Untrack secret_key_base
Closed this issue · 3 comments
jtwalters commented
If you happen to share your code publicly, make sure your secret_key_base value is kept private. (http://markdblackwell.blogspot.com/2013/06/ongoing-open-source-rails-secrettoken.html)
proglottis commented
I use the rails cache session strore instead of signed cookies for this exact reason. Despite this, config.secret_key_base
is still required.
I am however looking for a nice way to setup my database.yml and still be able to deploy from my public repo. I fear I might have to go via the chef/puppet route.
jtwalters commented
What about copying your database.yml into shared/config (capistrano-style) and then symlink the file after deploy:update_code? I tried that and it seems to work.
proglottis commented
Fixed with deae4a3