23 lines
1.4 KiB
Ruby
23 lines
1.4 KiB
Ruby
# ActiveRecord Encryption Configuration
|
|
# Encryption keys derived from SECRET_KEY_BASE (no separate key storage needed)
|
|
# Used for encrypting sensitive columns (currently: TOTP secrets)
|
|
#
|
|
# Optional: Override with env vars (for key rotation or explicit key management):
|
|
# - ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY
|
|
# - ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY
|
|
# - ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT
|
|
Rails.application.config.after_initialize do
|
|
# Use env vars if set, otherwise derive from SECRET_KEY_BASE (deterministic)
|
|
primary_key = ENV['ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY'] || Rails.application.key_generator.generate_key('active_record_encryption_primary', 32)
|
|
deterministic_key = ENV['ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY'] || Rails.application.key_generator.generate_key('active_record_encryption_deterministic', 32)
|
|
key_derivation_salt = ENV['ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT'] || Rails.application.key_generator.generate_key('active_record_encryption_salt', 32)
|
|
|
|
# Configure Rails 7.1+ ActiveRecord encryption
|
|
Rails.application.config.active_record.encryption.primary_key = primary_key
|
|
Rails.application.config.active_record.encryption.deterministic_key = deterministic_key
|
|
Rails.application.config.active_record.encryption.key_derivation_salt = key_derivation_salt
|
|
|
|
# Ensure encryption is enabled
|
|
Rails.application.config.active_record.encryption.support_unencrypted_data = false
|
|
end
|