Question

I am setting up a redirection through SendGrid for the mails sent by my rails application.
However I am not really satisfied with the way I’m told to store the credentials.

As it is specified there, they suggest to overwrite ActionMailers defaults in the config/environment.rb file. I’ve found out that my predecessor created a initializers/smtp.rb file where he defined the previous settings, but by discovering this file, I discovered the SMTP password…

If I modify any of these files, anuone having access to the git repository will have access to the credentials (including the front-end and back-end freelances we work with).

I was thinking of creating a file that would stay on the server’s shared folder (like the database.yml file) and that would be symlinked to the app each time we deploy thanks to capistrano.

What do you think of it? Would it be okay to just move this initializers/smtp.rb to the server’s shared folder and symlink it when deploying?

Answer 1

My suggestion (what I’ve seen done):

Move API keys and sensitive info into a yml file under config/.

Load this yml file into a variable, for instance

KEYS = YAML::load(File.open("#{RAILS_ROOT}/config/config.yml"))

Voila.

Also, when putting your code up on GitHub for example, this config.yml would be something you add to the .gitignore. Instead, make a config-example.yml and tell your developers to get their own keys and passwords and such, storing them in their local config.yml.