrets.yml.enc]\n```\n\nTo enable servers and services to read this file, we can set a single environment variable, like RAILS_MASTER_KEY.\n\nWe should ask for this master key if it's not available when booting the server, if config/secrets.yml.enc is present:\n\n```\n$ rails server\n$ Please enter the master key (ENV['RAILS_MASTER_KEY'] is missing): XXXX\n```\n\nNote that config/secrets.yml.enc is in addition to config/secrets.yml. We can still use the latter for secrets that aren't critical, like dev/test secret_base_key. Then it'll become a user-action to add config/secrets.yml.enc (which should be created on-demand the first time `rails secrets:edit` is called). At the initiation time, the user will be asked to set the master key.\n\nThe two secrets files should then be merged at runtime, with enc taking priority.\n"},"comment":{"url":"https://api.github.com/repos/rails/rails/issues/comments/260391335","html_url":"https://github.com/rails/rails/issues/25095#issuecomment-260391335","issue_url":"https://api.github.com/repos/rails/rails/issues/25095","id":260391335,"user":{"login":"dhh","id":2741,"avatar_url":"https://avatars.githubusercontent.com/u/2741?v=3","gravatar_id":"","url":"https://api.github.com/users/dhh","html_url":"https://github.com/dhh","followers_url":"https://api.github.com/users/dhh/followers","following_url":"https://api.github.com/users/dhh/following{/other_user}","gists_url":"https://api.github.com/users/dhh/gists{/gist_id}","starred_url":"https://api.github.com/users/dhh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dhh/subscriptions","organizations_url":"https://api.github.com/users/dhh/orgs","repos_url":"https://api.github.com/users/dhh/repos","events_url":"https://api.github.com/users/dhh/events{/privacy}","received_events_url":"https://api.github.com/users/dhh/received_events","type":"User","site_admin":false},"created_at":"2016-11-14T16:51:22Z","updated_at":"2016-11-14T16:51:22Z","body":"@BenMorganIO I don't think it's a good idea to export a global like that on a machine that runs multiple apps. Idea is that you'd start the server with that export, not keep it in .bash_profile."}}
{"actor":{"display_login":"dhh"}}