| 1 | # Secrets defined here are available for reference under registry/password, env/secret, builder/secrets, |
| 2 | # and accessories/*/env/secret in config/deploy.yml. All secrets should be pulled from either |
| 3 | # password manager, ENV, or a file. DO NOT ENTER RAW CREDENTIALS HERE! This file needs to be safe for git. |
| 4 | |
| 5 | # Example of extracting secrets from 1password (or another compatible pw manager) |
| 6 | # SECRETS=$(kamal secrets fetch --adapter 1password --account your-account --from Vault/Item KAMAL_REGISTRY_PASSWORD RAILS_MASTER_KEY) |
| 7 | # KAMAL_REGISTRY_PASSWORD=$(kamal secrets extract KAMAL_REGISTRY_PASSWORD ${SECRETS}) |
| 8 | # RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY ${SECRETS}) |
| 9 | |
| 10 | # Use a GITHUB_TOKEN if private repositories are needed for the image |
| 11 | # GITHUB_TOKEN=$(gh config get -h github.com oauth_token) |
| 12 | |
| 13 | # Grab the registry password from ENV |
| 14 | KAMAL_REGISTRY_PASSWORD=$KAMAL_REGISTRY_PASSWORD |
| 15 | |
| 16 | # Improve security by using a password manager. Never check config/master.key into git! |
| 17 | RAILS_MASTER_KEY=$(cat config/credentials/production.key) |