AO3-7427 Use config file for activerecord encryption config (#5801)

Author: brianjaustin

.github/workflows/automated-tests.yml

@@ -22,9 +22,6 @@ jobs:
     env:
       CI: true
       RAILS_ENV: test
-      ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY: bEZjYLY9tCYGh6WlcMtEJpIi7GO2plZC
-      ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY: PpLWizzsQHIWnIihtECw8nDHZQd0amzf
-      ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT: 3S99KdpdEWLnCYudBgUfdCFDBWePWCud
       TEST_GROUP: ${{ matrix.tests.command }} ${{ matrix.tests.arguments }}
       CUCUMBER_RETRY: 1
       CUCUMBER_FORMAT: Ao3Cucumber::Formatter

config/application.rb

@@ -90,10 +90,9 @@ class Application < Rails::Application
       BCrypt::Password
     ]
 
-    # Set admin two-factor authentication keys
-    config.active_record.encryption.primary_key = ENV["ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY"]
-    config.active_record.encryption.deterministic_key = ENV["ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY"]
-    config.active_record.encryption.key_derivation_salt = ENV["ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT"]
+    config.active_record.encryption.primary_key = ArchiveConfig.ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY
+    config.active_record.encryption.deterministic_key = ArchiveConfig.ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY
+    config.active_record.encryption.key_derivation_salt = ArchiveConfig.ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT
 
     # handle errors with custom error pages:
     config.exceptions_app = self.routes

config/config.yml

@@ -805,3 +805,8 @@ PSEUD_SHARDS: 5
 TAG_SHARDS: 5
 USER_SHARDS: 5
 WORKS_SHARDS: 5
+
+# Placeholder values for active record encryption. THESE MUST BE OVERRIDDEN FOR PRODUCTION DEPLOYMENTS!
+ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY: bEZjYLY9tCYGh6WlcMtEJpIi7GO2plZC
+ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY: PpLWizzsQHIWnIihtECw8nDHZQd0amzf
+ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT: 3S99KdpdEWLnCYudBgUfdCFDBWePWCud

docker-compose.yml

@@ -78,9 +78,6 @@ services:
       CODESPACES: ${CODESPACES:-}
       CODESPACE_NAME: ${CODESPACE_NAME:-}
       GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN: ${GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN:-}
-      ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY: bEZjYLY9tCYGh6WlcMtEJpIi7GO2plZC
-      ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY: PpLWizzsQHIWnIihtECw8nDHZQd0amzf
-      ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT: 3S99KdpdEWLnCYudBgUfdCFDBWePWCud
     command: bash -c "rm -f tmp/pids/server.pid && bundle exec rails s -p 3000 -b '0.0.0.0'"
     volumes:
       - .:/otwa
@@ -124,9 +121,6 @@ services:
       dockerfile: ./config/docker/Dockerfile
     environment:
       - RAILS_ENV=test
-      - ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=bEZjYLY9tCYGh6WlcMtEJpIi7GO2plZC
-      - ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=PpLWizzsQHIWnIihtECw8nDHZQd0amzf
-      - ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=3S99KdpdEWLnCYudBgUfdCFDBWePWCud
       - CHROME_URL=http://chrome:4444
       - DOCKER=true
       - CAPYBARA_PORT=5100