ruby-on-rails - 使用 capistrano 部署时隐藏 mysql2 密码的好方法是什么

Question

所以，这是我的 capistrano 文件

load 'deploy/assets'
require "bundler/capistrano" 
set :application, "XXXXXX"
set :repository,  "XXXXXX"

set :scm, :git # You can set :scm explicitly or Capistrano will make an intelligent guess based on known version control directory names
# Or: `accurev`, `bzr`, `cvs`, `darcs`, `git`, `mercurial`, `perforce`, `subversion` or `none`
set :repository , "XXXXXX"

role :web, "XXXXXX"                          # Your HTTP server, Apache/etc
role :app, "XXXXXX"                          # This may be the same as your `Web` server
role :db,  "XXXXXX", :primary => true # This is where Rails migrations will run
#role :db,  "your slave db-server here"

set :user, 'root'
set :use_sudo, false
set :deploy_to, "/var/www/#{application}"
set :deploy_via, :remote_cache
set :normalize_asset_timestamps, false

# if you want to clean up old releases on each deploy uncomment this:
# after "deploy:restart", "deploy:cleanup"

# if you're still using the script/reaper helper you will need
# these http://github.com/rails/irs_process_scripts

# If you are using Passenger mod_rails uncomment this:
namespace :deploy do

  task :start do ; end
  task :stop do ; end
  task :restart, :roles => :app, :except => { :no_release => true } do
    run "touch #{File.join(current_path,'tmp','restart.txt')}"
  end
end

现在当我运行 cap deploy我收到一个错误

Access denied for user 'root'@'localhost' (using password: NO)

我假设那是因为我的 database.yml 文件是

development:
  adapter: sqlite3
  database: db/development.sqlite3
  pool: 5
  timeout: 5000

# Warning: The database defined as "test" will be erased and
# re-generated from your development database when you run "rake".
# Do not set this db to the same as development or production.
test:
  adapter: sqlite3
  database: db/test.sqlite3
  pool: 5
  timeout: 5000

production:
    adapter: mysql2
    encoding: utf8
    database: XXXXX
    username: root
    password: 
    socket: /tmp/mysql.sock

现在因为我有一个公共(public) github 帐户。我不想传递我的密码并将其发布到 github。如果我不输入密码，我将无法部署该应用程序。

处理这个问题的好方法是什么？

谢谢

Answer 1

您还需要确保您的 SSH 系统得到很好的保护，以防止人们以 Capistrano 机器人的身份登录。我建议限制对受密码保护的 key 对的访问。

加密服务器上的 .yml 文件是没有用的，因为您必须给机器人提供 key ，该 key 将被存储。 . .在同一台服务器上。在您的机器上加密它可能是一个好主意。 Capistrano 可以在发送前对其进行解密。

或者

我解决这个问题的方法是将数据库密码放在一个文件中，该文件仅对我运行我的应用程序的用户具有读取权限。然后，在 database.yml 中，我使用 ERB 读取文件:

production:
  adapter: mysql
  database: my_db
  username: db_user
  password: <%= begin IO.read("/home/my_deploy_user/.db") rescue "" end %>