Secrets in public

secrets.yml

# Be sure to restart your server when you modify this file.

development:
  secret_key_base: 9957f79a6a9842bdc41548ac3b45fe0610acf00d67c81e5fbf9c228c12bc957b6b48a6da8f1ce0312622b1acc9aadb1960908231f07895ba42393026acd6bf4a

test:
  secret_key_base: 389d2335277ce7b02a1db2b5eda898d7f7f6cd604e7714daced0d9ab28c38bfea83b53750880bc30bc21f15b15dce5753f2d92736f9576d756ec17b1867ec5e3

# Do not keep production secrets in the repository,
# instead read values from the environment.
production:
  secret_key_base: <%= ENV['SECRET_KEY_BASE'] %>

database.yml

...
# As with config/secrets.yml, you never want to store sensitive information,
# like your database password, in your source code. If your source code is
# ever seen by anyone, they now have access to your database.
...
#   production:
#     url: <%= ENV['DATABASE_URL'] %>
#
production:
  <<: *default
  database: <%= ENV['DEMO_DATABASE_DATABASE'] %>
  username: <%= ENV['DEMO_DATABASE_USERNAME'] %>
  password: <%= ENV['DEMO_DATABASE_PASSWORD'] %>

Solution 1

Environment Variables

Solution 2

Mina

shared_paths

set :shared_paths, [
  'log', 
  'config/secrets.yml', 
  'config/database.yml'
]

Solution 3

Mina & dotenv

set :shared_paths, [ 'log', ".env.#{rails_env}" ]

SECRET_KEY=YOURSECRETKEYGOESHERE # comment
USER="awesome_joza"
PASS="(╯°□°）╯︵ ┻━┻"

Solution 3

task setup_env: :environment do |t|
  set :term_mode, :pretty
  to :after_hook do
    queue "echo '-----> Copying .env'"
    queue! "scp -P #{port} .env.#{rails_env} \
           #{user}@#{domain}:#{deploy_to}/#{shared_path}/"
  end
end

task :setup => :environment do
  queue! %[mkdir -p "#{deploy_to}/#{shared_path}/log"]
  invoke :setup_env
end

Puppet?

Chef?

Forman?