是
引用来自 trails of tobsuctions ob objection ：
rails将秘密存储在 config/recertentials.enc.enc 中，该>已加密，因此无法直接编辑。 Rails使用 config/master.key 或其他寻找环境变量 env [“ rails_master_key”] 来加密凭据文件。由于凭据文件已加密，只要主键保持安全。
要编辑凭据文件，运行 bin/rails凭据：编辑。如果不存在此命令将创建凭据文件。此外，此命令将创建 config/master.key 如果未定义主密钥。
可以通过 rails.application.credentials 。
访问凭据文件中的秘密
我的想法是：
- 将所有秘密在存储库中加密；
- 只有本地
master.key （或仅一个Env变量）；
- 一次手动传递到生产服务器
master.key ;
- 然后通过自动部署过程通过git传递其他秘密。
Are the Python analogs of encrypted credentials Rails feature?
Quote from Rails Guides on subject:
Rails stores secrets in config/credentials.yml.enc, which is encrypted and hence cannot be edited directly. Rails uses config/master.key or alternatively looks for the environment variable ENV["RAILS_MASTER_KEY"] to encrypt the credentials file. Because the credentials file is encrypted, it can be stored in version control, as long as the master key is kept safe.
To edit the credentials file, run bin/rails credentials:edit. This command will create the credentials file if it does not exist. Additionally, this command will create config/master.key if no master key is defined.
Secrets kept in the credentials file are accessible via Rails.application.credentials.
My idea is:
- to have all the secrets encrypted in repository;
- to have locally only
master.key (or only one env variable);
- to once pass manually to production server
master.key;
- then pass other secrets by git through automated deployment process.
发布评论
评论（1）
有像铁路的加密凭证一样的作品，但我还没有看到它在我从事的任何项目中使用过。
通常，我会看到使用
os.environ的环境变量：软件包也非常受欢迎，通常与
.env文件一起使用。我没有自己使用过，但是 dynaconf 似乎也很受欢迎。
There is https://github.com/nzaillian/django-encrypted-secrets that works like Rail's encrypted credentials, but I haven't seen it used in any projects I've worked on.
Usually I see environment variables being used and accessed using
os.environ:The django-environ package is also very popular and is often used together with
.envfiles.I haven't used it myself, but dynaconf also seems popular.