Put the Rails application in public git, keep personal data private

I have a Rails application that is not really a “collaborative” application, but I would still like to host it in a public git (hub) repository. What for? Well, mainly because I really want to share the code with other interested people working in my field. A free github repo won't hurt, but if I really didn't want to share the code, I would just pay for it, of course.

base context

So the problem is saving 'private' data from git repo. What is personal data? Well, Rails does a pretty good job of isolating them. Sometimes they are separate files, such as. /config/database.yml or several other files (not the default Rails) ./ config / x. In other cases, unfortunately, there may be single lines in files with the desired desire, but are not sure about it.

Now I ask you NOT to help find all places that are 'private' in your Rails3 application. No, this was just some context for the underlying problem.

easy way to manage private material

What I am actually asking is to propose using mechanisms to store personal things “somewhere else” and merging them into an application extracted from the git public repository.

I know the main idea: "Well, keep them somewhere else, of your choice, and then copy them." But, yes, where? (another private git repo? Shared file system?) and how to manage the "copy"? rubies / rails people like to automate things and automate best practices, I think that this requires a tool, or at least someone who has suggestions for best practices?

what I want

  • It should be very simple . So simple that I can leave instructions for hypothetically barely competent colleagues covering application deployment (combining public repo with private data), as well as changing / adding / fixing "private data".

  • It should cover entire "private data" files and, ideally, also separate lines in other public files, although this may not be necessary, an ideal tool / process will do this.

  • The application will be deployed / tested / installed on several hosts and should be easy to test on a completely new host without any special configuration on that host. Similarly, with any host account. As a normal git check is not a problem in these circumstances, right?

  • snapshot / dependency management. Here you can sacrifice, but it would be nice. Private configuration changes sometimes, right? With the usual “single git repo” setup, your personal data is instantly deleted and managed along with all the rest of the code. It’s easy to understand which version of the “personal data” configuration comes with which version of the rest of the code, because it’s just automatic - you perform a git check on a specific snapshot, and you get, well, the state of the whole code, including the personal data in this snapshot. It would be nice to keep this feature with the plan "private data in a separate place", so you can still find out which version of the private data comes with exactly that git snapshot .... but this may not be possible. ** This requirement first made me think about "oh, just use the git submodules, personal data in the private git repository, public git repo links to it with the git submodule." This will work if the "personal data" was a single directory (this entire directory and only this directory), but I'm not sure what the case is with the Rails application. Ideally, some of. / config can be shared, and personal data can be somewhere else. But I suppose that one option would be to simply make sure that all personal data is in “config” and keep ALL the configuration 'private', even if you really don't need it. Not ideal if there is a better solution, but I believe this is one approach.

So?

Any ideas? Are there tools that already exist for this? It's good? Or, if not tools, suggestions for approaches or best practices? (If I can find a killer way to make it elegant and powerful, I could write a tool to automate it. Right now I'm still not sure what the “right” way to do it.)

+4
source share
2 answers
  • Refactor all the 'private' single liners in the constants defined in config / secrets.yml and all your "secret" files in config / secrets /. Pack them in a baseball and distribute it privately with your employees. To unravel these secrets, save the tarball md5sum in a version file, for example. config /secrets.tar.md5. Write a rake command that extends the tarball over your application only if md5sum matches the version of md5sum with the version.
  • You can encrypt each of these secret files with a symmetric key, and then distribute only the key, but this puts your secrets publicly (albeit in encrypted form) and relies on everyone who has +, correctly using something like GPG.
  • In the first case, deploying the application using secrets will be as simple as moving the tar ball to the right place and performing the rake task.
  • You can include md5sum in the tarball file name, which means that from the secrets.tar.md5 version in the repo, you can determine the specific secrets associated with this version.
0
source

If you need to share your project with the public, I would share the secrets in a separate GEM, which is posted on bitbucket.org and give each employee:

  • Own account (maximum 5 free) or
  • Common username / password or
  • SSH key

If you do not need to share, I would use bitbucket.org for the whole project, since free accounts only allow private projects.

0
source

Source: https://habr.com/ru/post/1396919/


All Articles