openflighthpc / concertim-ansible-playbook

Ansible playbook for building a Concertim appliance
Eclipse Public License 2.0
0 stars 0 forks source link

Run goodjob in production mode #61

Closed benarmston closed 1 year ago

benarmston commented 1 year ago
benarmston commented 1 year ago

This PR is sufficient to fix the database access issues for a new deployment. Unfortunately, it doesn't work when updating an existing deployment as new active record encryption keys are created.

In more detail:

  1. When concertim is first deployed, the visualisation service is built and as part of that process the active record encryption keys are created. The database is also created and migrated, which involved use of those encryption keys.
  2. Updating to a new deployment involves rebuiding the visualisation service and as part of that process the active record encryption keys are re-created. These re-creted keys are not compatible with the keys previously used.

The solution is to either:

Commit the config/credentials.yml.enc to the git repo and keep the master key a secret. Each deployment will need to provide the master key either through docker environment, docker secrets or some other mechanism. This is the standard Rails solution, but would result in each deployment using the same master key.

Alternatively, if we have a programmatic means of creating all of the credentials in config/credentials.yml.enc, then would could require that each deployment create their own master key and provide it through docker environment, docker secrets or some other mechanism. Then the build (or a post build) process would create the config/credentials.yml.enc using the provided master key. This would require that each deployment is resposible for safely storing the master key. If its lost, data may become inaccessible.

Another alternative, would be to use docker volumes to store config/credentials.yml.enc and/or the master key.