From c3a9ac7391640525ae1d5b3b0030498da94ca92b Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Sat, 31 May 2025 10:55:25 -0400 Subject: [PATCH] Create a distinct "beta" environment and move secrets into Rails credentials for both beta and production environments. --- .kamal/secrets.beta | 5 ++--- .kamal/secrets.dhh | 4 ++-- .kamal/secrets.production | 5 ++--- config/cable.yml | 5 ++++- config/cache.yml | 5 ++++- config/credentials.yml.enc | 1 - config/credentials/beta.yml.enc | 1 + config/credentials/production.yml.enc | 1 + config/database.yml | 5 ++++- config/deploy.beta.yml | 4 +++- config/deploy.production.yml | 3 +++ config/deploy.yml | 3 +-- config/environments/beta.rb | 5 +++++ config/queue.yml | 5 ++++- config/recurring.yml | 5 ++++- 15 files changed, 40 insertions(+), 17 deletions(-) delete mode 100644 config/credentials.yml.enc create mode 100644 config/credentials/beta.yml.enc create mode 100644 config/credentials/production.yml.enc create mode 100644 config/environments/beta.rb diff --git a/.kamal/secrets.beta b/.kamal/secrets.beta index ef220785d..60d911ced 100644 --- a/.kamal/secrets.beta +++ b/.kamal/secrets.beta @@ -1,6 +1,5 @@ -SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Beta/SECRET_KEY_BASE Beta/OPEN_AI_API_KEY) +SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Beta/RAILS_MASTER_KEY) GITHUB_TOKEN=$(gh config get -h github.com oauth_token) BASECAMP_REGISTRY_PASSWORD=$(kamal secrets extract BASECAMP_REGISTRY_PASSWORD $SECRETS) -SECRET_KEY_BASE=$(kamal secrets extract SECRET_KEY_BASE $SECRETS) -OPEN_AI_API_KEY=$(kamal secrets extract OPEN_AI_API_KEY $SECRETS) +RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY $SECRETS) diff --git a/.kamal/secrets.dhh b/.kamal/secrets.dhh index b427fe0c2..60d911ced 100644 --- a/.kamal/secrets.dhh +++ b/.kamal/secrets.dhh @@ -1,5 +1,5 @@ -SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Production/SECRET_KEY_BASE) +SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Beta/RAILS_MASTER_KEY) GITHUB_TOKEN=$(gh config get -h github.com oauth_token) BASECAMP_REGISTRY_PASSWORD=$(kamal secrets extract BASECAMP_REGISTRY_PASSWORD $SECRETS) -SECRET_KEY_BASE=$(kamal secrets extract SECRET_KEY_BASE $SECRETS) +RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY $SECRETS) diff --git a/.kamal/secrets.production b/.kamal/secrets.production index 8ac9f1e7c..b6d71edd3 100644 --- a/.kamal/secrets.production +++ b/.kamal/secrets.production @@ -1,6 +1,5 @@ -SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Production/SECRET_KEY_BASE Production/OPEN_AI_API_KEY) +SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Production/RAILS_MASTER_KEY) GITHUB_TOKEN=$(gh config get -h github.com oauth_token) BASECAMP_REGISTRY_PASSWORD=$(kamal secrets extract BASECAMP_REGISTRY_PASSWORD $SECRETS) -SECRET_KEY_BASE=$(kamal secrets extract SECRET_KEY_BASE $SECRETS) -OPEN_AI_API_KEY=$(kamal secrets extract OPEN_AI_API_KEY $SECRETS) +RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY $SECRETS) diff --git a/config/cable.yml b/config/cable.yml index 41e5f322d..535a25fe7 100644 --- a/config/cable.yml +++ b/config/cable.yml @@ -12,5 +12,8 @@ development: test: adapter: test -production: +production: &production <<: *cable + +beta: + <<: *production diff --git a/config/cache.yml b/config/cache.yml index 4b41834ab..c4fb2c2ae 100644 --- a/config/cache.yml +++ b/config/cache.yml @@ -17,6 +17,9 @@ development: test: <<: *default_options -production: +production: &production <<: *default_connection <<: *default_options + +beta: + <<: *production diff --git a/config/credentials.yml.enc b/config/credentials.yml.enc deleted file mode 100644 index 8112d68b5..000000000 --- a/config/credentials.yml.enc +++ /dev/null @@ -1 +0,0 @@ -5ZoHBjwBHPiVvPcnI4khzagL3ZR54mfvv5VdRLjDicl0s/6hGKd88rwmSb/8WOITFSDQZntfFcJ4/xlH8ZLr2az51/7CJr9J1QSJUCBexDtTpqa4g7/+s2TW1YDrLg3LybtVzuGcTVL2YE4llcW+5RLI6JuioAQQ0Sx9hGqd6n5/safGW/OXrBPS198b3YmPeAkSm4uA4L7yOmQYaeweJp1p47WSrgh5bnesttx+ey0L7nMSwWKj/pBFEP5N0ELQXm4G38RYf3SUsoAQkUl+TIsMHvFz3/toeS0+tuEvKeDQYlvXCyVTK4XHsvbu8pkOvZGBpDgkvW3aMOBTf/Bsrv0ylU1gF3pGs2Oc90KOmKxBmHbuOOS5VpNTYhZ6IPEaMz9t5rDYlYVupPQ6TTNrn4jAvq6f--InMaBENysICzAQUu--mMpwA+kXMLs3j/zWoA0NMA== \ No newline at end of file diff --git a/config/credentials/beta.yml.enc b/config/credentials/beta.yml.enc new file mode 100644 index 000000000..e8e9f14df --- /dev/null +++ b/config/credentials/beta.yml.enc @@ -0,0 +1 @@ +t6ny1JCvKxJ8bNWGATiCM7DxrxC8Zu6NkrDYmad+Lk1OeisO6uYzizMZ94dwJfun2Na09V+clw7nKhx6Gk6kG5jykfSoaegu355xzGUDHrmeAov5RSe2znytTNgVDuh9YSJTJUnF+ntDSRE3yzXXeG4+ytb6WVwl2tHQrRKuXDc0Mk3mmxb1yqFSjb7EdREMHrmZQ0nvM+nNpBmnfe7Cn8lr92IApPpCWyk0qVyoHY5sCSneaXRuQusqWUMvhCMC3C/2LmjW5oKbzlWLicH4YQo0/SNYS0wclNJMvN0M23BcLvWu0JIaLpOHmFPJB7Kp--69iYHxd7qLsiOxpm--GmtDrSgvzIOvSczwWWdIhQ== \ No newline at end of file diff --git a/config/credentials/production.yml.enc b/config/credentials/production.yml.enc new file mode 100644 index 000000000..bb8d1a2db --- /dev/null +++ b/config/credentials/production.yml.enc @@ -0,0 +1 @@ +Qfchpaf23CQC2m4NQ5sUeAlHdflPAFCIcrlTjNB41VJjr202jgAu38nof8MWHhUBOn1RLvrLvW3JALT0uP9q9pkYFvsr3bONw11Dtz6DDEO2ZurjS4Blv0u8MGYS/igdb9N3X/yZDpfolgJS9lYYEj2S21s7BtLLBc5aDrYLC3HHstZoMkGCGh9126tMucIdhNdf4au4A36llTfNeWV7K136MgeoacfoqfsfJu0H53I+HxiuGiAcXSm2WSjBKa0EIuzPzD+Rq02xNhVOE5s0xsv9JlgTulwHrCLAIEw9Yx4DkEoiz0SIpwj5SvPXPdQF--aBcwo7pQVCIiV2UH--quPq/fEI5YPKcSu68LypyA== \ No newline at end of file diff --git a/config/database.yml b/config/database.yml index d9584de0b..a242b1555 100644 --- a/config/database.yml +++ b/config/database.yml @@ -37,7 +37,7 @@ test: database: storage/tenants/<%= Rails.env %>/%{tenant}/db/main.sqlite3 tenanted: true -production: +production: &production primary: <<: *default database: storage/tenants/<%= Rails.env %>/%{tenant}/db/main.sqlite3 @@ -62,3 +62,6 @@ production: <<: *default database: storage/production_queue.sqlite3 migrations_paths: db/queue_migrate + +beta: + <<: *production diff --git a/config/deploy.beta.yml b/config/deploy.beta.yml index 52249bbcd..9f384148b 100644 --- a/config/deploy.beta.yml +++ b/config/deploy.beta.yml @@ -10,6 +10,9 @@ proxy: hosts: - fizzy.37signals.works # the single tenant is named "fizzy" +env: + clear: + RAILS_ENV: beta x-beamer-accessory: &beamer-accessory image: basecamp/beamer @@ -22,7 +25,6 @@ x-beamer-accessory: &beamer-accessory volumes: - fizzy:/storage - accessories: beamer-primary: <<: *beamer-accessory diff --git a/config/deploy.production.yml b/config/deploy.production.yml index 6263ee89e..3f2102f95 100644 --- a/config/deploy.production.yml +++ b/config/deploy.production.yml @@ -16,6 +16,9 @@ proxy: ssh: user: app +env: + clear: + RAILS_ENV: production x-beamer-accessory: &beamer-accessory image: basecamp/beamer diff --git a/config/deploy.yml b/config/deploy.yml index aa2f04862..d80015ed7 100644 --- a/config/deploy.yml +++ b/config/deploy.yml @@ -23,8 +23,7 @@ builder: env: secret: - - SECRET_KEY_BASE - - OPEN_AI_API_KEY + - RAILS_MASTER_KEY aliases: console: app exec -i --reuse "bin/rails console" diff --git a/config/environments/beta.rb b/config/environments/beta.rb new file mode 100644 index 000000000..7325cd37a --- /dev/null +++ b/config/environments/beta.rb @@ -0,0 +1,5 @@ +require_relative "production" + +Rails.application.configure do + config.action_mailer.default_url_options = { host: "%{tenant}.37signals.works" } +end diff --git a/config/queue.yml b/config/queue.yml index 9eace59c4..ecab73581 100644 --- a/config/queue.yml +++ b/config/queue.yml @@ -14,5 +14,8 @@ development: test: <<: *default -production: +production: &production <<: *default + +beta: + <<: *production diff --git a/config/recurring.yml b/config/recurring.yml index 7be0c716a..6862cfd5c 100644 --- a/config/recurring.yml +++ b/config/recurring.yml @@ -1,4 +1,4 @@ -production: +production: &production auto_close_all_due: class: Card::AutoCloseAllDueJob schedule: every hour @@ -14,3 +14,6 @@ production: delete_unused_tags: class: DeleteUnusedTagsJob schedule: every day at 04:00 + +beta: + <<: *production