Merge pull request #554 from basecamp/flavorjones/real-beta-environment

Create a distinct "beta" environment and move secrets into Rails credentials

.kamal/secrets.beta

@@ -1,6 +1,5 @@
-SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Beta/SECRET_KEY_BASE Beta/OPEN_AI_API_KEY)
+SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Beta/RAILS_MASTER_KEY)
 
 GITHUB_TOKEN=$(gh config get -h github.com oauth_token)
 BASECAMP_REGISTRY_PASSWORD=$(kamal secrets extract BASECAMP_REGISTRY_PASSWORD $SECRETS)
-SECRET_KEY_BASE=$(kamal secrets extract SECRET_KEY_BASE $SECRETS)
-OPEN_AI_API_KEY=$(kamal secrets extract OPEN_AI_API_KEY $SECRETS)
+RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY $SECRETS)

.kamal/secrets.dhh

@@ -1,5 +1,5 @@
-SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Production/SECRET_KEY_BASE)
+SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Beta/RAILS_MASTER_KEY)
 
 GITHUB_TOKEN=$(gh config get -h github.com oauth_token)
 BASECAMP_REGISTRY_PASSWORD=$(kamal secrets extract BASECAMP_REGISTRY_PASSWORD $SECRETS)
-SECRET_KEY_BASE=$(kamal secrets extract SECRET_KEY_BASE $SECRETS)
+RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY $SECRETS)

.kamal/secrets.production

@@ -1,6 +1,5 @@
-SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Production/SECRET_KEY_BASE Production/OPEN_AI_API_KEY)
+SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Production/RAILS_MASTER_KEY)
 
 GITHUB_TOKEN=$(gh config get -h github.com oauth_token)
 BASECAMP_REGISTRY_PASSWORD=$(kamal secrets extract BASECAMP_REGISTRY_PASSWORD $SECRETS)
-SECRET_KEY_BASE=$(kamal secrets extract SECRET_KEY_BASE $SECRETS)
-OPEN_AI_API_KEY=$(kamal secrets extract OPEN_AI_API_KEY $SECRETS)
+RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY $SECRETS)

config/cable.yml

@@ -12,5 +12,8 @@ development:
 test:
   adapter: test
 
-production:
+production: &production
   <<: *cable
+
+beta:
+  <<: *production

config/cache.yml

@@ -17,6 +17,9 @@ development:
 test:
   <<: *default_options
 
-production:
+production: &production
   <<: *default_connection
   <<: *default_options
+
+beta:
+  <<: *production

config/credentials.yml.enc

@@ -1 +0,0 @@
-5ZoHBjwBHPiVvPcnI4khzagL3ZR54mfvv5VdRLjDicl0s/6hGKd88rwmSb/8WOITFSDQZntfFcJ4/xlH8ZLr2az51/7CJr9J1QSJUCBexDtTpqa4g7/+s2TW1YDrLg3LybtVzuGcTVL2YE4llcW+5RLI6JuioAQQ0Sx9hGqd6n5/safGW/OXrBPS198b3YmPeAkSm4uA4L7yOmQYaeweJp1p47WSrgh5bnesttx+ey0L7nMSwWKj/pBFEP5N0ELQXm4G38RYf3SUsoAQkUl+TIsMHvFz3/toeS0+tuEvKeDQYlvXCyVTK4XHsvbu8pkOvZGBpDgkvW3aMOBTf/Bsrv0ylU1gF3pGs2Oc90KOmKxBmHbuOOS5VpNTYhZ6IPEaMz9t5rDYlYVupPQ6TTNrn4jAvq6f--InMaBENysICzAQUu--mMpwA+kXMLs3j/zWoA0NMA==

config/credentials/beta.yml.enc

@@ -0,0 +1 @@
+t6ny1JCvKxJ8bNWGATiCM7DxrxC8Zu6NkrDYmad+Lk1OeisO6uYzizMZ94dwJfun2Na09V+clw7nKhx6Gk6kG5jykfSoaegu355xzGUDHrmeAov5RSe2znytTNgVDuh9YSJTJUnF+ntDSRE3yzXXeG4+ytb6WVwl2tHQrRKuXDc0Mk3mmxb1yqFSjb7EdREMHrmZQ0nvM+nNpBmnfe7Cn8lr92IApPpCWyk0qVyoHY5sCSneaXRuQusqWUMvhCMC3C/2LmjW5oKbzlWLicH4YQo0/SNYS0wclNJMvN0M23BcLvWu0JIaLpOHmFPJB7Kp--69iYHxd7qLsiOxpm--GmtDrSgvzIOvSczwWWdIhQ==

config/credentials/production.yml.enc

@@ -0,0 +1 @@
+Qfchpaf23CQC2m4NQ5sUeAlHdflPAFCIcrlTjNB41VJjr202jgAu38nof8MWHhUBOn1RLvrLvW3JALT0uP9q9pkYFvsr3bONw11Dtz6DDEO2ZurjS4Blv0u8MGYS/igdb9N3X/yZDpfolgJS9lYYEj2S21s7BtLLBc5aDrYLC3HHstZoMkGCGh9126tMucIdhNdf4au4A36llTfNeWV7K136MgeoacfoqfsfJu0H53I+HxiuGiAcXSm2WSjBKa0EIuzPzD+Rq02xNhVOE5s0xsv9JlgTulwHrCLAIEw9Yx4DkEoiz0SIpwj5SvPXPdQF--aBcwo7pQVCIiV2UH--quPq/fEI5YPKcSu68LypyA==

config/database.yml

@@ -37,7 +37,7 @@ test:
   database: storage/tenants/<%= Rails.env %>/%{tenant}/db/main.sqlite3
   tenanted: true
 
-production:
+production: &production
   primary:
     <<: *default
     database: storage/tenants/<%= Rails.env %>/%{tenant}/db/main.sqlite3
@@ -62,3 +62,6 @@ production:
     <<: *default
     database: storage/production_queue.sqlite3
     migrations_paths: db/queue_migrate
+
+beta:
+  <<: *production

config/deploy.beta.yml

@@ -10,6 +10,9 @@ proxy:
   hosts:
     - fizzy.37signals.works # the single tenant is named "fizzy"
 
+env:
+  clear:
+    RAILS_ENV: beta
 
 x-beamer-accessory: &beamer-accessory
   image: basecamp/beamer
@@ -22,7 +25,6 @@ x-beamer-accessory: &beamer-accessory
   volumes:
     - fizzy:/storage
 
-
 accessories:
   beamer-primary:
     <<: *beamer-accessory

config/deploy.production.yml

@@ -16,6 +16,9 @@ proxy:
 ssh:
   user: app
 
+env:
+  clear:
+    RAILS_ENV: production
 
 x-beamer-accessory: &beamer-accessory
   image: basecamp/beamer

config/deploy.yml

@@ -23,8 +23,8 @@ builder:
 
 env:
   secret:
-    - SECRET_KEY_BASE
-    - OPEN_AI_API_KEY
+    - RAILS_MASTER_KEY
 
 aliases:
   console: app exec -i --reuse "bin/rails console"
+  ssh: app exec -i --reuse /bin/bash

config/environments/beta.rb

@@ -0,0 +1,5 @@
+require_relative "production"
+
+Rails.application.configure do
+  config.action_mailer.default_url_options = { host: "%{tenant}.37signals.works" }
+end

config/queue.yml

@@ -14,5 +14,8 @@ development:
 test:
   <<: *default
 
-production:
+production: &production
   <<: *default
+
+beta:
+  <<: *production

config/recurring.yml

@@ -1,4 +1,4 @@
-production:
+production: &production
   auto_close_all_due:
     class: Card::AutoCloseAllDueJob
     schedule: every hour
@@ -14,3 +14,6 @@ production:
   delete_unused_tags:
     class: DeleteUnusedTagsJob
     schedule: every day at 04:00
+
+beta:
+  <<: *production