Rails Credentials va Secrets 2026: Quan ly Bien moi truong An toan

# Truy cap credentials trong Rails
Rails.application.credentials.aws[:access_key_id]
Rails.application.credentials.dig(:aws, :access_key_id)

# Voi gia tri fallback
Rails.application.credentials.dig(:stripe, :secret_key) || ENV['STRIPE_SECRET_KEY']

# Chinh sua credentials voi trinh soan thao mac dinh
RAILS_MASTER_KEY=your_master_key rails credentials:edit

# Su dung trinh soan thao cu the
EDITOR="code --wait" rails credentials:edit

# Chinh sua credentials cho environment cu the
rails credentials:edit --environment production

# config/credentials.yml.enc (sau khi giai ma)
aws:
  access_key_id: AKIAIOSFODNN7EXAMPLE
  secret_access_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
  region: ap-southeast-1
  bucket: myapp-production

database:
  host: db.example.com
  username: app_user
  password: secure_password_here

stripe:
  publishable_key: pk_live_xxxxx
  secret_key: sk_live_xxxxx
  webhook_secret: whsec_xxxxx

redis:
  url: redis://user:password@redis.example.com:6379/0

secret_key_base: a1b2c3d4e5f6g7h8i9j0...

# Tao credentials cho development
rails credentials:edit --environment development

# Tao credentials cho staging
rails credentials:edit --environment staging

# Tao credentials cho production
rails credentials:edit --environment production

config/credentials/development.yml.enc
config/credentials/development.key
config/credentials/staging.yml.enc
config/credentials/staging.key
config/credentials/production.yml.enc
config/credentials/production.key

# config/environments/production.rb
config.require_master_key = true

# Su dung credentials production tu dong
# Rails se tim config/credentials/production.yml.enc
# voi key tu config/credentials/production.key
# hoac tu bien moi truong RAILS_MASTER_KEY

# config/database.yml
production:
  adapter: postgresql
  encoding: unicode
  pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>
  host: <%= Rails.application.credentials.dig(:database, :host) %>
  database: <%= Rails.application.credentials.dig(:database, :name) %>
  username: <%= Rails.application.credentials.dig(:database, :username) %>
  password: <%= Rails.application.credentials.dig(:database, :password) %>
  sslmode: require

# app/lib/app_credentials.rb
class AppCredentials
  class MissingCredentialError < StandardError; end

  class << self
    def aws_access_key_id
      fetch(:aws, :access_key_id)
    end

    def aws_secret_access_key
      fetch(:aws, :secret_access_key)
    end

    def stripe_secret_key
      fetch(:stripe, :secret_key)
    end

    def database_url
      credentials = Rails.application.credentials
      db = credentials.database
      
      "postgresql://#{db[:username]}:#{db[:password]}@#{db[:host]}/#{db[:name]}"
    end

    private

    def fetch(*keys)
      value = Rails.application.credentials.dig(*keys)
      
      if value.nil?
        raise MissingCredentialError, "Missing credential: #{keys.join('.')}"
      end
      
      value
    end
  end
end

# Su dung trong ung dung
AWS_CLIENT = Aws::S3::Client.new(
  access_key_id: AppCredentials.aws_access_key_id,
  secret_access_key: AppCredentials.aws_secret_access_key
)

Stripe.api_key = AppCredentials.stripe_secret_key

# config/initializers/credentials_validator.rb
Rails.application.config.after_initialize do
  required_credentials = [
    [:secret_key_base],
    [:aws, :access_key_id],
    [:aws, :secret_access_key],
    [:stripe, :secret_key],
    [:database, :password]
  ]

  missing = required_credentials.select do |keys|
    Rails.application.credentials.dig(*keys).nil?
  end

  if missing.any? && Rails.env.production?
    raise "Missing required credentials: #{missing.map { |k| k.join('.') }.join(', ')}"
  end
end

# lib/tasks/credentials.rake
namespace :credentials do
  desc "Rotate master key and re-encrypt credentials"
  task rotate: :environment do
    require 'securerandom'
    
    # Sao luu credentials hien tai
    current_credentials = Rails.application.credentials.config
    
    # Tao master key moi
    new_key = SecureRandom.hex(16)
    
    # Ghi key moi
    File.write('config/master.key.new', new_key)
    
    # Ma hoa lai voi key moi
    encrypted = ActiveSupport::EncryptedConfiguration.new(
      config_path: 'config/credentials.yml.enc.new',
      key_path: 'config/master.key.new',
      env_key: 'RAILS_MASTER_KEY_NEW',
      raise_if_missing_key: true
    )
    
    encrypted.write(current_credentials.to_yaml)
    
    puts "New credentials created. Review and replace old files."
    puts "New master key: #{new_key}"
  end
end

# Dockerfile
FROM ruby:3.3-alpine

WORKDIR /app

# Credentials se duoc thiet lap qua bien moi truong
# KHONG copy master.key vao image
ENV RAILS_ENV=production

COPY Gemfile Gemfile.lock ./
RUN bundle install --without development test

COPY . .

# Master key duoc thiet lap khi runtime
CMD ["bundle", "exec", "rails", "server", "-b", "0.0.0.0"]

# docker-compose.yml
services:
  web:
    build: .
    environment:
      - RAILS_MASTER_KEY=${RAILS_MASTER_KEY}
      - RAILS_ENV=production
    secrets:
      - rails_master_key

secrets:
  rails_master_key:
    external: true

# k8s/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: rails-credentials
type: Opaque
stringData:
  RAILS_MASTER_KEY: "your-master-key-here"
---
# k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: rails-app
spec:
  template:
    spec:
      containers:
      - name: rails
        image: myapp:latest
        envFrom:
        - secretRef:
            name: rails-credentials

# config/initializers/configuration.rb
module AppConfig
  class << self
    # Uu tien: ENV > Credentials > Default
    def database_pool_size
      ENV.fetch('DATABASE_POOL_SIZE') do
        Rails.application.credentials.dig(:database, :pool_size) || 5
      end.to_i
    end

    def redis_url
      ENV.fetch('REDIS_URL') do
        Rails.application.credentials.dig(:redis, :url)
      end
    end

    def secret_key_base
      ENV.fetch('SECRET_KEY_BASE') do
        Rails.application.credentials.secret_key_base
      end
    end
  end
end

# spec/support/credentials_helper.rb
module CredentialsHelper
  def stub_credentials(credentials_hash)
    allow(Rails.application.credentials).to receive(:dig) do |*keys|
      credentials_hash.dig(*keys)
    end
  end
end

RSpec.configure do |config|
  config.include CredentialsHelper
end

# spec/services/payment_service_spec.rb
RSpec.describe PaymentService do
  before do
    stub_credentials({
      stripe: {
        secret_key: 'sk_test_xxx',
        webhook_secret: 'whsec_test_xxx'
      }
    })
  end

  it "processes payment successfully" do
    # test implementation
  end
end

# config/initializers/security.rb

# Ngan chan logging credentials mot cach vo tinh
Rails.application.config.filter_parameters += [
  :password, :secret, :token, :_key, :crypt, :salt,
  :certificate, :otp, :ssn, :api_key, :access_key
]

# Audit logging cho viec truy cap credentials
module CredentialsAudit
  def self.log_access(key_path)
    Rails.logger.info(
      "Credentials accessed: #{key_path} by #{caller_locations(2, 1).first}"
    )
  end
end

# lib/tasks/migrate_env.rake
namespace :credentials do
  desc "Migrate .env variables to credentials"
  task migrate_from_env: :environment do
    require 'dotenv'
    
    env_vars = Dotenv.parse('.env.production')
    
    puts "Variables to migrate:"
    env_vars.each { |k, v| puts "  #{k}: #{v[0..5]}..." }
    
    puts "\nAdd these to your credentials file:"
    puts env_vars.transform_keys(&:downcase).to_yaml
  end
end