How to protect database credentials in an .yml database

Question

How to protect connection credentials that are used in config/database.yml . How to protect username, password, host information for my db settings.

 local: &local adapter: mysql2 encoding: utf8 reconnect: false username: foo password: bar host: localhost 

Answer 1

No. At some point you should insert this material, and it should be in the clear.

This is usually a problem during deployment, when you do not want anyone who has read access to the repository to see the db configuration for the deployment servers.

I worked on this with a special capistrano task that copies (or symbolizes) the .yml database from the server’s home directory to the application. (So ​​there is an empty database.yml in my repo, and it becomes overridden whenever I publish a new version with a secret version that is already on the server)

I wrote about this here: http://www.tigraine.at/2011/09/25/securely-managing-database-yml-when-deploying-with-capistrano/

As for not sharing this in development: just put database.yml in your .gitignore and it won't be committed