When pushing to Github, I want to .gitignore my database.yaml file so that I don’t publically expose my production database password. But I need that password to be available to Heroku for when the app is running in production.
I could set environment variables in heroku, but that strikes me as unsecure. Any able to get on my computer could run a single command in terminal and reveal the password variable.
When dealing with Github and Heroku, it is possible to write code that specifies that certain files should be ignored when pushing to github but not ignored when pushing to heroku?
Once someone gets access to your host, it’s basically over. Either approach, environment variables or a database.yml file, will still be retrievable if someone has access to your box.
I would recommend using environment variables in Heroku to store your database credentials. As you know, you should never check in production credentials into any repository.