Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Run goodjob in production mode #61

Merged
merged 2 commits into from
Sep 22, 2023
Merged

Run goodjob in production mode #61

merged 2 commits into from
Sep 22, 2023

Conversation

benarmston
Copy link
Collaborator

  • Fix good job trying to access the development database that hasn't been created.
  • Fix ActiveRecord::Encryption::Errors::Decryption messages. Presumably due to good job running in development where the encryption keys are unset.

@benarmston
Copy link
Collaborator Author

This PR is sufficient to fix the database access issues for a new deployment. Unfortunately, it doesn't work when updating an existing deployment as new active record encryption keys are created.

In more detail:

  1. When concertim is first deployed, the visualisation service is built and as part of that process the active record encryption keys are created. The database is also created and migrated, which involved use of those encryption keys.
  2. Updating to a new deployment involves rebuiding the visualisation service and as part of that process the active record encryption keys are re-created. These re-creted keys are not compatible with the keys previously used.

The solution is to either:

Commit the config/credentials.yml.enc to the git repo and keep the master key a secret. Each deployment will need to provide the master key either through docker environment, docker secrets or some other mechanism. This is the standard Rails solution, but would result in each deployment using the same master key.

Alternatively, if we have a programmatic means of creating all of the credentials in config/credentials.yml.enc, then would could require that each deployment create their own master key and provide it through docker environment, docker secrets or some other mechanism. Then the build (or a post build) process would create the config/credentials.yml.enc using the provided master key. This would require that each deployment is resposible for safely storing the master key. If its lost, data may become inaccessible.

Another alternative, would be to use docker volumes to store config/credentials.yml.enc and/or the master key.

@benarmston benarmston merged commit 40971a1 into main Sep 22, 2023
@benarmston benarmston deleted the fix/database-oddities branch September 22, 2023 13:06
benarmston added a commit that referenced this pull request Oct 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant