CODEWITHSUNDEEP
ruby-on-railsruby-on-rails-5.1
krsyoung
krsyoung

Reputation: 1241

Rails 5 not loading encrypted secrets in production.rb

I have a project configured to use Rails encrypted secrets. Everything works fine until I try to access a secret within the production.rb environment file.

I found that if I try to access something like Rails.application.secrets.smtp_user_name within the configure block it wipes out all of the encrypted secrets (I'm only left with things in secrets.yml ... which I'm not using). Example:

Loading production environment (Rails 5.1.2)
irb(main):001:0> Rails.application.secrets
=> {:secret_key_base=>nil, :secret_token=>nil}

If I remove the attempt to access the secrets it works correctly:

irb(main):001:0> Rails.application.secrets
=> {:secret_key_base=>"...", :smtp_user_name=>"...", :smtp_password=>"...", :secret_token=>nil}

I'm currently working around it by using two configure blocks in production.rb as follows:

# This is hacky, it needs to come before the second configure block where
# the encrypted secrets are used.
Rails.application.configure do
  config.read_encrypted_secrets = true
end

Rails.application.configure do
 ... stuff that uses Rails.application.secrets, like ActionMailer
end

Anybody else faced this and possibly have a more correct way to work around it?

It makes sense why this is happening (Rails doesn't know to load the encrypted secrets because we haven't told it to you), but I'm thinking there must be a better way to deal with it.

Update

This nailed me again 9 months later. To be clear, if you reference Rails.application.secrets BEFORE calling config.read_encrypted_secrets = true you will cache empty secrets and not be able to access any of the values in secrets.yml.enc!

In my case I had tried to configure Paperclip S3 credentials in application.rb while my config.read_encrypted_secrets = true was set in production.rb. Result was devise.rb blowing up trying to read a secret for the key base, all because in application.rb I had effectively cached nil secrets.

Upvotes: 0

Views: 1143

Answers (1)

Paul Jurasek
Paul Jurasek

Reputation: 26

here is bug report related to your issue:

https://github.com/rails/rails/issues/30362#issuecomment-326821656

In general even if you have all things set up properly you need check also order how your application loads secrets. If your application ask first for Rails.application.secrets and then set proper flag... Rails.application.secrets will cache version without secrets... and Secrets from secret.yml.enc will not be merge.

Upvotes: 1

Related Questions