Repository navigation
Missing encryption key to decrypt file with. Ask your team for your master key and write it to /rails/config/master.key or put it in the ENV['RAILS_MASTER_KEY'] #261
Description
Testing using MRSK 0.11.0
Please bear with me as I am working through numerous MRSK setup issues and I am new to MRSK and relatively new to Docker.
Initially started building this app using the default config/deploy.yml file, making small tweeks and re-testing each time as I worked through various issues.
Somewhere along the way, I uncommented this code in the deploy.yml file:
(1)
env:
secret:
- RAILS_MASTER_KEY
Note that I just uncommented the code, leaving the characters RAILS_MASTER_KEY as just a string. It is not clear to me reading the instructions and default of the file whether it should have been replaced by my real master key (or not?).
I was confused by the comment in the default file that reads: "(secrets come from .env)" which made me think that the string RAILS_MASTER_KEY would get replaced by the secret in the .env file.
Somewhere along the way, someone on SLACK suggested this as a way to bring your Ruby version, bundler version, and secret key into the MRSK setup:
(2)
builder:
args:
RUBY_VERSION: "<%= Pathname.pwd.join('.ruby-version').read.strip.delete_prefix('ruby-') %>"
BUNDLER_VERSION: "<%= Bundler::LockfileParser.new(Pathname.pwd.join('Gemfile.lock').read).bundler_version %>"
RAILS_MASTER_KEY: "<%= ENV['RAILS_MASTER_KEY'] %>"
(Notice that these are builder args, not env secret)
Should I also do this same syntax for env secret configured in config/deploy.yml?
If I do this:
(3)
env:
secret:
- "<%= ENV['RAILS_MASTER_KEY'] %>"
then I can no longer do anything with MRSK at all --it's like I'm borked now --- mrsk lock release and mrsk deploy both now tell me:
ERROR (KeyError): key not found: "f0e5e49fXXXXXXXXXXXXXXXXXXXXXX"
(rest of key has been obscured for privacy but I confirmed it matches my real secret key. )
If I use the original syntax (#1), then the lock mechanism works as expected to release the lock, but when I try to deploy, I get:
> [linux/arm64 build 10/10] RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile:
#0 0.977 Missing encryption key to decrypt file with. Ask your team for your master key and write it to /rails/config/master.key or put it in the ENV['RAILS_MASTER_KEY'].
------
Dockerfile:53
--------------------
51 |
52 | # Precompiling assets for production without requiring secret RAILS_MASTER_KEY
53 | >>> RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile
54 |
55 |
Note that in production.rb this line has been UNCOMMENTED:
config.require_master_key = true
as well, my app contains config/master.key (but it is not being copied into the container by Dockerfile), and my app also has the RAILS_MASTER_KEY set as an .env variable.
if I locally run RAILS_ENV=production rails s, I get these result:
3.1.2 :005 > Rails.application.credentials.key_file_contents
=> nil
3.1.2 :006 > Rails.application.credentials.env_key
=> "RAILS_MASTER_KEY"
3.1.2 :007 > Rails.application.credentials.key_file_contents
=> nil
3.1.2 :008 > ENV['RAILS_MASTER_KEY']
=> nil
if I instead run RAILS_ENV=development rails s, I get this:
3.1.2 :002 > Rails.application.credentials.env_key
=> "RAILS_MASTER_KEY"
3.1.2 :003 > Rails.application.credentials.key_file_contents
=> nil
3.1.2 :001 > ENV['RAILS_MASTER_KEY']
=> "f0e5e49fXXXXXXXXXXXXXXXXXXXXXXXXX"
The Dockerfile is the same Dockerfile found on https://www.driftingruby.com/episodes/deploying-with-mrsk and the line that it fails on is:
# Precompiling assets for production without requiring secret RAILS_MASTER_KEY
RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile
Activity
jasonfb commentedon May 2, 2023
https://github.com/bkeepers/dotenv explicitly discusses that the original intention of the Gem is to be used on development + test, but not in production. It seems it CAN be used in production, but that wans't the original intention.
MRSK makes
dotenva specific dependency for all environments, changing for most of us what was once a dependency used only in development+test into dev+test+prodWhat is confusing is generally, it is advised against to put your master key into source control -- this is the whole point of having environment variables separated from the source code.
So, what do I do? I could see two ways forward:
(1) put my rails master key into
.env.production-- a no-no based on security, or(2) if using a
config/master.keyfile instead, should my Dockerfile be copying that file into the Docker image during the build steps?jasonfb commentedon May 2, 2023
cc: @driftingruby — I'm not sure if this problem is related to MRSK or the Dockerfile which I had copied from your site https://www.driftingruby.com/episodes/deploying-with-mrsk
jasonfb commentedon May 2, 2023
I tried adding this but it didn't work as expected
ERROR: failed to solve: failed to compute cache key: failed to calculate checksum of ref iu1slb3t4migzukxu8utkd59t::wo21gohuj7e7t4qunsw6t9nfs: "/config/master.key": not found
am I going down the wrong path here?
[-]switching the ENV secret borks the lock mechanism[/-][+]Missing encryption key to decrypt file with. Ask your team for your master key and write it to /rails/config/master.key or put it in the ENV['RAILS_MASTER_KEY'][/+]jasonfb commentedon May 2, 2023
@driftingruby says the Dockerfile which I had copied into my Rails 7.0.4 app originally came from here in Rails 7.1
https://github.com/rails/rails/blob/10285e977b7be785e34a107811aec7e363d5621a/railties/lib/rails/generators/rails/app/templates/Dockerfile.tt#L2
jasonfb commentedon May 2, 2023
if I have
config.require_master_key = trueenabled in production.rb, the error when running mrsk deploy is:if I COMMENT OUT `config.require_master_key = true in production.rb, the error is instead this:
Either way, if I run
RAILS_ENV=production rails c, there's no env setting for RAILS_MASTER_KEY:jasonfb commentedon May 2, 2023
tested on MRSK 0.12.0, same results
jasonfb commentedon May 2, 2023
next step:
"I'd add it at bin/rails credentials:edit --environment production"