Closed benarmston closed 1 year ago
This PR is sufficient to fix the database access issues for a new deployment. Unfortunately, it doesn't work when updating an existing deployment as new active record encryption keys are created.
In more detail:
The solution is to either:
Commit the config/credentials.yml.enc
to the git repo and keep the master key a secret. Each deployment will need to provide the master key either through docker environment, docker secrets or some other mechanism. This is the standard Rails solution, but would result in each deployment using the same master key.
Alternatively, if we have a programmatic means of creating all of the credentials in config/credentials.yml.enc
, then would could require that each deployment create their own master key and provide it through docker environment, docker secrets or some other mechanism. Then the build (or a post build) process would create the config/credentials.yml.enc
using the provided master key. This would require that each deployment is resposible for safely storing the master key. If its lost, data may become inaccessible.
Another alternative, would be to use docker volumes to store config/credentials.yml.enc
and/or the master key.
ActiveRecord::Encryption::Errors::Decryption
messages. Presumably due to good job running in development where the encryption keys are unset.