Rails

Install

Add the Dotenvx Rails gem to your Gemfile, outside any environment-specific group:

# Gemfile
gem "dotenvx-rails"

Install it:

$ bundle install

And get the CLI to encrypt files:

$ curl -sfS https://dotenvx.sh | sh

Encrypt

Start with a secret value in the .env file at your Rails project root, like:

# .env
HELLO="Secret"

Encrypt it with a single command.

$ dotenvx encrypt
◈ encrypted (.env)

The values become ciphertext and only your private key can unlock them.

# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"

HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="

Commit

Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git.

$ git add .env
$ git commit -m "encrypt .env"

Ship

Rails loads your encrypted secrets automatically. Create script/hello.rb to try it:

# script/hello.rb
puts "Hello #{ENV['HELLO']}"

Run it through Rails:

$ bin/rails runner script/hello.rb
⟐ injected env (2) from .env
Hello Secret

The dotenvx-rails gem loads your secrets before Rails configures your application. Read them through ENV in your controllers, jobs, and other server code.

Deploy

Find your private key with the keypair command.

$ dotenvx keypair
{"DOTENV_PUBLIC_KEY":"0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990","DOTENV_PRIVATE_KEY":"b37dbad0e00206f31486c4f44f8cc7abf2f1be96d5ba352eb791122b5e131bbf"}

Deploy your code and encrypted .env file, install your gems with bundle install, and set DOTENV_PRIVATE_KEY on your production environment. Keep .env.keys on your local machine.

Run it in production:

$ RAILS_ENV=production bin/rails runner script/hello.rb
⟐ injected env (2) from .env
Hello Secret

Dotenvx uses your private key to decrypt and inject your secrets just-in-time, but this time with the private key stored on your server.

Production

Give production its own secrets by creating a .env.production file:

# .env.production
HELLO="Production"

Encrypt it:

$ dotenvx encrypt -f .env.production
◈ encrypted (.env.production)

Commit it:

$ git add .env.production
$ git commit -m "encrypt .env.production"

Find the matching private key with dotenvx keypair -f .env.production. Set it as DOTENV_PRIVATE_KEY and set DOTENV_FILE to .env.production on your server.

Run the same script in production:

$ RAILS_ENV=production bin/rails runner script/hello.rb
⟐ injected env (3) from .env.production, .env
Hello Production

With RAILS_ENV=production, dotenvx-rails automatically loads .env.production and uses DOTENV_PRIVATE_KEY to unlock it. Same code, production secrets.

Rails also loads .env as a fallback. If it uses a different encryption key, supply that key as DOTENV_PRIVATE_KEY_2.

Conclusion

You've encrypted a .env file, committed it to git, and loaded its secrets automatically with dotenvx-rails. You've also learned how to set a private key on your server and use a separate encrypted file for production without changing your application code.

Your encrypted secrets now travel with your code. Set the matching keys in your hosting environment, and Rails handles loading them.