SecretVault -- store your secrets inside your repository

Your Libraries & OS Mentoring Libraries
, ,
21

I can’t reproduce this.

Check this repository for an example: GitHub - hissssst/secret_vault_example: Example of secret_vault usage

22

Thanks for checking!

Interestingly I have this same setup, and works great locally. Only seems to have the problem when I am trying to deploy it.
Building mix release and starting on render.
When I build a release locally that seems to work more or less.

EDIT:

I found the problem!
In our build script we have migration running as the last step:
_build/$MIX_ENV/rel/xxx/bin/xxx eval "xxx.Release.migrate"
When it wants to run this step we get that error I sent earlier, even locally.

We have this setup: How to migrate Mix Release projects · Fly
Anything with eval post build does not seem to work.

23

I was able to reproduce the issue on this project by doing the following:

  1. build a release: MIX_ENV=dev mix release --overwrite
  2. try to eval: _build/dev/rel/playground/bin/playground eval 'Playground.hello()'

Same error:

ERROR! Config provider Config.Reader failed with:
{"init** (MatchError) no match of right hand side value: {:error, {:no_configuration_for_app, :playground}}
    (stdlib 4.1.1) erl_eval.erl:496: :erl_eval.expr/6
    /Users/tbj/projects/secret_vault_example/_build/dev/rel/playground/releases/0.1.0/runtime.exs:3: (file)
    (elixir 1.14.2) src/elixir.erl:294: :elixir.eval_forms/4
    (elixir 1.14.2) lib/module/parallel_checker.ex:107: Module.ParallelChecker.verify/1
    (elixir 1.14.2) lib/code.ex:425: Code.validated_eval_string/3
    (elixir 1.14.2) lib/config.ex:288: Config.__eval__!/3
    (elixir 1.14.2) lib/config/reader.ex:92: Config.Reader.read!/2
1 Like
24

Just for reference, we are using secret_vault now in production with the following setup:

We have a runtime config setup like this: Tips for Improving Your Elixir Configuration

The only env var we pull in config.exs is for secret_vault.

Since eval does not work with this setup, as mentioned above I did the following:

I changed the migrations to run in Application.start/2 with GitHub - mspanc/ecto_boot_migration: Tool for running Ecto migrations upon boot of the Elixir application.

I also changed the way seeds run in staging to use start_phase/3 Application — Elixir v1.14.2

For now this setups seems to work well, and secret_vault is looking great!

The only thing I had to change in runtime.exs compared to what was shared here is that I have to use:

{:ok, config} = SecretVault.Config.fetch_from_env(:xxx, to_string(config_env()), "default")

otherwise it seemed to always default to “prod”.
This could be related to secret_vault doing Mix.env() here

and the fetching running in runtime.exs where config_env/0 should be used:
https://hexdocs.pm/elixir/main/Config.html#module-migrating-from-use-mix-config

25

Wow, thank you very much for this feedback,I’ll definitely add this information to usage guide and mention you in the project’s README :heart:

1 Like
26

What do you mean?

27

This SecretVault -- store your secrets inside your repository - #23 by benonymus

28

Appreciate it! Not sure if needed for it, but here is my GitHub profile: benonymus (Bence Janos Toth) · GitHub

1 Like
29

I can’t edit my answer, to give a bit more explanation on this:

I cloned your playground project, and built a release with:
MIX_ENV=dev mix release --overwrite.
Then when I try to call a function with eval in the release (analogous to the way we ran migrations and seeds)
_build/dev/rel/playground/bin/playground eval 'Playground.hello()',
it gives an error that I pasted here:

This can be an issue for many projects considering that, that is the recommended way to run migrations in the Phoenix release docs: Deploying with Releases — Phoenix v1.7.10
_build/prod/rel/my_app/bin/my_app eval "MyApp.Release.migrate"

30

Hi, yeah, I’ve edited the usage guide and included examples on usage in runtime.exs, plus I’ve created SecretVault.runtime_config macro which removes the boilerplate in runtime.exs

31

Hey,

I tried the updated docs on the playground app, it works in iex nicely, but eval still does not seem to work.
I tried to run everything the same as described in the previous message.

_build/dev/rel/playground/bin/playground eval ‘Playground.hello()’
ERROR! Config provider Config.Reader failed with:
{** (MatchError) no match of right hand side value: {:error, {:no_configuration_for_app, :playground}}
(stdlib 4.1.1) erl_eval.erl:496: :erl_eval.expr/6
/Users/tbj/projects/secret_vault_example/_build/dev/rel/playground/releases/0.1.0/runtime.exs:4: (file)

“init terminating in do_boot”,{{badmatch,{error,{no_configuration_for_app,playground}}},[{erl_eval,expr,6,[{file,“erl_eval.erl”},{line,496}]},{elixir_eval,‘FILE’,1,[{file,"/Users/tbj/projects/secret_vault_example/build/dev/rel/playground/releases/0.1.0/runtime.exs"},{line,4}]}]}}
init terminating in do_boot ({{badmatch,{error,{no_configuration_for_app,playground}}},[{erl_eval,expr,6,[{},{}]},{elixir_eval,FILE,1,[{},{_}]}]})

Crash dump is being written to: erl_crash.dump…done

32

Hmmmmmmmm hmmm