Multiple production Rails credentials for multiple production servers

[frenkel]

I need a different credentials.yml.env file for every production server. Unfortunately it is not an option to use environment names different from production. How can this be done with Kamal? Maybe it's something that should be done on the Ruby on Rails level, using config.credentials.content_path based on some env variable? (How would I set a different env variable per production server?)

[nickhammond]

@frenkel Are these secrets or clear env variables?

[frenkel]

Thanks. Yes, a separate destination per server would require duplicating the deploy file with only 1 line different. Seems very fragile.
A secret store would still need to distinguish the server, right? That's my problem here, a secret that should differ per server.

[nickhammond]

You could also argue that blocking/requiring access to a real-time secrets service as part of the deploy is more fragile, I'm not sure how connecting a .env and destination to a specific server is fragile.

How many servers are we talking about? What is the use case for what you're trying to do? How do you associate a server to a set of secrets currently? They'd usually still have a role or identifier for this, whether that's the machine name, IP address or tagging with Docker.

[frenkel]

I'm sorry, let me explain. I find it fragile if I have 8 different deploy files which each should contain the exact same 50 lines of code, with each just one line different (the ip-adress). Making changes should be done in all, without forgetting one or mixing things up.

There currently are 8 servers for customer data separation, but the number might grow in the future. We don't use Docker and want to switch to Kamal. Each server currently has a local copy of the Ruby on Rails credentials.yml.enc and master.key files because each server needs a different secret_key_base.

I might be able to give future servers the same secret_key_base, although that sounds less secure to me, for example when one of the servers is compromised the attacker can create custom encrypted cookies for the other servers as well.

[nickhammond]

Got it, that's helpful and let me see if I can clear things up a bit. So you don't need to duplicate those 50 lines to each file, something like this should work:

deploy.yml - Your full deploy details, all 50+ lines.

service: blah
image: blah/awesome
env:
  clear:
    RAILS_ENV: production
  secret:
    - RAILS_MASTER_KEY

# The rest of your deploy setup, no need to setup servers in here.

deploy.production-1.yml - This is the entire file.

servers:
  - 123.0.0.1

.env.production-1

RAILS_MASTER_KEY=23489254ujiusadof

Deploying with:

kamal deploy -d production-1

Repeat for production-2, production-3, etc.

[frenkel]

Didn’t know that, thank you! That seems like the solution to further explore.