Rails 5.2 with master.key Digital Ocean deployment: ActiveSupport::MessageEncryptor::InvalidMessage: ActiveSupport::MessageEncryptor::InvalidMessage

Question

I have migrated my Ruby on Rails application from Rails 5.1.2 to Rails 5.2.0 to use the encrypted secrets. Application is successfully deployed to Digital Ocean Ubuntu Server. But when I go in browser to access, it shows the following log.

    ActiveSupport::MessageEncryptor::InvalidMessage: ActiveSupport::MessageEncryptor::InvalidMessage
  /home/deploy/apps/GeekyCricket/shared/bundle/ruby/2.4.0/gems/activesupport-5.2.0/lib/active_support/message_encryptor.rb:206:in `rescue in _decrypt'
  /home/deploy/apps/GeekyCricket/shared/bundle/ruby/2.4.0/gems/activesupport-5.2.0/lib/active_support/message_encryptor.rb:184:in `_decrypt'
  /home/deploy/apps/GeekyCricket/shared/bundle/ruby/2.4.0/gems/activesupport-5.2.0/lib/active_support/message_encryptor.rb:157:in `decrypt_and_verify'
  /home/deploy/apps/GeekyCricket/shared/bundle/ruby/2.4.0/gems/activesupport-5.2.0/lib/active_support/messages/rotator.rb:21:in `decrypt_and_verify'
  /home/deploy/apps/GeekyCricket/shared/bundle/ruby/2.4.0/gems/activesupport-5.2.0/lib/active_support/encrypted_file.rb:79:in `decrypt'
  /home/deploy/apps/GeekyCricket/shared/bundle/ruby/2.4.0/gems/activesupport-5.2.0/lib/active_support/encrypted_file.rb:42:in `read'
  /home/deploy/apps/GeekyCricket/shared/bundle/ruby/2.4.0/gems/activesupport-5.2.0/lib/active_support/encrypted_configuration.rb:21:in `read'
  /home/deploy/apps/GeekyCricket/shared/bundle/ruby/2.4.0/gems/activesupport-5.2.0/lib/active_support/encrypted_configuration.rb:33:in `config'
  /home/deploy/apps/GeekyCricket/shared/bundle/ruby/2.4.0/gems/activesupport-5.2.0/lib/active_support/encrypted_configuration.rb:38:in `options'
  /home/deploy/apps/GeekyCricket/shared/bundle/ruby/2.4.0/gems/activesupport-5.2.0/lib/active_support/core_ext/module/delegation.rb:271:in `method_missing'
  (erb):12:in `<main>'

I have added encrypted secrets using rails credentials:edit , which creates config/credentials.yml.enc and master.key .

I also have added the master.key file on /app_name/shared/config/ on my ubuntu server, also placed an env variable RAILS_MASTER_KEY . But still getting this error, I don't know what I am missing here.

Answer 1

Solution A and B are different solutions. Just choose which is good for you.

a. Deploy from Continous Integration

1. Edit deploy.rb

set :default_env, {
  "RAILS_ENV" => "production",
  "RAILS_MASTER_KEY" => ENV["RAILS_MASTER_KEY"]
}

2. Add RAILS_MASTER_KEY as a variable

• Travis CI
• GitLab CI

b. Usage of master.key

1. Edit deploy.rb

append :linked_files, "config/master.key"

2. Upload master.key with :linked_files

Let's assume our application's root path is /home/deploy/awesome-project . All we need to do is upload the key file to /home/deploy/awesome-project/shared/config/master.key .

Answer 2

I faced the same problem, when deploying for the first time on my DigitalOcean Droplet, every time I ran RAILS_ENV=production cap production deploy:initial it failed complaining this error - ActiveSupport::MessageEncryptor::InvalidMessage

I tried below options which all failed -

• removing master.key and credential.yml.enc file and then deploying again.
• adding both files again and deploying.

Finally one solution worked, i just added master.key , removing credentials.yml.enc file, committed it and redeployed, and it worked without changing my deploy.rb file