Rails Credentials와 Secrets 2026년 가이드: 환경 변수 보안 관리 방법

# credentials 파일 편집하기
RAILS_MASTER_KEY=your-master-key rails credentials:edit

# 또는 에디터를 지정하여 편집
EDITOR="code --wait" rails credentials:edit

# 프로덕션 환경용 credentials 생성 및 편집
rails credentials:edit --environment production

# 스테이징 환경용 credentials 생성 및 편집
rails credentials:edit --environment staging

# 개발 환경용 credentials 생성 및 편집
rails credentials:edit --environment development

# config/credentials/production.yml.enc 내용 예시 (복호화 후)
aws:
  access_key_id: AKIAIOSFODNN7EXAMPLE
  secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
  region: ap-northeast-2
  bucket: myapp-production-assets

database:
  host: production-db.example.com
  username: myapp_prod
  password: super_secure_password_here

stripe:
  publishable_key: pk_live_xxxxx
  secret_key: sk_live_xxxxx
  webhook_secret: whsec_xxxxx

redis:
  url: redis://production-redis.example.com:6379/0

secret_key_base: a1b2c3d4e5f6...

# config/initializers/aws.rb
Aws.config.update(
  region: Rails.application.credentials.dig(:aws, :region),
  credentials: Aws::Credentials.new(
    Rails.application.credentials.dig(:aws, :access_key_id),
    Rails.application.credentials.dig(:aws, :secret_access_key)
  )
)

# Stripe 설정
Stripe.api_key = Rails.application.credentials.dig(:stripe, :secret_key)

# app/services/payment_service.rb
class PaymentService
  def initialize
    @api_key = Rails.application.credentials.stripe[:secret_key]
    @webhook_secret = Rails.application.credentials.stripe[:webhook_secret]
  end

  def process_payment(amount:, customer_id:)
    Stripe::PaymentIntent.create(
      amount: amount,
      currency: 'krw',
      customer: customer_id
    )
  end
end

# config/database.yml
default: &default
  adapter: postgresql
  encoding: unicode
  pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>

development:
  <<: *default
  database: myapp_development

production:
  <<: *default
  host: <%= Rails.application.credentials.dig(:database, :host) %>
  database: <%= Rails.application.credentials.dig(:database, :name) %>
  username: <%= Rails.application.credentials.dig(:database, :username) %>
  password: <%= Rails.application.credentials.dig(:database, :password) %>
  pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 10 } %>

# .gitignore에 반드시 마스터 키 추가
echo "config/master.key" >> .gitignore
echo "config/credentials/*.key" >> .gitignore

# Heroku의 경우
heroku config:set RAILS_MASTER_KEY=$(cat config/credentials/production.key)

# AWS ECS의 경우 (Secrets Manager 사용)
aws secretsmanager create-secret \
  --name myapp/production/rails-master-key \
  --secret-string "$(cat config/credentials/production.key)"

# Docker의 경우
docker run -e RAILS_MASTER_KEY=your-key-here myapp:latest

# app/lib/app_credentials.rb
class AppCredentials
  class MissingCredentialError < StandardError; end

  class << self
    def aws
      @aws ||= OpenStruct.new(credentials.aws || {})
    end

    def stripe
      @stripe ||= OpenStruct.new(credentials.stripe || {})
    end

    def database
      @database ||= OpenStruct.new(credentials.database || {})
    end

    def fetch(*keys)
      value = credentials.dig(*keys)
      raise MissingCredentialError, "Credential not found: #{keys.join('.')}" if value.nil?
      value
    end

    private

    def credentials
      Rails.application.credentials
    end
  end
end

# 사용 예시
AppCredentials.aws.access_key_id
AppCredentials.stripe.secret_key
AppCredentials.fetch(:stripe, :webhook_secret)

# config/initializers/configuration.rb
module MyApp
  class Configuration
    def self.stripe_api_key
      ENV['STRIPE_API_KEY'] || Rails.application.credentials.dig(:stripe, :secret_key)
    end

    def self.database_url
      ENV['DATABASE_URL'] || build_database_url
    end

    private

    def self.build_database_url
      creds = Rails.application.credentials.database
      return nil unless creds

      "postgresql://#{creds[:username]}:#{creds[:password]}@#{creds[:host]}/#{creds[:name]}"
    end
  end
end

# .github/workflows/test.yml
name: Test

on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest

    env:
      RAILS_ENV: test
      RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}

    steps:
      - uses: actions/checkout@v4

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.4'
          bundler-cache: true

      - name: Run tests
        run: |
          bundle exec rails db:prepare
          bundle exec rspec

# config/initializers/verify_credentials.rb
if Rails.env.production?
  required_credentials = [
    [:stripe, :secret_key],
    [:stripe, :webhook_secret],
    [:aws, :access_key_id],
    [:aws, :secret_access_key],
    [:database, :password]
  ]

  missing = required_credentials.reject do |keys|
    Rails.application.credentials.dig(*keys).present?
  end

  if missing.any?
    raise "Missing required credentials: #{missing.map { |k| k.join('.') }.join(', ')}"
  end
end

# spec/rails_helper.rb
RSpec.configure do |config|
  config.before(:each) do
    allow(Rails.application.credentials).to receive(:dig)
      .with(:stripe, :secret_key)
      .and_return('sk_test_xxx')
  end
end

# config/initializers/security.rb

# 1. 프로덕션 환경에서는 반드시 secret_key_base 설정
if Rails.env.production? && Rails.application.credentials.secret_key_base.blank?
  raise 'secret_key_base is not set in production credentials!'
end

# 2. 기밀 정보의 로그 출력 방지
Rails.application.config.filter_parameters += [
  :password, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn,
  :api_key, :access_key, :secret_key
]

# 3. 암호화되지 않은 기밀 정보 탐지
if Rails.env.development?
  Dir.glob('config/**/*.yml').each do |file|
    content = File.read(file)
    if content.match?(/password:\s*['"]?[^<]/) && !file.end_with?('.enc')
      Rails.logger.warn "Potential unencrypted secret in #{file}"
    end
  end
end

#!/bin/bash
# scripts/rotate_credentials.sh

# 현재 credentials 백업
cp config/credentials/production.yml.enc config/credentials/production.yml.enc.backup
cp config/credentials/production.key config/credentials/production.key.backup

# 새 키로 credentials 재암호화
RAILS_ENV=production rails credentials:edit --environment production

# 새 마스터 키를 안전한 곳에 저장
echo "New master key: $(cat config/credentials/production.key)"
echo "Update this key in your deployment secrets!"