How to deploy heroku app with secret yaml configur

Question

In other rails projects, I'd have a local database.yml and in source code repository only commit the database.sample file. When deploying, a capistrano script that would symlink a shared version of database.yml to all the releases.

When deploying to heroku, git is used and they seem to override database.yml altogether and do something internal.

That's all fine and good for database.yml, but what if I have s3 configurations in config/s3.yml. And I'm putting my project on github so I don't want to commit the s3.yml where everyone can see my credentials. It'd rather commit a sample s3.sample which people will override with their own settings, and keep a local s3.yml file uncommitted in my working directory.

what is the best way to handle this?

Answer 1

Store the s3 credentials in environment variables.

$ cd myapp
$ heroku config:add S3_KEY=8N029N81 S3_SECRET=9s83109d3+583493190
Adding config vars:
  S3_KEY    => 8N029N81
  S3_SECRET => 9s83109d3+583493190
Restarting app...done.

In your app:

AWS::S3::Base.establish_connection!(
  :access_key_id     => ENV['S3_KEY'],
  :secret_access_key => ENV['S3_SECRET']
)

See the Heroku Config Vars documentation which explain development setup etc.

Answer 2

An alternative solution is to create a new local-branch where you modify .gitignore so secret-file can be pushed to heroku. DON'T push this branch to your Github repo.

To push non-master branch to heroku, use:

git push heroku secret-branch:master

More info can be found on:
https://devcenter.heroku.com/articles/multiple-environments#advanced-linking-local-branches-to-remote-apps

Use heroku run bash and then ls to check whether your secret-file have been pushed on to heroku or not

Answer 3

You can also check out the Figaro gem.

Answer 4

If using Rails 4.1 beta, try the heroku_secrets gem, from https://github.com/alexpeattie/heroku_secrets:

gem 'heroku_secrets', github: 'alexpeattie/heroku_secrets'

This lets you store secret keys in Rails 4.1's config/secrets.yml (which is not checked in to source control) and then just run

rake heroku:secrets RAILS_ENV=production

to make its contents available to heroku (it parses your secrets.yml file and pushes everything in it to heroku as environment variables, per the heroku best practice docs).

Answer 5

Heroku have some guidance on this -

http://devcenter.heroku.com/articles/config-vars