rails_key_rotator 0.2.1 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29eb6c4fb0ee94eb94483058e009c91b40bc017ff13da75d90f60249c51df5c7
-  data.tar.gz: cb203507ac300b69adac536d0aee9685c42a09c78b0b3a9d391bfbc4a0ba77c2
+  metadata.gz: c1583daf18681adbf057da6b49f0b1d31edde595911bae83460fd0ca7088d38f
+  data.tar.gz: 28024ed59be4ed43b9476eb3c0927a0a0a16370949a4c6bb1b98caf4f1ae770e
 SHA512:
-  metadata.gz: 87a8d7106191f090426e9d9d6a7d997fa5b972c1a840c76fef0250adab92e56a309bc0a9ca1a127e7ceeecf9195e10a57006adee2748e0d5e9e30e14315162cf
-  data.tar.gz: 74cb11e1eb92733a54fa3e2051ade59b108578b1b41e02e7e8105297cec4fd96978bbec962214a6b4e8606f358630f333028c7fb0bc1c226b18413811ff84007
+  metadata.gz: b54587fcd4c6f39ed55143893c66550222e08eb1e2a6db07a1cafa3e574e78a47ad726b4d4b7cb6c9c24a7a2218ec5ba2054206ca0e30f7830638e56424c08de
+  data.tar.gz: 1a02f4f16ebe9ca906b587d2654358282febe8ed5c17348945989a583d70475eb5418a7aaaf4dd8cb9875bd94462124221f0705ea8166e48745527c98b0ebc18

data/README.md

@@ -17,9 +17,22 @@ If bundler is not being used to manage dependencies, install the gem by executin
 
 1. Run the rake taks
 
-        bundle rake key_rotator:rotate
+        $ RAILS_ENV=production bundle exec rake key_rotator:rotate
+
+        Starting process:
+        -> Copy config/credentials/production.key -> config/credentials/production.key.bak-2023-10-15-084335
+        -> Copy config/credentials/production.yml.enc -> config/credentials/production.yml.enc.bak-2023-10-15-084335
+        -> Writing 774ef137809953c633f03233d3ec5d35 to config/credentials/production.key
+
+        Finished! The next steps are:
+
+        - Deploy `RAILS_MASTER_KEY_NEW=774ef137809953c633f03233d3ec5d35` to your infrastructure
+        - Share the new key w/ your colleagues
+        - Commit changes in config/credentials/production.yml.enc
+        - Update `RAILS_MASTER_KEY`and remove `RAILS_MASTER_KEY_NEW` from your infrastructure
+
+    This will backup current key / credentials, create a new key and saves encrypts the credentails w/ this new key for the current `RAILS_ENV`
 
-    This will backup current key / credentials, create a new key and saves encrypts the credentails w/ this new key
 
 2. Deploying this variable as an env `RAILS_MASTER_KEY_NEW`
 

data/lib/rails_key_rotator/railtie.rb

@@ -5,7 +5,7 @@ require "rails"
 module RailsKeyRotator
   class Railtie < Rails::Railtie
     config.before_initialize do
-      KeyRotator.rotated?
+      RailsKeyRotator.rotated?
     end
     rake_tasks do
       load "tasks/key_rotator.rake"

data/lib/rails_key_rotator/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsKeyRotator
-  VERSION = "0.2.1"
+  VERSION = "0.2.3"
 end

data/lib/rails_key_rotator.rb

@@ -17,19 +17,30 @@ module RailsKeyRotator
       if ENV.fetch("RAILS_MASTER_KEY_NEW", false)
         if can_read_credentials!
           ENV["RAILS_MASTER_KEY"] = ENV.fetch("RAILS_MASTER_KEY_NEW")
-          say "NEW key"
+          say_loud "Using NEW key"
         else
-          say "OLD key"
+          say_loud "Using OLD key"
         end
       end
     end
 
     def rotate
+      puts "Starting process:"
       decrypted = read(credentials_path) # Decrypt current credentials
-      backup_file(key_path)              # Backup key
       backup_file(credentials_path)      # Backup credentials
-      File.write(key_path, new_key)      # Save new key
-      write(decrypted)                   # Save new credentials
+      backup_file(key_path)              # Backup key
+      write_key                          # Save new key
+      write_credentials(decrypted)       # Save new credentials
+      puts <<~PROCEDURE
+
+        Finished! The next steps are:
+
+        - Deploy `RAILS_MASTER_KEY_NEW=#{new_key}` to your infrastructure
+        - Share the new key w/ your colleagues
+        - Commit changes in #{credentials_path}
+        - Update `RAILS_MASTER_KEY`and remove `RAILS_MASTER_KEY_NEW` from your infrastructure
+
+      PROCEDURE
     end
 
     def credentials_path
@@ -58,7 +69,11 @@ module RailsKeyRotator
     end
 
     def say(message)
-      warn "\e[41;37;1m\n\n\tKeyRotator: Using #{message} for #{env} env\n\e[0m"
+      puts "-> #{message}"
+    end
+
+    def say_loud(message)
+      warn "\e[41;37;1m\n\n\tKeyRotator(#{env}): #{message}\n\e[0m"
     end
 
     def env
@@ -74,6 +89,8 @@ module RailsKeyRotator
     end
 
     def backup_file(original)
+      raise "File does not exist: #{original}" unless File.exist?(original)
+      say "Copy #{original} -> #{original}.bak-#{date}"
       FileUtils.mv(original, "#{original}.bak-#{date}")
     end
 
@@ -81,12 +98,12 @@ module RailsKeyRotator
       ActiveSupport::EncryptedConfiguration.new(
         config_path: credentials_path,
         key_path: key_path,
-        env_key: "",
+        env_key: "RAILS_MASTER_KEY",
         raise_if_missing_key: true
       ).read
     end
 
-    def write(contents) # the new configuration
+    def write_credentials(contents) # the new configuration
       ActiveSupport::EncryptedConfiguration.new(
         config_path: credentials_path,
         key_path: key_path,
@@ -94,5 +111,10 @@ module RailsKeyRotator
         raise_if_missing_key: true
       ).write(contents)
     end
+
+    def write_key
+      say "Writing #{new_key} to #{key_path}"
+      File.write(key_path, new_key)
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_key_rotator
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.3
 platform: ruby
 authors:
 - Leon Berenschot
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-10-15 00:00:00.000000000 Z
+date: 2023-10-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport