when you have secret key in your project, how can pushing to GitHub be possible?
I am trying to push a brand new, empty Rail 3.0.4 project to GitHub, but just realize that the cookie session store has a secret key:
- Making a Git project open source when you have secret keys
- Managing secret keys
- Installed jenkins 2.19.2 pkg and it says to enter InitialAdminPassword from the secrets folder.Unable to find password
- How to deal with passwords, API keys, etc in development stack? (git, webservers, etc)
- How are environmental variables safer than secrets.yml
- How to manage secrets in a Microservice / Container / Cloud environment?
NewRuby192Rails304Proj::Application.config.secret_token = '22e8...'
So how can we avoid it being push to GitHub? We can ignore this file (using
.gitignore), but without this file, a Rails app won’t run at all (and is not a complete Rails app). Or in general, other files or frameworks may have files containing secret keys too. In such case, how should it be handled when pushing to GitHub?
4 Solutions collect form web for “when you have secret key in your project, how can pushing to GitHub be possible?”
Add in your repo:
- a template of it (
- a script able to generate a proper config file
secret_token.rbbased on local data found on the server (like an encrypted file with the secret value ready to be decoded and put in the
From there, add a git attribute custom driver:
The script referenced above will be your ‘
smudge‘ script which will, on checkout of the working tree, generate automatically the right file.
Put the secret key in some sort of external config file. Thats what we do.
There are several external tools, which do exactly that. Basically, these tools encrypt the file with your private data and store it in the VCS, but ignore the original unencrypted file.
One of the most known and trusted is
blackbox. It uses
gpg to encrypt your files and works with both
hg. By the way, it is created by SO team. Have a look at the alternatives section, it has at least five other tools.
I can also recommend you a tool called
git-secret, it also uses
gpg. But it works only with
git. The main advantage is that the workflow is much easier compared to other tools.
You could risk trusting Github’s security/privacy if it is a private repository .. or:
– Pull the data from a configuration file on the server. For example, if you use Capistrano for deployment, you can add a step that copies the configuration file from somewhere on the server.
– Use an environment variable.