Rails Credentials และ Secrets ปี 2026: การจัดการตัวแปรสภาพแวดล้อมอย่างปลอดภัย

# เข้าถึง credentials ใน Rails
Rails.application.credentials.aws[:access_key_id]
Rails.application.credentials.dig(:aws, :access_key_id)

# พร้อมค่า fallback
Rails.application.credentials.dig(:stripe, :secret_key) || ENV['STRIPE_SECRET_KEY']

# แก้ไข credentials ด้วย editor เริ่มต้น
RAILS_MASTER_KEY=your_master_key rails credentials:edit

# ใช้ editor ที่ระบุ
EDITOR="code --wait" rails credentials:edit

# แก้ไข credentials สำหรับ environment ที่ระบุ
rails credentials:edit --environment production

# config/credentials.yml.enc (หลังถอดรหัส)
aws:
  access_key_id: AKIAIOSFODNN7EXAMPLE
  secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
  region: ap-southeast-1
  bucket: myapp-production

database:
  host: db.example.com
  username: app_user
  password: secure_password_here

stripe:
  publishable_key: pk_live_xxxxx
  secret_key: sk_live_xxxxx
  webhook_secret: whsec_xxxxx

redis:
  url: redis://user:password@redis.example.com:6379/0

secret_key_base: a1b2c3d4e5f6g7h8i9j0...

# สร้าง credentials สำหรับ development
rails credentials:edit --environment development

# สร้าง credentials สำหรับ staging
rails credentials:edit --environment staging

# สร้าง credentials สำหรับ production
rails credentials:edit --environment production

config/credentials/development.yml.enc
config/credentials/development.key
config/credentials/staging.yml.enc
config/credentials/staging.key
config/credentials/production.yml.enc
config/credentials/production.key

# config/environments/production.rb
config.require_master_key = true

# ใช้ credentials production โดยอัตโนมัติ
# Rails จะค้นหา config/credentials/production.yml.enc
# ด้วย key จาก config/credentials/production.key
# หรือจากตัวแปรสภาพแวดล้อม RAILS_MASTER_KEY

# config/database.yml
production:
  adapter: postgresql
  encoding: unicode
  pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>
  host: <%= Rails.application.credentials.dig(:database, :host) %>
  database: <%= Rails.application.credentials.dig(:database, :name) %>
  username: <%= Rails.application.credentials.dig(:database, :username) %>
  password: <%= Rails.application.credentials.dig(:database, :password) %>
  sslmode: require

# app/lib/app_credentials.rb
class AppCredentials
  class MissingCredentialError < StandardError; end

  class << self
    def aws_access_key_id
      fetch(:aws, :access_key_id)
    end

    def aws_secret_access_key
      fetch(:aws, :secret_access_key)
    end

    def stripe_secret_key
      fetch(:stripe, :secret_key)
    end

    def database_url
      credentials = Rails.application.credentials
      db = credentials.database
      
      "postgresql://#{db[:username]}:#{db[:password]}@#{db[:host]}/#{db[:name]}"
    end

    private

    def fetch(*keys)
      value = Rails.application.credentials.dig(*keys)
      
      if value.nil?
        raise MissingCredentialError, "Missing credential: #{keys.join('.')}"
      end
      
      value
    end
  end
end

# การใช้งานในแอปพลิเคชัน
AWS_CLIENT = Aws::S3::Client.new(
  access_key_id: AppCredentials.aws_access_key_id,
  secret_access_key: AppCredentials.aws_secret_access_key
)

Stripe.api_key = AppCredentials.stripe_secret_key

# config/initializers/credentials_validator.rb
Rails.application.config.after_initialize do
  required_credentials = [
    [:secret_key_base],
    [:aws, :access_key_id],
    [:aws, :secret_access_key],
    [:stripe, :secret_key],
    [:database, :password]
  ]

  missing = required_credentials.select do |keys|
    Rails.application.credentials.dig(*keys).nil?
  end

  if missing.any? && Rails.env.production?
    raise "Missing required credentials: #{missing.map { |k| k.join('.') }.join(', ')}"
  end
end

# lib/tasks/credentials.rake
namespace :credentials do
  desc "Rotate master key and re-encrypt credentials"
  task rotate: :environment do
    require 'securerandom'
    
    # สำรอง credentials ปัจจุบัน
    current_credentials = Rails.application.credentials.config
    
    # สร้าง master key ใหม่
    new_key = SecureRandom.hex(16)
    
    # เขียน key ใหม่
    File.write('config/master.key.new', new_key)
    
    # เข้ารหัสใหม่ด้วย key ใหม่
    encrypted = ActiveSupport::EncryptedConfiguration.new(
      config_path: 'config/credentials.yml.enc.new',
      key_path: 'config/master.key.new',
      env_key: 'RAILS_MASTER_KEY_NEW',
      raise_if_missing_key: true
    )
    
    encrypted.write(current_credentials.to_yaml)
    
    puts "New credentials created. Review and replace old files."
    puts "New master key: #{new_key}"
  end
end

# Dockerfile
FROM ruby:3.3-alpine

WORKDIR /app

# Credentials จะถูกตั้งค่าผ่านตัวแปรสภาพแวดล้อม
# ห้าม copy master.key เข้า image
ENV RAILS_ENV=production

COPY Gemfile Gemfile.lock ./
RUN bundle install --without development test

COPY . .

# Master key ถูกตั้งค่าเมื่อ runtime
CMD ["bundle", "exec", "rails", "server", "-b", "0.0.0.0"]

# docker-compose.yml
services:
  web:
    build: .
    environment:
      - RAILS_MASTER_KEY=${RAILS_MASTER_KEY}
      - RAILS_ENV=production
    secrets:
      - rails_master_key

secrets:
  rails_master_key:
    external: true

# k8s/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: rails-credentials
type: Opaque
stringData:
  RAILS_MASTER_KEY: "your-master-key-here"
---
# k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: rails-app
spec:
  template:
    spec:
      containers:
      - name: rails
        image: myapp:latest
        envFrom:
        - secretRef:
            name: rails-credentials

# config/initializers/configuration.rb
module AppConfig
  class << self
    # ลำดับความสำคัญ: ENV > Credentials > Default
    def database_pool_size
      ENV.fetch('DATABASE_POOL_SIZE') do
        Rails.application.credentials.dig(:database, :pool_size) || 5
      end.to_i
    end

    def redis_url
      ENV.fetch('REDIS_URL') do
        Rails.application.credentials.dig(:redis, :url)
      end
    end

    def secret_key_base
      ENV.fetch('SECRET_KEY_BASE') do
        Rails.application.credentials.secret_key_base
      end
    end
  end
end

# spec/support/credentials_helper.rb
module CredentialsHelper
  def stub_credentials(credentials_hash)
    allow(Rails.application.credentials).to receive(:dig) do |*keys|
      credentials_hash.dig(*keys)
    end
  end
end

RSpec.configure do |config|
  config.include CredentialsHelper
end

# spec/services/payment_service_spec.rb
RSpec.describe PaymentService do
  before do
    stub_credentials({
      stripe: {
        secret_key: 'sk_test_xxx',
        webhook_secret: 'whsec_test_xxx'
      }
    })
  end

  it "processes payment successfully" do
    # test implementation
  end
end

# config/initializers/security.rb

# ป้องกันการ log credentials โดยไม่ตั้งใจ
Rails.application.config.filter_parameters += [
  :password, :secret, :token, :_key, :crypt, :salt,
  :certificate, :otp, :ssn, :api_key, :access_key
]

# Audit logging สำหรับการเข้าถึง credentials
module CredentialsAudit
  def self.log_access(key_path)
    Rails.logger.info(
      "Credentials accessed: #{key_path} by #{caller_locations(2, 1).first}"
    )
  end
end

# lib/tasks/migrate_env.rake
namespace :credentials do
  desc "Migrate .env variables to credentials"
  task migrate_from_env: :environment do
    require 'dotenv'
    
    env_vars = Dotenv.parse('.env.production')
    
    puts "Variables to migrate:"
    env_vars.each { |k, v| puts "  #{k}: #{v[0..5]}..." }
    
    puts "\nAdd these to your credentials file:"
    puts env_vars.transform_keys(&:downcase).to_yaml
  end
end