Hiding my sensitive information (e.g. password) fr

Question

I just set up Devise (rails authentication plugin) to send a confirmation email upon sign up. This involved my putting the following into my environment.rb file:

ActionMailer::Base.delivery_method = :smtp
ActionMailer::Base.smtp_settings = {
   :tls => true,
   :address => "smtp.gmail.com",
   :port => 587,
   :domain => "gmail.com",
   :authentication => :login,
   :user_name => "[my email]",
   :password => "[my pass]"
 }

I obviously don't want to push this up to github with [my pass] just sitting there. Is there a standard practice here?

Answer 1

The standard is to put your configuration settings in one YAML file which isn't included in your repo.

Then you simply get the data from it.

Check Railscast "#85 YAML Configuration File" to see it in action.

Answer 2

apneadiving is correct, adding to his solution, other folks downloading your code, may won't figure out quickly how to generate this yml, so you'll need to give them a hint, by having the following structure:

config
  |
  |--- environment.rb
  |--- mail_settings.yml
  |--- main_settings.yml.example

Having the file 'mail_settings.yml' contains your sensitive information and NOT included in the repo, and have 'main_settings.yml.example' included in your repo, and having the same structure as 'mail_settings.yml'.

And to be more helpful, provide a section in you README file, describing that people need to copy the mail_settings.yml.example file to mail_settings.yml and enhance it's content.

Answer 3

Create a config file containing the mail settings and load them from a file. Check in the config file with all the settings erased. Have your application check to see if the file is filled in, and if it is not, display an error and exit gracefully (or disable mailing, just make sure that the user knows what is going on).

This has the added advantage that users can easily change mail settings without having to edit code. Telling a user to edit the code to set a configuration is, in general, a bad idea. Also, you can keep the configuration in a separate location from the code so it is easier to get to.