Managing security for an open source rails 3 application stored at github

Question

New to rails, open source and soon ready for deploying to a production environment, I have some security considerations.

How to handle the database.yml is covered pretty good by, how-to-manage-rails-database-yml

But from my point of view there are more configuration settings in a normal rails application that shouldn't be hosted in a public github repository and deployed to production e.g.

• devise.rb -> config.pepper
• secret_token.rb -> Application.config.secret_token
• capistrano -> deploy.rb
• ...

Adding config/****/* to .gitignore would not only prevent new developers from bundle install, db:create, db:migrate, rails server but also to keep the production config up to date if a new gem with an initializer is installed.

Another possibility would be add an environment.yml with sensitive config, like database.yml where sensitive configuration in the initializers will be overridden?

This will make it easy to get up and running after a clean checkout and the production environment will be easy to maintain.

Any ideas how to approach my problems above?

Answer 1

I usually put "safe" data in these files, which will usually work for development purposes. But in production I symlink the files to another location with capistrano, like this:

invoke_command "ln -sf #{shared_path}/database.yml #{release_path}/config/database.yml"

So in the production server I have a bunch of files that override the files in source control. I don't even work with a database.yml.example, just some sane default database.yml that the developers agree upon to use in development and test.

For individual settings, like API keys, I usually create a config/settings.yml and read them from inside the initializer:

SETTINGS = YAML.load(IO.read(Rails.root.join("config", "settings.yml")))
YourApp::Application.config.secret_token = SETTINGS["secret_token"]