Add the OTP encryption key to secrets

thewca · Jan 5, 2020 · 32a4549 · 32a4549
1 parent fdc5552
commit 32a4549
Show file tree

Hide file tree

Showing 3 changed files with 110 additions and 78 deletions.
diff --git a/WcaOnRails/app/controllers/users_controller.rb b/WcaOnRails/app/controllers/users_controller.rb
@@ -119,7 +119,6 @@ def update
         DelegateStatusChangeMailer.notify_board_and_assistants_of_delegate_status_change(@user, current_user).deliver_now
       end
       if current_user == @user
-        # TODO: for 2FA, log them out and explicitly ask for a re-login
         # Sign in the user, bypassing validation in case their password changed
         bypass_sign_in @user
       end

diff --git a/chef/data_bags/secrets/production.json b/chef/data_bags/secrets/production.json
@@ -1,117 +1,143 @@
 {
   "id": "production",
   "_password_comment": {
-    "encrypted_data": "BHIG5zSIk0L3Idl0V9eGtmeJBRUiWqHASuZik98rVq0nkA66AF9vChoFl578\nn9mXN4L5fC/HGPJG4IrHml5SA1TwoOIgHfbhH/Kwtbvpgm8tTQgHD6glLflE\n8bwy7AdnISD7ae+ioRbRJosbdiYAAw==\n",
-    "iv": "tbLZjfSxDaYP6FSEBNuWDg==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "7P+hGbWOXrEzdf9VbVu5XMow/oEdwPMRDoAI7hsStwa0/DRCegMQAbYN6bCb\ncJ7PibuTUgb4rA/N/0Cz0k5FZzoLtxZSsdg3EOR8dcCQ2bNjrsD4XCawaW5W\nq+AUFO351X9j6SiK\n",
+    "iv": "ko3D81pL53HEuQXP\n",
+    "auth_tag": "BXBFsGRNBN1ChtzRHbOuQw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "cubing_password": {
-    "encrypted_data": "Hr8Vblgb7I+osYOFviU3ABO1sdYm0wtgKAWq9bRWtWlUo7dw/9t7M8CfvNnt\nTK/2wqNXC5bx9Hj9xWXE7n7Peg==\n",
-    "iv": "Zl2T3cSEV6z4aZcyFZK9sw==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "fGEe0TQXhyLCvV054ceavaPBNxMfvapSFCDWrQjUwz69tHHRaks3g/BA8jEO\nAyV27Oqm\n",
+    "iv": "4QxMkw9GoqyAudJq\n",
+    "auth_tag": "qB9zGEuq7t8greUHDKYBsw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "mysql_password": {
-    "encrypted_data": "swX/3e9ap30MOHpSP0Ax4gfNgKVfP3kI8Aw/eQnsJd94OYrRJVl8XRrTGxHq\n0pYdMCM13dcJlLO/fsmCYARX7Q==\n",
-    "iv": "RQufC1hLQBb6XwhTlD0TfQ==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "NnDDsx/vfwF4Qa75G643TCGOmm83h2eUwfd7owskg0sQjdBsEzYaVKiPhCq2\nZqt68aU=\n",
+    "iv": "OTqMju5Ql1oZsPja\n",
+    "auth_tag": "TPasC0RE+yJT75E0f9t18Q==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "secret_key_base_comment": {
-    "encrypted_data": "HyTnBNlxKF24rd7yIWTTdBtTjc14+GwDArmkd9LFLndSGBdyKjxI2wsoMar4\ndhzD\n",
-    "iv": "XSAQadiBvHl8imCGXRdyJw==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "JbSnJx0lMwy1+qVzwY22YYKa9xHf0IZzg2jrGz1mM89dSd7n2NJ2D05Mc2CI\n5wM=\n",
+    "iv": "6LfeVLxe/AgWbxSk\n",
+    "auth_tag": "O35bA2m4HFBVF5vGkNBW/Q==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "secret_key_base": {
-    "encrypted_data": "zHbgGTq8LiRHyepMnd1p+a+M5BnUghLekw0Z/f2glX4vuOGN63Y/OWd1bFGs\n4DS4Zt0lO6LAKzALLMA7nougWO7tFFmfuppe1j/kgHO0mETdoASr9Z6iAl/g\nAPe/yRLYV3QVJes2L6Z4Tr4qosX2DPn9nUwDswhwtw9liQGktJvO9FCioMvE\nwIV/NvPQAerb9OU0eFuvldhApStiGGTRJA==\n",
-    "iv": "/vq/hpfibyt8BgdIyETHtw==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "dN4I+FHagAl4HF5l3YsnN78hUYoeWfUhtl/dV6ibYSDctoug2FXF63UPHu4c\nFVqXr+Lo45UcuJBGNKPVC53IL5wk8u/n0Xmdj66mPB+8YBJ+dpEeOddKx6Qf\n+qIRFxy09KVtaq7Nn4W1uUzDNcWwZREaqbKXj6UDpuOQRP11/MajCHNcxFvk\n8mvDTcJFZv61+6RC\n",
+    "iv": "rlCjOhmo98y0yWg0\n",
+    "auth_tag": "yhzUmjSIuKkMaNdM4Tqtbw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "SMTP_USERNAME": {
-    "encrypted_data": "JkRTrLO//JVxgmUwdmpYIUSnjo5ZttoXdzaUafmBwhFkxQ+Ds2z2EuCxRQOM\nIoTI\n",
-    "iv": "6eSb7xXc4GWV7Hit+XnkUA==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "9MLTm4jWzUjGnmpGeRAFKNH+pXTHkZmALl8aQsQ8JfwzK7fWyD6M\n",
+    "iv": "YKhTU2vRWA9Nw6s+\n",
+    "auth_tag": "aqe51nPRRpCQXnYgiR0twA==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "SMTP_PASSWORD": {
-    "encrypted_data": "geHmMsvcChK+kWmz+dW3VKZUE2YTL2xmTIUtMNZFN4YLfQAmFQ5iPp0G07iI\nLHXQYhE55NEJfYqMZIT6gnBGMg==\n",
-    "iv": "CAfRGqFqJ+Npg7iId0aQkw==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "MDkc31JFjXhC81wH1qi1yXIhzR+e+quK0Lqg9fQ78YcFXypvgBl+XPCQt1eC\nVqG32sBmh6OWGGEN6v7WlK9y\n",
+    "iv": "WH2G9EHiozIn03UL\n",
+    "auth_tag": "VgR36SaK2p35Vq/zBbORjg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "RECAPTCHA_PUBLIC_KEY": {
-    "encrypted_data": "uzhL4Hs6SYoSFn8VlAlU9GCxMppoQFbSUumsZBA+PVleMAjaYFHJLtoqfAW0\neAv8vkb4+n+x67qfzIzC3Bl/RA==\n",
-    "iv": "/ezQFHvdd/eM7k5Y/NYb4Q==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "3LNjQjOZx9SYF5OsHTexSF5IWJ8oGZJgC2/WmXcPnsJTspR2KM0wO6T5qNJs\nWZDBNYl5jZh5tXt8B4E=\n",
+    "iv": "Dzjxev2AgSj+XlsT\n",
+    "auth_tag": "Zd1RVu0NRRRCZof6PXl9ng==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "RECAPTCHA_PRIVATE_KEY": {
-    "encrypted_data": "3EPxMlbbPsWqw8eGtpMGkh4r3FCdA4i8VNkhyp3aNFMgLcd5/EjXZ98xZCh1\nA/zzAtjmvt3hBJhQ8va6GvckcQ==\n",
-    "iv": "HmCajELQvGsrs0lhNPpPZQ==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "+aTWTygpVwKFe0fgBNM68kHpcotGz4t1Dw0TLcBOjwdwLJubMyIcJP/8E1bc\nFca6zckBQe1Z97JsiHI=\n",
+    "iv": "gglyNfTU3iJ/rkIw\n",
+    "auth_tag": "/0nJpVf10wkrpo7TlyOz9w==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "NEW_RELIC_LICENSE_KEY": {
-    "encrypted_data": "zsJkH4DKA0lOZlcehwdq8vCD5kY+t5LNV0R7RAYwQx0JB78idDThniO2E5Ay\nTqtXacfvwFwOSAZr2OZZnPTUSA==\n",
-    "iv": "K37beLnvRZTakC1eqGkMFw==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "sarq1CIWp6HveD8xbiC3inqgtPKE69B0CBSL8RynODqBZ8K5xNpLbjC7ThLE\nm3i2GHbutWc7Qur/NRA=\n",
+    "iv": "68okEdyDkvsSUgHq\n",
+    "auth_tag": "wEyqOGmvqwRBwp5GcXVArA==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "GOOGLE_MAPS_API_KEY": {
-    "encrypted_data": "JLSrORWeRYfQd6nDGX0QNtm87h8PS/SHK1tYqB4vzIMsSPL13BRBB5TvxqCJ\n0WUHGiOqx0NbzNTCVjGhZnrk7w==\n",
-    "iv": "ycTjyhafQ2k1cJnMhKJwag==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "XblGM73HXZYx+OHjef97bQsXZuRMA5BXWMp3ZIopajPLAKOkNhCPHpnv7yT0\n2A9OZEDQ0ODeNdbv9w==\n",
+    "iv": "qTByyMLXmqyR+0xz\n",
+    "auth_tag": "2K1ZoKlFm36cLLRMBoq/RQ==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "GITHUB_BACKUP_ACCESS_TOKEN": {
-    "encrypted_data": "qStRsW+D8y8WAZCPVTYmJLV3hh9QTYPlHEdT3PeI4cTYj2RBgtTlWoP/7NZi\n0xESMwYZYgZSAf2UzDz8kqjhQw==\n",
-    "iv": "yjUtmtK06VC8WcmICKcQYw==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "SstCa1E1FEeojIuXGOAR/yRyFvFhowj8EVIqXA1F8UllNBmqXFWuslLoJqWt\nOgijLtXPD0MvNv+Ki/4=\n",
+    "iv": "nOjWUJNLD90cwKo6\n",
+    "auth_tag": "qEWxR8zYcNUpY3ZshbnIrg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "GITHUB_CREATE_PR_ACCESS_TOKEN": {
-    "encrypted_data": "uVMOd2x12XZGKbryAD5OO6GvtQDVEn1nl8WLvx0i38AofVnVYcE1F/q1UsQt\nCOoh/BKkh5kkjCms6d9C77Klfw==\n",
-    "iv": "AVTXBSy8pybIUyQuhJwFCw==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "GyBggVm29d5ncK7JDux2V+zNQiXqKPNZ0t3C3OiNx2PZg7lK3l8oqP61I64S\nBZ/EFU82n3DfWNMoNsA=\n",
+    "iv": "FLgQqbS9GwMup3/0\n",
+    "auth_tag": "W66gB3QF/mjHfLeDq3wjhw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "GITHUB_LIST_MEMBERS_ACCESS_TOKEN": {
-    "encrypted_data": "q7PoIhVGE84wKFi8EcAZ84Ls6T+MmNdA810TZcsDUm3GFpMVc8VxSvsPO3Y8\ntr9xulD/AyAv/8ZrQqaRvq9Osw==\n",
-    "iv": "FkrV5zGliqq/UCWw+kBRxA==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "AMRFe3YQEKTE300oL/KlIqGr9wwswhL8ogr10Y6cTblTUGDkTGiYWqJl6oDn\nujhIlhiZKQOuDfqgKZg=\n",
+    "iv": "gzP5Y/DEasfCpP5J\n",
+    "auth_tag": "xcn+n+XG6xi/YuUYxPIy2Q==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "STRIPE_API_KEY": {
-    "encrypted_data": "JF1oGWD3r7tOaNNTTIp1e/U5fdRw3t9XtaklHgaML/lhDTFiev8W2kuZFxEq\nXHObfJtUhBXW7Z5gfbzXkgXIRQ==\n",
-    "iv": "YYACHw/UsEEfY9VbJcLxbA==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "dDINH4f5eNpFBh/kMQVGvBKySJr6HWqtwNqHIqGyylAt+BMY09Bbw/YYtuvq\nup7mddyp\n",
+    "iv": "ttUA5TsrbbfEDCDG\n",
+    "auth_tag": "K5D0sgjetUp46JF+zEIBfA==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "STRIPE_CLIENT_ID": {
-    "encrypted_data": "szMz/GtUGEGGdTE21k8xrc++lmOnAAOxpu105Scft0HpnTpYXDoJzxpgjJvt\nH4jdZXeWDx6cNXrEadT/7/BtRw==\n",
-    "iv": "YvzlV7BOl0xhXw1UiZUY3Q==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "GvSfInj3OB0vrFqDDxWkVmRVy2moHiHQJqJxU/gkXwiyR72Y6GxMHrK0ToIw\nQgY8ydNr53F0\n",
+    "iv": "+vDx3Bm5h9t/b5l2\n",
+    "auth_tag": "qTfpme38lZW+XW26aQzHIA==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "STRIPE_PUBLISHABLE_KEY": {
-    "encrypted_data": "ivmo8LbEiRCWBJxgPkCIsE9O6R9b8MORdK7XyNPxWWBgaN9ODXti1bZjPE/j\nyDPYOXrJhUazvsTzy8ciTSEbYQ==\n",
-    "iv": "5h915IvoTHex0Q3GGjmkZg==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "R9Q3EKjePjMoIXSfcBp8rFNP8LHRsaTCts7cCAsnIZbO9R/BHmOKfl1V6jUu\nfuhB6INu\n",
+    "iv": "d/q0b1s8IdWflZJ6\n",
+    "auth_tag": "bTuIjVMSFN6SHg5tt6l7ng==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "AWS_ACCESS_KEY_ID": {
-    "encrypted_data": "b3bREgXpX/PuXYcmeBZ4TTrxve5VsOCE7cs+VHCdnmgW/W5no0DkajwuxrJT\nwOWb\n",
-    "iv": "g0OZGW6wFdWHROtWEYrWpA==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "ur3DlinEhSb8yMWZvqUeL+vqpkgh1Ekgde7x0jaqaiE88wTk5dB7\n",
+    "iv": "40MExXbPh/cfkx6x\n",
+    "auth_tag": "x8TXW/KEVmQbhx5Qmb6NZw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   },
   "AWS_SECRET_ACCESS_KEY": {
-    "encrypted_data": "xabGFQdOltz4ki+LwHuz6t07HRtXr4ZkatELI1zoCQae1u0AGX/2RrRAUG8a\n2mpVuyUaqSmtjmKqe/NCKf6Usg==\n",
-    "iv": "49vnZy9FNsf4lJkegtCzgQ==\n",
-    "version": 1,
-    "cipher": "aes-256-cbc"
+    "encrypted_data": "+4xmJj9dXo5NKPzUAydxU2xL13qedWk2WehwsYnFt7luN1Ttx4cv1Chn8drU\n8+A1U3vGUje4BP66ZPo=\n",
+    "iv": "2DOHV5HjzQfL9Lmg\n",
+    "auth_tag": "f//JSzGj3BChi/D8NHmyxQ==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "OTP_ENCRYPTION_KEY": {
+    "encrypted_data": "6Qg1WVX2MKjzJ1wMazkuFspt7lv+SOWM3DscSVXWoxzrThf+NPXI/Jt/FWEL\n8K8GDCCUtpnD1vHqTe6XU96mYeCFP8BUEZb9W1h8Q2pxmnmOJnfzj0koR5yJ\nIZYXMGHsmUL1VvJCwYnI6+ABCDzA/qi0/c5PhXhbkp6Dewx0AM5tryEYpCIa\nPpi6n99NwLSJVfCL\n",
+    "iv": "d6nNPCaE5hn2tosQ\n",
+    "auth_tag": "Imt+9pfEwSEWcAqzz2ef2A==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
   }
-}
+}
diff --git a/chef/site-cookbooks/wca/templates/env.production.erb b/chef/site-cookbooks/wca/templates/env.production.erb
@@ -47,3 +47,10 @@ AWS_BUCKET=<%=
     "production" => "www.worldcubeassociation.org",
   }[node.chef_environment]
 %>
+OTP_ENCRYPTION_KEY=<%=
+  {
+    "development" => "abcdefghijklmnopqrstuvwxyz1234567890",
+    "staging" => "abcdefghijklmnopqrstuvwxyz1234567890",
+    "production" => @secrets['OTP_ENCRYPTION_KEY'],
+  }[node.chef_environment]
+%>