Search code examples
ruby-on-railspostgresqlsslheroku

How to secure Postgres client certificates on Heroku

I'm connecting a Rails app hosted on Heroku, to an external PostgreSQL database using SSL certificates for authentication.

This requires three files: (1)the signed certificate (2)the key (3)the root ca certificate.

The signed cert and the root cert can both be added to the git repo, but the key must be kept secure.

For passwords, we would use ENV/'Config Vars' to keep things safe .... but how do I secure the key file?

I asked Heroku themselves, but they said this was "an issue that falls outside the nature of the Heroku Support policy."

So I'm asking the experts instead 😉

Solution

  • One way to avoid commiting the key file would I guess be to add the key to a ENV var and then setup a git hook or Procfile command that dumps the ENV var into a file (since the file system is reset every time you push). You can use the PGSSLKEY ENV var to set the file path.