Ruby-on-rails Rails 生产 - 如何设置密钥库？

Rails Production - How to set Secret Key Base?

提问by nvrpicurnose

So I am trying to get my rails app to deploy in production mode, but I get the error: Missing secret_tokenand secret_key_basefor 'production' environment, set these values in config/secrets.yml

所以我试图让我的 rails 应用程序在生产模式下部署，但我收到错误：缺少secret_token，secret_key_base对于“生产”环境，将这些值设置在config/secrets.yml

My secrets.yml file is as expected:

我的 secrets.yml 文件符合预期：

development:
  secret_key_base: xxxxxxx

test:
  secret_key_base: xxxxxxx

production:
  secret_key_base: <%= ENV["SECRET_KEY_BASE"] %>

But even after google and research, I have no idea what to do with the production secret key base. Most of the info out there assumes I have certain background knowledge, but the reality is that I'm a noob.

但即使在谷歌和研究之后，我也不知道如何处理生产密钥库。大多数信息都假设我有一定的背景知识，但现实是我是一个菜鸟。

Can anyone explain to me how to set my secret key and get this to work in production mode?

谁能向我解释如何设置我的密钥并使其在生产模式下工作？

回答by Tarun Rathi

You can generate the key by using following commands

您可以使用以下命令生成密钥

$ irb
>> require 'securerandom'
=> true
>> SecureRandom.hex(64)
=> "3fe397575565365108556c3e5549f139e8078a8ec8fd2675a83de96289b30550a266ac04488d7086322efbe573738e7b3ae005b2e3d9afd718aa337fa5e329cf"
>> exit

回答by n0rm

The errors you are getting just indicate that the environment variable for secret_key_baseare not properly set on the server.

您收到的错误仅表明服务器上的环境变量secret_key_base设置不正确。

You can use various scripts like capistrano that automate the process of setting these before the application is ran.

您可以使用各种脚本（如 capistrano）在应用程序运行之前自动设置这些脚本。

As for a quick fix try this:

至于快速修复试试这个：

export SECRET_KEY_BASE=YOUR SECRET BASE

Validate the environment variables and check if these have been set.

验证环境变量并检查是否已设置这些变量。

Command:

命令：

env | grep -E "SECRET_TOKEN|SECRET_KEY_BASE"

env | grep -E "SECRET_TOKEN|SECRET_KEY_BASE"

If your values pop up then these are set on the production server.

如果您的值弹出，则这些值是在生产服务器上设置的。

Also it is best practice to use ENV.fetch(SECRET_KEY)as this will raise an exception before the app even tries to start.

此外，最好的做法是使用，ENV.fetch(SECRET_KEY)因为这会在应用程序甚至尝试启动之前引发异常。

回答by matias salgado

This answer helped me a lot. He indicates you how to config the secrets.yml file in production and how to read it from the environment:

这个答案对我帮助很大。他向您指示如何在生产中配置 secrets.yml 文件以及如何从环境中读取它：

original link: https://stackoverflow.com/a/26172408/4962760

原文链接：https: //stackoverflow.com/a/26172408/4962760

I had the same problem and I solved it by creating an environment variable to be loaded every time that I logged in to the production server and made a mini guide of the steps to configure it:

https://gist.github.com/pablosalgadom/4d75f30517edc6230a67

I was using Rails 4.1 with Unicorn v4.8.2, when I tried to deploy my app it didn't start properly and in the unicorn.log file I found this error message:

"app error: Missing secret_key_base for 'production' environment, set this value in config/secrets.yml (RuntimeError)"

After some research I found out that Rails 4.1 changed the way to manage the secret_key, so if you read the secrets.yml file located at [exampleRailsProject]/config/secrets.yml you'll find something like this:

Do not keep production secrets in the repository,

instead read values from the environment. production: secret_key_base: <%= ENV["SECRET_KEY_BASE"] %> This means that rails

recommends you to use an environment variable for the secret_key_base in your production server, in order to solve this error you should follow this steps to create an environment variable for Linux (in my case Ubuntu) in your production server:

1.- In the terminal of your production server execute the next command:

$ RAILS_ENV=production rake secret This returns a large string with letters and numbers, copy that (we will refer to that code as GENERATED_CODE).

2.1- Login as root user to your server, find this file and edit it: $ vi /etc/profile

Go to the bottom of the file ("SHIFT + G" for capital G in VI)

Write your environment variable with the GENERATED_CODE (Press "i" key to write in VI), be sure to be in a new line at the end of the file:

export SECRET_KEY_BASE=GENERATED_CODE Save the changes and close the file (we push "ESC" key and then write ":x" and "ENTER" key for save and exit in VI)

2.2 But if you login as normal user, lets call it example_user for this gist, you will need to find one of this other files:

$ vi ~/.bash_profile $ vi ~/.bash_login $ vi ~/.profile These files are in order of importance, that means that if you have the first file, then you wouldn't need to write in the others. So if you found this 2 files in your directory "~/.bash_profile" and "~/.profile" you only will have to write in the first one "~/.bash_profile", because Linux will read only this one and the other will be ignored.

Then we go to the bottom of the file ("SHIFT + G" for capital G in VI)

And we will write our environment variable with our GENERATED_CODE (Press "i" key to write in VI), be sure to be in a new line at the end of the file:

export SECRET_KEY_BASE=GENERATED_CODE Having written the code, save the changes and close the file (we push "ESC" key and then write ":x" and "ENTER" key for save and exit in VI)

3.- You can verify that our environment variable is properly set in Linux with this command:

$ printenv | grep SECRET_KEY_BASE or with:

$ echo $SECRET_KEY_BASE When you execute this command, if everything went ok, it will show you the GENERATED_CODE from before. Finally with all the configuration done you should be able to deploy without problems your Rails app with Unicorn or other.

When you close your shell terminal and login again to the production server you will have this environment variable set and ready to use it.

And thats it!! I hope this mini guide help you to solve this error.

Disclaimer: I'm not a Linux or Rails guru, so if you find something wrong or any error I will be glad to fix it!

我遇到了同样的问题，我通过创建一个环境变量来解决它，每次登录到生产服务器时都要加载它，并制作了一个配置它的步骤的迷你指南：

https://gist.github.com/pablosalgadom/4d75f30517edc6230a67

我在 Unicorn v4.8.2 中使用 Rails 4.1，当我尝试部署我的应用程序时，它没有正确启动，在 unicorn.log 文件中我发现了以下错误消息：

“应用程序错误：‘生产’环境缺少 secret_key_base，请在 config/secrets.yml (RuntimeError) 中设置此值”

经过一番研究，我发现 Rails 4.1 改变了管理 secret_key 的方式，所以如果你阅读位于 [exampleRailsProject]/config/secrets.yml 的 secrets.yml 文件，你会发现如下内容：

不要在存储库中保留生产机密，

而是从环境中读取值。生产：secret_key_base：<%= ENV["SECRET_KEY_BASE"] %> 这意味着rails

建议您在生产服务器中为 secret_key_base 使用环境变量，为了解决此错误，您应该按照以下步骤在生产服务器中为 Linux（在我的情况下为 Ubuntu）创建环境变量：

1.- 在您的生产服务器的终端中执行下一个命令：

$ RAILS_ENV=production rake secret 这将返回一个包含字母和数字的大字符串，复制该字符串（我们将该代码称为 GENERATED_CODE）。

2.1- 以 root 用户身份登录到您的服务器，找到这个文件并编辑它： $ vi /etc/profile

转到文件底部（VI 中大写 G 的“SHIFT + G”）

使用 GENERATED_CODE 写入您的环境变量（在 VI 中按“i”键写入），确保在文件末尾的新行中：

export SECRET_KEY_BASE=GENERATED_CODE 保存更改并关闭文件（我们按“ESC”键，然后在VI中写入“:x”和“ENTER”键以保存并退出）

2.2 但是，如果您以普通用户身份登录，在此要点中将其命名为 example_user，您将需要找到其他文件之一：

$ vi ~/.bash_profile $ vi ~/.bash_login $ vi ~/.profile 这些文件是按重要性排序的，这意味着如果你有第一个文件，那么你就不需要写其他文件了。所以如果你在你的目录“~/.bash_profile”和“~/.profile”中找到这两个文件，你只需要写第一个“~/.bash_profile”，因为Linux只会读取这个和另一个将被忽略。

然后我们转到文件的底部（“SHIFT + G”代表VI中的大写G）

我们将使用 GENERATED_CODE 写入我们的环境变量（在 VI 中按“i”键写入），确保在文件末尾的新行中：

export SECRET_KEY_BASE=GENERATED_CODE 写完代码，保存更改并关闭文件（我们在VI中按“ESC”键然后写“:x”和“ENTER”键保存退出）

3.- 您可以使用以下命令验证我们的环境变量是否在 Linux 中正确设置：

$ 打印环境 | grep SECRET_KEY_BASE 或：

$ echo $SECRET_KEY_BASE 当你执行这个命令时，如果一切顺利，它会显示之前的 GENERATED_CODE。最后，完成所有配置后，您应该可以毫无问题地使用 Unicorn 或其他方式部署 Rails 应用程序。

当您关闭 shell 终端并再次登录到生产服务器时，您将设置此环境变量并准备好使用它。

就是这样！！我希望这个迷你指南可以帮助您解决这个错误。

免责声明：我不是 Linux 或 Rails 专家，所以如果您发现错误或任何错误，我很乐意修复它！

回答by RedBassett

As you can see, there is a hardcoded value for the developmentand testenvironments, but the one for productioncomes from a variable. First of all, why this way? It is a security feature. This way, if you check this file into version control such as git or svn, the developmentand testvalues get shared, which is fine, but the productionone (the one that would be used on a real website) isn't, so no one can look at the source to get that secret.

如您所见，developmentandtest环境有一个硬编码值，但 forproduction来自变量。首先，为什么要这样？这是一个安全功能。这样，如果您将此文件签入版本控制（例如 git 或 svn），则development和test值将被共享，这很好，但是production（将在真实网站上使用的那个）不是，因此没有人可以查看来源以获取该秘密。

As for the variable used, ENV["SECRET_KEY_BASE"], this is an environment variable from the environment Rails is run in (not to be confused with the Rails "environment", such as development, test, and production). These environment variables come from the shell. As mentioned in JensD's post, you can set this environment variable temporarily with:

至于使用的变量ENV["SECRET_KEY_BASE"]，这是来自 Rails 运行环境的环境变量（不要与 Rails 的“环境”混淆，例如development、test、 和production）。这些环境变量来自shell。正如JensD的帖子中提到的，您可以使用以下命令临时设置此环境变量：

export SECRET_TOKEN=YOUR SECRET TOKEN
export SECRET_KEY_TOKEN=YOUR SECRET BASE

To generate a new secret token, use the rake secretcommand in the command line.

要生成新的秘密令牌，请使用rake secret命令行中的命令。

That is temporary, however, and not a good final solution. For a final solution, check out this articlewhich has a quick bit near the end on implementing dotenvto load configuration secrets. Remember, if you use version control, be sure to exclude your .envfile from being checked in!

然而，这是暂时的，并不是一个好的最终解决方案。对于最终的解决方案，请查看这篇文章，该文章接近尾声，介绍了如何实现dotenv以加载配置机密。请记住，如果您使用版本控制，请务必将您的.env文件排除在检入之外！

Setting dotenv up takes a little bit of work, but I highly recommend it over trying to manually configure these environment variables.

设置 dotenv 需要一些工作，但我强烈建议您尝试手动配置这些环境变量。

回答by localhostdotdev

nowadays (rails 6) rails generate a secret key base in tmp/development_secret.txtfor you.

现在（rails 6）railstmp/development_secret.txt为您生成一个密钥库。

and in production environment the best is having SECRET_KEY_BASEas en env variable, it will get picked up by rails.

在生产环境中，最好的环境SECRET_KEY_BASE变量是 en env 变量，它会被 rails 获取。

you can check with Rails.application.secret_key_base.

你可以用Rails.application.secret_key_base.

should give you a long string of numbers and characters from 'a' to 'f' (a 128 chars long hexadecimal encoded string)

应该给你一长串从“a”到“f”的数字和字符（一个 128 个字符的十六进制编码字符串）