when you have secret key in your project, how can pushing to GitHub be possible?

Question

I am trying to push a brand new, empty Rail 3.0.4 project to GitHub, but just realize that the cookie session store has a secret key:

In config/initializers/secret_token.rb

NewRuby192Rails304Proj::Application.config.secret_token = '22e8...'

So how can we avoid it being push to GitHub? We can ignore this file (using .gitignore), but without this file, a Rails app won't run at all (and is not a complete Rails app). Or in general, other files or frameworks may have files containing secret keys too. In such case, how should it be handled when pushing to GitHub?

Answer 1

Add in your repo:

• a template of it (secret_token.rb.template),
• a script able to generate a proper config file secret_token.rb based on local data found on the server (like an encrypted file with the secret value ready to be decoded and put in the secret_token.rb file)

From there, add a git attribute custom driver:

The script referenced above will be your 'smudge' script which will, on checkout of the working tree, generate automatically the right file.

Answer 2

Put the secret key in some sort of external config file. Thats what we do.

Answer 3

There are several external tools, which do exactly that. Basically, these tools encrypt the file with your private data and store it in the VCS, but ignore the original unencrypted file.

One of the most known and trusted is blackbox. It uses gpg to encrypt your files and works with both git and hg. By the way, it is created by SO team. Have a look at the alternatives section, it has at least five other tools.

I can also recommend you a tool called git-secret, it also uses gpg. But it works only with git. The main advantage is that the workflow is much easier compared to other tools.

Answer 4

You could risk trusting Github's security/privacy if it is a private repository .. or:
- Pull the data from a configuration file on the server. For example, if you use Capistrano for deployment, you can add a step that copies the configuration file from somewhere on the server.
- Use an environment variable.