Kazunori Kimura ac47124a0d Allow setting ActiveRecord encryption secrets
Add environment variable to set entry in secrets.yml related to
active record encryption

- active_record_encryption_primary_key (can be multiple)
- active_record_encryption_deterministic_key (can be multiple)
- active_record_encryption_key_derivation_salt

Reference for '32 characters length' recommendation:
https://gitlab.com/gitlab-org/gitlab/-/blob/v18.0.0-ee/config/initializers/2_secret_token.rb#L78-80

TODO: fix command line usage in documentation
2025-06-17 18:53:25 +09:00

19 lines
929 B
YAML

production:
# db_key_base is used to encrypt for Variables. Ensure that you don't lose it.
# If you change or lose this key you will be unable to access variables stored in database.
# Make sure the secret is at least 30 characters and all random,
# no regular words or you'll be exposed to dictionary attacks.
db_key_base: {{GITLAB_SECRETS_DB_KEY_BASE}}
secret_key_base: {{GITLAB_SECRETS_SECRET_KEY_BASE}}
otp_key_base: {{GITLAB_SECRETS_OTP_KEY_BASE}}
encrypted_settings_key_base: {{GITLAB_SECRETS_ENCRYPTED_SETTINGS_KEY_BASE}}
active_record_encryption_primary_key: {{GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY}}
active_record_encryption_deterministic_key: {{GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY}}
active_record_encryption_key_derivation_salt: {{GITLAB_SECRETS_ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT}}
development:
db_key_base: development
test:
db_key_base: test