rails_outofband_keys 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c028a4ebdbf7196c3cdaa3279dfda0dd8d5d75d25a9b662c847847d650087b1d
-  data.tar.gz: 6d393b4056c6e6bfd9b63f7bdbb7dbba10a29544ca833a7e09109d71498f59c1
+  metadata.gz: 36a784436805d0003b9202eee28f1a6fdce3d461f1bd897d35d83c5a19fc1738
+  data.tar.gz: da58352c65fdc7e632485518e7430798ff4d8ea9b1b324dbc00149f0d9aa7540
 SHA512:
-  metadata.gz: 8d0f2b467ced1b33e8e139843413f4e1f0c21e524a73eb41985dba3c75091a9d8818bd87976b21cab592ca4f5d325e426991720ef7d3cd62b36347ab96597202
-  data.tar.gz: 642e1b15c124d6dc4fee45991c69fee2b36ef486f6428a61b7844b371350c1b9de55b07f70d8b70e4dfd11a56ae0e5ef4ca30ebee770f65688cdaa7cab10f485
+  metadata.gz: f18708b2c0ca5d7e3c3250cbb324a631e9adbcf69cdbffd3d528ae8be18c90e774fd191f0b706dd5aff06496c48acf02c4708ee4c7af80f926f00dbeced96dde
+  data.tar.gz: 61b7df727a378c470e8fab0bb813f6b9603854804c55f16ddd4b0626c9b8876d564612410d10d8908de8b480671bbbc098ef75d981dedd8a790fd3cd99f0c499

data/README.md

@@ -1,21 +1,36 @@
 # rails_outofband_keys
 
-`rails_outofband_keys` is a Rails plugin that changes **how Rails finds your credentials key files** (e.g., `production.key` or `master.key`). It allows you to keep these sensitive keys **outside of your project directory and git tree** (e.g., in `~/.config/`).
+`rails_outofband_keys` is a Rails plugin that changes **how Rails finds your credentials key files** (e.g., `production.key` or `master.key`). It allows you to keep these sensitive keys **outside of your project directory and git tree** (for example, under `~/.config/`).
 
-It does **not** replace Rails credentials, change where `credentials.yml.enc` lives, or alter how encryption works. It only dynamically configures `config.credentials.key_path` during the boot process.
+It does **not** replace Rails credentials, change where `credentials.yml.enc` lives, or alter how encryption works. It only configures `config.credentials.key_path` during the boot process.
+
+## Why did I make this?
+
+Encrypted credentials are a solid default. They simplify onboarding, move teams away from risky `.env` files, and give Rails a single, consistent way to manage secrets.
+
+But the system is only as strong as how the encryption keys are handled.
+
+In Rails, it’s standard practice to store credentials keys next to the encrypted files and rely on `.gitignore` to keep them out of version control. That works — until it doesn’t. It assumes perfect developer hygiene and assumes your tooling will always respect ignore rules.
+
+Modern AI assistants and agentic tools break that assumption. These tools upload project files to the cloud and often execute commands directly inside your repo. Even ignored files are now a single `grep` or accidental read away from exposure.
+
+Moving encryption keys out of the project directory is a simple, effective risk reduction. It’s one of the baseline requirements I set before allowing agentic tooling on my team, alongside credential redaction in logs and exceptions.
+
+This gem exists to make that safer pattern easy and boring.
 
 ## Resolution Order
 
 1. If `RAILS_MASTER_KEY` is set in the environment, Rails uses it (this gem does nothing).
 2. If `RAILS_CREDENTIALS_KEY_DIR` is set, it is used as the base directory for the app.
 3. If `RAILS_OUTOFBAND_BASE_DIR` is set, it is used as the global base directory.
-4. Otherwise, the gem fallbacks to OS defaults:
-  - **Linux/macOS**: XDG config directory (`~/.config` fallback)
-  - **Windows**: `%AppData%`
+4. Otherwise, the gem falls back to OS defaults:
+- **Linux/macOS**: XDG config directory (`~/.config` fallback)
+- **Windows**: `%AppData%`
 
 The final path is constructed as:
-`base_directory / root_subdir / credentials_subdir / <environment>.key`
-`base_directory / root_subdir / credentials_subdir / master.key`
+
+- `base_directory / root_subdir / credentials_subdir / <environment>.key`
+- `base_directory / root_subdir / credentials_subdir / master.key`
 
 ## Configuration
 
@@ -41,9 +56,9 @@ On Unix-like systems, key files **must** have secure permissions. They must be o
 Add the gem to your Gemfile:
 
 ```ruby
-gem "rails_outofband_keys", git: "git@github.com:lholden/rails_outofband_keys.git", tag: "v0.1.1"
+gem "rails_outofband_keys"
 ```
 
 ## License
 
-MIT
+MIT

data/lib/rails_outofband_keys/railtie.rb

@@ -10,12 +10,15 @@ module RailsOutofbandKeys
 
     config.before_configuration do |app|
       # Load file-based configuration.
-      config_file = File.join(Dir.getwd, "config", "rails_outofband_keys.yml")
-
-      if File.exist?(config_file)
-        external_config = YAML.load_file(config_file)
-        app.config.rails_outofband_keys.root_subdir = external_config["root_subdir"]
-        app.config.rails_outofband_keys.credentials_subdir = external_config.fetch("credentials_subdir", "credentials")
+      config_file = app.root.join("config", "rails_outofband_keys.yml")
+      if config_file.file?
+        data = YAML.safe_load_file(config_file.to_s, permitted_classes: [], aliases: false)
+        data = {} unless data.is_a?(Hash)
+
+        app.config.rails_outofband_keys.root_subdir = data["root_subdir"]
+        if data.key?("credentials_subdir")
+          app.config.rails_outofband_keys.credentials_subdir = data["credentials_subdir"]
+        end
       end
 
       # Identify the app name for path resolution.
@@ -28,12 +31,12 @@ module RailsOutofbandKeys
       )
 
       key_path = resolver.resolve_key_path
-      if key_path
-        app.config.credentials.key_path = key_path
+      next unless key_path
 
-        # Clear any early-cached credentials object to ensure the new path is used.
-        app.remove_instance_variable(:@credentials) if app.instance_variable_defined?(:@credentials)
-      end
+      app.config.credentials.key_path = key_path
+
+      # Clear any early-cached credentials object to ensure the new path is used.
+      app.remove_instance_variable(:@credentials) if app.instance_variable_defined?(:@credentials)
     end
   end
 end

data/lib/rails_outofband_keys/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsOutofbandKeys
-  VERSION = "0.1.1"
+  VERSION = "0.1.3"
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails_outofband_keys
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - Lori Holden
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2025-12-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -38,8 +39,11 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.2'
 description: |
-  Configures Rails credentials key_path to load environment/master key files
-  from an out-of-band directory (XDG on Unix/MacOS, AppData on Windows).
+  Configures Rails to load credentials master and environment key files from an out-of-band location
+  (XDG on Linux/macOS, AppData on Windows) instead of the project directory.
+
+  This reduces the risk of key exposure from tooling that reads or executes within your repo,
+  including modern AI assistants and agentic tools.
 email:
 - git@loriholden.com
 executables: []
@@ -58,6 +62,9 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
+  homepage_uri: https://github.com/lholden/rails_outofband_keys
+  source_code_uri: https://github.com/lholden/rails_outofband_keys
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -72,8 +79,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.2
+rubygems_version: 3.5.23
+signing_key:
 specification_version: 4
-summary: Resolve Rails credentials key files outside the project tree (XDG/AppData
-  + overrides).
+summary: Load Rails credentials keys from outside your repo.
 test_files: []