Merge pull request #316 from AyuntamientoMadrid/secrets

Secrets

app/controllers/application_controller.rb

@@ -29,7 +29,7 @@ class ApplicationController < ActionController::Base
     def authenticate_http_basic
       if Rails.env.staging? || Rails.env.production?
         authenticate_or_request_with_http_basic do |username, password|
-          username == Rails.application.secrets.username && password == Rails.application.secrets.password
+          username == Rails.application.secrets.http_basic_username && password == Rails.application.secrets.http_basic_password
         end
       end
     end

config/environments/preproduction.rb

@@ -0,0 +1,81 @@
+Rails.application.configure do
+  # Settings specified here will take precedence over those in config/application.rb.
+
+  # Code is not reloaded between requests.
+  config.cache_classes = true
+
+  # Eager load code on boot. This eager loads most of Rails and
+  # your application in memory, allowing both threaded web servers
+  # and those relying on copy on write to perform better.
+  # Rake tasks automatically ignore this option for performance.
+  config.eager_load = true
+
+  # Full error reports are disabled and caching is turned on.
+  config.consider_all_requests_local       = false
+  config.action_controller.perform_caching = true
+
+  # Enable Rack::Cache to put a simple HTTP cache in front of your application
+  # Add `rack-cache` to your Gemfile before enabling this.
+  # For large-scale production use, consider using a caching reverse proxy like
+  # NGINX, varnish or squid.
+  # config.action_dispatch.rack_cache = true
+
+  # Disable serving static files from the `/public` folder by default since
+  # Apache or NGINX already handles this.
+  config.serve_static_files = ENV['RAILS_SERVE_STATIC_FILES'].present?
+
+  # Compress JavaScripts and CSS.
+  config.assets.js_compressor = :uglifier
+  # config.assets.css_compressor = :sass
+
+  # Do not fallback to assets pipeline if a precompiled asset is missed.
+  config.assets.compile = false
+
+  # Asset digests allow you to set far-future HTTP expiration dates on all assets,
+  # yet still be able to expire them through the digest params.
+  config.assets.digest = true
+
+  # `config.assets.precompile` and `config.assets.version` have moved to config/initializers/assets.rb
+
+  # Specifies the header that your server uses for sending files.
+  # config.action_dispatch.x_sendfile_header = 'X-Sendfile' # for Apache
+  # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for NGINX
+
+  # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
+  config.force_ssl = true
+
+  # Use the lowest log level to ensure availability of diagnostic information
+  # when problems arise.
+  config.log_level = :debug
+
+  # Prepend all log lines with the following tags.
+  # config.log_tags = [ :subdomain, :uuid ]
+
+  # Use a different logger for distributed setups.
+  # config.logger = ActiveSupport::TaggedLogging.new(SyslogLogger.new)
+
+  # Use a different cache store in production.
+  config.cache_store = :dalli_store
+
+  # Enable serving of images, stylesheets, and JavaScripts from an asset server.
+  # config.action_controller.asset_host = 'http://assets.example.com'
+
+  # Ignore bad email addresses and do not raise email delivery errors.
+  # Set this to true and configure the email server for immediate delivery to raise delivery errors.
+  config.action_mailer.raise_delivery_errors = true
+  config.action_mailer.default_url_options = { host: Rails.application.secrets.server_name }
+  config.action_mailer.asset_host = "https://#{Rails.application.secrets.server_name}"
+
+  # Enable locale fallbacks for I18n (makes lookups for any locale fall back to
+  # the I18n.default_locale when a translation cannot be found).
+  config.i18n.fallbacks = true
+
+  # Send deprecation notices to registered listeners.
+  config.active_support.deprecation = :notify
+
+  # Use default logging formatter so that PID and timestamp are not suppressed.
+  config.log_formatter = ::Logger::Formatter.new
+
+  # Do not dump schema after migrations.
+  config.active_record.dump_schema_after_migration = false
+end

config/secrets.yml.example

@@ -1,43 +1,41 @@
-# Be sure to restart your server when you modify this file.
-
-# Your secret key is used for verifying the integrity of signed cookies.
-# If you change this key, all old signed cookies will become invalid!
-
-# Make sure the secret is at least 30 characters and all random,
-# no regular words or you'll be exposed to dictionary attacks.
-# You can use `rake secret` to generate a secure secret key.
-
-# Make sure the secrets in this file are kept private
-# if you're sharing your code publicly.
-
 default: &default
+  secret_key_base: "56792feef405a59b18ea7db57b4777e855103882b926413d4afdfb8c0ea8aa86ea6649da4e729c5f5ae324c0ab9338f789174cf48c544173bc18fdc3b14262e4"
 
 development:
-  secret_key_base: 56792feef405a59b18ea7db57b4777e855103882b926413d4afdfb8c0ea8aa86ea6649da4e729c5f5ae324c0ab9338f789174cf48c544173bc18fdc3b14262e4
-  twitter_key: AAAA
-  twitter_secret: BBBB
-  facebook_key: AAAA
-  facebook_secret: BBBB
-  google_oauth2_key: AAAA
-  google_oauth2_secret: BBBB
   <<: *default
 
 test:
-  secret_key_base: 4d5adf961ddd27aef19622d6c0b3234d555f9ee003f022b1f829c92bbe33aaee907be7feb67bd54c14a1a32512fa968565ad405971fbc41bd0797af73c26a796
-  twitter_key: AAAA
-  twitter_secret: BBBB
-  facebook_key: AAAA
-  facebook_secret: BBBB
-  google_oauth2_key: AAAA
-  google_oauth2_secret: BBBB
   <<: *default
 
-production:
-  secret_key_base: <%= ENV["SECRET_KEY_BASE"] %>
-  twitter_key: <%= ENV["TWITTER_KEY"] %>
-  twitter_secret: <%= ENV["TWITTER_SECRET"] %>
-  facebook_key: <%= ENV["FACEBOOK_KEY"] %>
-  facebook_secret: <%= ENV["FACEBOOK_SECRET"] %>
-  google_oauth2_key: <%= ENV["GOOGLE_KEY"] %>
-  google_oauth2_secret: <%= ENV["GOOGLE_SECRET"] %>
+staging:
+  server_name: ""
   <<: *default
+
+production: &production
+  secret_key_base: "817232feef405a59b18ea7db57b4777e855103882b926413d4afdfb8c0ea8aa86ea6649da4e729c5f5ae324c0ab9338f789174cf48c544173bc18fdc3b14262e4"
+
+  census_api_end_point: ""
+  census_api_institution_code: ""
+  census_api_portal_name: ""
+  census_api_user_code: ""
+
+  sms_end_point:  ""
+  sms_username: ""
+  sms_password: ""
+
+  http_basic_username: ""
+  http_basic_password: ""
+
+  twitter_key: ""
+  twitter_secret: ""
+  facebook_key: ""
+  facebook_secret: ""
+  google_oauth2_key: ""
+  google_oauth2_secret: ""
+
+  rollbar_server_token: ""
+  server_name: ""
+
+preproduction:
+  server_name: ""
+  <<: *production

lib/capistrano/tasks/upload_secrets.cap

@@ -0,0 +1,12 @@
+namespace :deploy do
+  desc "compiles assets locally then rsyncs"
+  task :upload_secrets do
+    on roles(:app) do |role|
+      run_locally do
+        execute"rsync -av ./config/secrets.yml #{role.user}@#{role.hostname}:#{shared_path}/config/secrets.yml;"
+      end
+      "chmod -R 755 #{shared_path}/config/secrets.yml"
+      execute "ln -nfs #{shared_path}/config/secrets.yml #{current_path}/config/secrets.yml"
+    end
+  end
+end

lib/census_api.rb

@@ -6,7 +6,7 @@ class CensusApi
   end
 
   def client
-    @client = Savon.client(wsdl: Rails.application.secrets.padron_end_point)
+    @client = Savon.client(wsdl: Rails.application.secrets.census_api_end_point)
   end
 
   def response
@@ -16,9 +16,9 @@ class CensusApi
 
   def request
     { request:
-      { codigo_institucion: Rails.application.secrets.institution_code,
-        codigo_portal:      Rails.application.secrets.portal_name,
-        codigo_usuario:     Rails.application.secrets.user_code,
+      { codigo_institucion: Rails.application.secrets.census_api_institution_code,
+        codigo_portal:      Rails.application.secrets.census_api_portal_name,
+        codigo_usuario:     Rails.application.secrets.census_api_user_code,
         documento:          citizen.document_number,
         tipo_documento:     citizen.document_type,
         codigo_idioma:      102,