DEV Community: 1klap

Rails 8 authentication with OAuth and addition of a test suite

1klap — Thu, 28 Nov 2024 13:11:15 +0000

This is the core part of the full article on my site: https://railsguru.dev/lessons/rails-8-oauth-and-rspec-tests
There is also a repo with the code

Context

With Ruby on Rails 8, the framework ships with a built-in authentication generator! We're extending it with OAuth sign in and a RSpec test suite!

All of the code below is building on top of a project that ran bin/rails generate authentication

Add gems and providers

# Gemfile

gem "omniauth", "~> 2.1", ">= 2.1.2"
gem "omniauth-rails_csrf_protection", "~> 1.0", ">= 1.0.2"
gem "omniauth-google-oauth2", "~> 1.2"
gem "omniauth-github", "~> 2.0.0"

# config/initializers/omniauth_providers.rb

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :developer if Rails.env.development? || Rails.env.test?
  provider :google_oauth2, Rails.application.credentials.dig(:oauth, :google, :client_id), Rails.application.credentials.dig(:oauth, :google, :client_secret)
  provider :github, Rails.application.credentials.dig(:oauth, :github, :client_id), Rails.application.credentials.dig(:oauth, :github, :secret), scope: "user:email"
end

# config/routes.rb

Rails.application.routes.draw do
  get "/auth/:provider/callback" => "sessions/omni_auths#create", as: :omniauth_callback
  get "/auth/failure" => "sessions/omni_auths#failure", as: :omniauth_failure
end

Add a new model and controller

bin/rails g model OmniAuthIdentity uid:string provider:string user:references

The next code block is the heart of the whole implementation. It connects the OmniAuthIdentity with the User, does the lookup and the creation

# app/controllers/sessions/omni_auths_controller.rb

class Sessions::OmniAuthsController < ApplicationController
  allow_unauthenticated_access only: [ :create, :failure ]

  def create
    auth = request.env["omniauth.auth"]
    uid = auth["uid"]
    provider = auth["provider"]
    redirect_path = request.env["omniauth.params"]&.dig("origin") || root_path

    identity = OmniAuthIdentity.find_by(uid: uid, provider: provider)
    if authenticated?
      # User is signed in so they are trying to link an identity with their account
      if identity.nil?
        # No identity was found, create a new one for this user
        OmniAuthIdentity.create(uid: uid, provider: provider, user: Current.user)
        # Give the user model the option to update itself with the new information
        Current.user.signed_in_with_oauth(auth)
        redirect_to redirect_path, notice: "Account linked!"
      else
        # Identity was found, nothing to do
        # Check relation to current user
        if Current.user == identity.user
          redirect_to redirect_path, notice: "Already linked that account!"
        else
          # The identity is not associated with the current_user, illegal state
          redirect_to redirect_path, notice: "Account mismatch, try signing out first!"
        end
      end
    else
      # Check if identity was found i.e. user has visited the site before
      if identity.nil?
        # New identity visiting the site, we are linking to an existing User or creating a new one
        user = User.find_by(email_address: auth.info.email) || User.create_from_oauth(auth)
        identity = OmniAuthIdentity.create(uid: uid, provider: provider, user: user)
      end
      start_new_session_for identity.user
      redirect_to redirect_path, notice: "Signed in!"
    end
  end

  def failure
    redirect_to new_session_path, alert: "Authentication failed, please try again."
  end
end

Add tests for authentication code

Below is a taste of some specs that test the functionality from the generator.

For example the password reset controller tests:

# spec/requests/passwords_spec.rb

require 'rails_helper'
require 'active_support/testing/time_helpers'
include ActiveSupport::Testing::TimeHelpers

RSpec.describe "Password", type: :request do
  fixtures :users
  let(:user) { users(:existing) }
  before(:all) do
    ActionMailer::Base.deliveries.clear
  end

  describe "GET /passwords/new" do
    it "returns http success" do
      get "/passwords/new"
      expect(response).to have_http_status(:success)
    end
  end

  describe "POST /passwords" do
    it "creating a password reset sends an email and show instructions" do
      # TODO: need to decide whether to enqueue or perform jobs
      # for the moment, request spec will perform jobs, while model spec will enqueue jobs
      perform_enqueued_jobs do
        post passwords_path, params: { email_address: user.email_address }
      end
      # expect do
      #   post passwords_path, params: { email_address: user.email_address }
      # end.to have_enqueued_email(PasswordMailer, :reset).exactly(:once)

      expect(response).to redirect_to new_session_path
      follow_redirect!
      assert_select "div", text: "Password reset instructions sent (if user with that email address exists)."

      expect(ActionMailer::Base.deliveries.size).to eq(1)

      ActionMailer::Base.deliveries.first.tap do |mail|
        content = mail.html_part.body.to_s
        token = content.match(/passwords\/(.+)\/edit"/)[1]
        expect(User.find_by_password_reset_token!(token)).to eq(user)
      end
    end
  end

  describe "GET /passwords/:token/edit" do
    it "returns http success" do
      get edit_password_path(user.password_reset_token)
      expect(response).to have_http_status(:success)
      assert_select "form"
    end
  end

  describe "PUT /passwords/:token" do
    it "changes to users password with a valid token" do
      token = user.password_reset_token

      expect do
        patch password_path(token), params: { password: "W3lcome?", password_confirmation: "somethingelse" }
      end.not_to change { user.password_digest }
      expect(response).to redirect_to(edit_password_path(token))

      expect do
        patch password_path(token), params: { password: "short", password_confirmation: "short" }
      end.not_to change { user.password_digest }
      expect(response).to redirect_to(edit_password_path(token))

      expect do
        patch password_path(token), params: { password: "W3lcome?" }
      end.to change { user.reload.password_digest }
      expect(response).to redirect_to(new_session_path)
      expect(User.authenticate_by(email_address: user.email_address, password: "W3lcome?")).to_not be_nil

      # Reset the token after a successful password change
      token = user.password_reset_token

      expect do
        patch password_path(token), params: { password: "W3lcome?", password_confirmation: "W3lcome?" }
      end.to change { user.reload.password_digest }
      expect(response).to redirect_to(new_session_path)
      expect(User.authenticate_by(email_address: user.email_address, password: "W3lcome?")).to_not be_nil
    end
  end

  it "does not change a user's password with an expired token" do
    token = user.password_reset_token
    travel_to 16.minutes.from_now
    expect do
      patch password_path(token), params: { password: "W3lcome?", password_confirmation: "W3lcome?" }
    end.not_to change { user.password_digest }
    expect(response).to redirect_to(new_password_path)
  end
end

Or the session controller tests:

# spec/requests/sessions_spec.rb

require 'rails_helper'

RSpec.describe "Sessions", type: :request do
  fixtures :users
  let(:user) { users(:existing) }

  describe "GET /session/new" do
    it "returns http success" do
      get "/session/new"
      expect(response).to have_http_status(:success)
    end
  end

  describe "POST /session" do
    it "sign a user in when credentials are valid" do
      user.sessions.destroy_all
      expect do
        post session_path, params: { email_address: user.email_address, password: "password" }
      end.to change { user.sessions.count }.from(0).to(1)
    end

    it "does not sign a user in when credentials are invalid" do
      user.sessions.destroy_all
      expect do
        post session_path, params: { email_address: user.email_address, password: "wrong-password" }
      end.not_to change { user.sessions.count }
    end
  end

  describe "DELETE /session" do
    it "sign a user out" do
      post session_path, params: { email_address: user.email_address, password: "password" }
      expect(response).to redirect_to root_path
      expect(user.reload.sessions.count).to eq(1)
      follow_redirect!

      expect do
        delete session_path
      end.to change { user.sessions.count }.from(1).to(0)
      expect(response).to redirect_to new_session_path
    end
  end
end

Shameless plug

The original article can be found here: https://railsguru.dev/lessons/rails-8-oauth-and-rspec-tests
It's posted on railsguru.dev, a learning hub for all things Ruby on Rails that I'm building up. Please check it out and share your thoughts.

You can also follow me on X under @railsguru_dev

Minimalistic Authentication in Rails

1klap — Mon, 30 Oct 2023 15:44:16 +0000

I have used devise in the past for user authentication and while it is a powerful gem, it certainly imposes a lot of restrictions on you.

Most of the time, it is so closed off that you cannot even open the hood and tweak it to your needs. I think this comes mostly from the fact, that it concerns itself with just too much. From verification of a password up to tracking of failed sign-ins, there is a lot that seems to be possible with devise, what bothers me is that i can't take over some part if devise's solutions does not work for me.

So, for my projects, I wanted to get rid of the cruft and start with minimal solutions. One first step on this journey is
Tinytokenauth-rails https://github.com/1klap/tinytokenauth-rails

It just concerns itself with the problem, how does any controller know whether a user is signed in or not (if yes, who is it) and how to sign a given user in or out.

With this, the task (and freedom) to come up with a solution for the required work around this, falls to the developer. Like model creation, password checking, controller and routes for registration and session, email sending, password change handling, etc. But this is also the part where customization can and will occur. Like when you want to sign up users with an invite token or a referral code, it will be trivial to add when you are handling the sign-up code yourself.

To me, this make most sense. I while I agree that not every developer should write his own authentication code from scratch, because this can be hard problems with subtle caveats, I also think that this should not be considered arcane craft that must never be touched.

I am happy for the increase in flexibilty. If you crave the same, try out the gem and let me know in the comment section here or on github how you like it.

Rails 7: production deploy from scratch (Ubuntu 22.04 edition)

1klap — Thu, 02 Feb 2023 22:59:25 +0000

Here's how i setup my rails 7 deployments, starting from a fresh ubuntu 22.04 install and root user ssh access.
Part of the stack will be rbenv, nginx, passenger, postgres and capistrano, with options to set up yarn and node as well.

Replace vim with nano if you prefer to use the worse text editor.

Prereq

DNS is set up
you have a SSH key generated (if not, simply run ssh-keygen)

User setup

Connect as root [local]

$ ssh root@<your-url>

Add non-root user [remote]

$ adduser devops
  # set password 'devops_user_password'
$ adduser devops sudo
$ exit

Connect as devops (for all steps below) [local]

# Run the first command below only once
$ ssh-copy-id devops@<your-url> 
$ ssh devops@<your-url>

Disallow root login via SSH [remote]

$ sudo vim /etc/ssh/sshd_config
  # Set line 'PermitRootLogin yes' to 'PermitRootLogin no'
$ sudo service sshd restart

Set hostname [remote]

$ sudo hostnamectl set-hostname <your-url>
$ sudo hostnamectl # check if it is set

Install system dependencies [remote]

$ sudo apt update
$ sudo apt upgrade
$ sudo apt install git build-essential libssl-dev zlib1g-dev libyaml-dev

Install rbenv, ruby, bundler [remote]

$ git clone https://github.com/rbenv/rbenv.git ~/.rbenv
$ echo 'eval "$(~/.rbenv/bin/rbenv init - bash)"' >> ~/.bashrc
$ exec $SHELL
$ git clone https://github.com/rbenv/ruby-build.git "$(rbenv root)"/plugins/ruby-build
$ git clone https://github.com/rbenv/rbenv-vars.git "$(rbenv root)"/plugins/rbenv-vars
$ rbenv install 3.2.0
$ rbenv global 3.2.0
  # Test complete install with rbenv-doctor
$ curl -fsSL https://github.com/rbenv/rbenv-installer/raw/main/bin/rbenv-doctor | bash
$ ruby -v # Shows ruby version number if correctly installed
$ gem install bundler # You might be prompted to update some gems, see command below
$ gem update --system 3.4.6 # Check if this is recommended after bundler installation
$ bundle -v # Shows bundler version number if correctly installed

Install yarn, nvm, node (skip if not required) [remote]

If you generated your rails project with default javascript configuration (i.e. importmaps), then you might not need yarn, nvm and node at all.

$ curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/yarn-archive-keyring.gpg
$ echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
$ sudo apt install yarn
$ yarn -v # Shows yarn version number if correctly installed

$ curl https://raw.githubusercontent.com/creationix/nvm/master/install.sh | bash
$ exec $SHELL
$ nvm install 16
$ node -v # Shows node version number if correctly installed
$ # npm install -g esbuild # Uncomment if you package javascript with esbuild
$ # esbuild --version
$ # npm install -g typescript # If needed
$ # npm install -g sass # If needed

Install nginx, passenger [remote]

$ curl https://oss-binaries.phusionpassenger.com/auto-software-signing-gpg-key.txt | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/phusion-keyring.gpg >/dev/null
$ sudo sh -c 'echo deb https://oss-binaries.phusionpassenger.com/apt/passenger jammy main > /etc/apt/sources.list.d/passenger.list'
$ sudo apt update
$ sudo apt install nginx-extras libnginx-mod-http-passenger
$ sudo vim /etc/nginx/conf.d/mod-http-passenger.conf
  # Change the path to rbenv ruby
  passenger_ruby /home/devops/.rbenv/shims/ruby;
$ sudo service nginx restart
$ sudo service nginx status
$ sudo /usr/bin/passenger-config validate-install # Looks ok?
$ sudo /usr/sbin/passenger-memory-stats # Looks ok?
$ sudo rm /etc/nginx/sites-enabled/default
$ sudo vim /etc/nginx/sites-available/<your-url>
  # Example conf
server {
  server_name <your-url>;
  # server_name _;
  root /home/devops/<your-url>/current/public;
  #client_max_body_size 25m; # Set max upload size
  passenger_enabled on;
  passenger_app_env production;
  # Uncomment if you use ActionCable and/or Turbo Streams
  # location /cable {
  #   passenger_app_group_name APPNAME_ws;
  #   passenger_force_max_concurrent_requests_per_process 0;
  # }
  location ~ ^/assets {
    expires max;
    gzip_static on;
  }
  listen 80;
  listen [::]:80;
}
$ sudo ln -s /etc/nginx/sites-available/<your-url> /etc/nginx/sites-enabled/<your-url>
$ sudo service nginx restart
  # Check error log if required (like after deploy)
$ sudo vim /var/log/nginx/error.log

Install SSL cert

$ sudo apt install snapd
$ sudo snap install core; sudo snap refresh core
$ sudo snap install --classic certbot
$ sudo certbot --nginx
  # Follow instructions

Enable HTTP2 on nginx

$ sudo vim /etc/nginx/sites-available/<your-url>
  # Add http2 to listen command, see below
  # listen [::]:443 ssl http2 ipv6only=on;
  # listen 443 ssl http2;
$ sudo service nginx restart

Install postgresql [remote]

$ sudo apt install postgresql postgresql-contrib libpq-dev
$ sudo service postgresql@14-main status
$ sudo su - postgres
  # execute the following as postgres user
$ createuser --pwprompt postgres_production
  # Enter password
$ createdb -O postgres_production <your-app-name>_production
  # check db existence with 'psql' then '\l', quit with '\q'
$ exit

Set env vars [remote]

$ mkdir ~/<your-url>
$ cd ~/<your-url>
$ vim .rbenv-vars
  # Required: 
  RAILS_MASTER_KEY=<master.key content>
  SECRET_KEY_BASE=<some random sequence> # use local bundle exec rake secret
  RAILS_ENV=production

capistrano setup (once per project) [local]

Add capistrano gems to development group in your Gemfile

group :development do
  ...
  # Deployment
  gem 'capistrano', "~> 3.17", require: false
  gem 'capistrano-rails', "~> 1.6", ">= 1.6.2", require: false
  gem 'capistrano-passenger', "~> 0.2", ">= 0.2.1", require: false
  gem 'capistrano-rbenv', "~> 2.2", require: false
  gem 'ed25519', '>= 1.2', '< 2.0', require: false
  gem 'bcrypt_pbkdf', '>= 1.0', '< 2.0', require: false
  ...
end

$ bundle install
$ bundle exec cap install

in the file Capfile require the following modules

require "capistrano/rbenv"
require "capistrano/rails"
require "capistrano/passenger"

in the file config/deploy.rb set the following configs
add your public SSH key to github

set :rbenv_ruby, '3.2.0'
set :application, "<your-url>"
set :repo_url, "git@github.com:<your_github_handle>/<your_github_repo>.git"
set :deploy_to, "~/#{fetch :application}"
# Issue with propshaft as asset pipwlinw
# See: https://github.com/capistrano/rails/issues/257
# Workaround
set :assets_manifests, -> {
  [release_path.join("public", fetch(:assets_prefix), '.manifest.json')]
}

in the file config/deploy.rb set the following configs

server '<your-url>', user: 'devops', roles: %w{app db web}
set :branch, "main"

Deploy [local]

  # if ssh-key is not recognized run the following two commands
$ eval `ssh-agent`
$ ssh-add ~/.ssh/id_rsa
  # Deployment
$ cap production deploy

Security (optional but recommended) [remote]

Set up firewall

$ sudo ufw default allow outgoing
$ sudo ufw default deny incoming
$ sudo ufw allow ssh
$ sudo ufw allow 80/tcp comment 'accept http'
$ sudo ufw allow 443/tcp comment 'accept https'
$ sudo ufw enable
$ sudo ufw status

Set up fail2ban

$ sudo sudo apt update; sudo apt upgrade
$ sudo apt install fail2ban
$ # sudo apt install sendmail # do this only if you want to config sending fail2ban reports
$ sudo systemctl enable fail2ban
$ sudo systemctl start fail2ban
  # .local files overwrite values from .conf files
$ sudo cp /etc/fail2ban/fail2ban.conf /etc/fail2ban/fail2ban.local
$ sudo vim /etc/fail2ban/fail2ban.local
$ sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
  # This is the main config file, defaults for sshd are ok
$ sudo vim /etc/fail2ban/jail.local
$ sudo fail2ban-client status
  # detail of sshd jail
$ sudo fail2ban-client status sshd

How did your deployment go? Anything you like to do differently? Leave a comment below!

Rails 7 new production install: from zero to deploy (Ubuntu 20.04 edition)

1klap — Tue, 01 Feb 2022 12:54:16 +0000

This is my recipe to install a brand new Rails 7 app without Node pipeline on a fresh Ubuntu 20.04 server with shell access.

Ingredients:

Ubuntu 20.04
rbenv and Ruby 3.0.3
Rails 7 without Node.js
Postgres and Redis
Nginx, Passenger, Capistrano

Note: Replace UPPERCASE words with your own setup details.
Note 2: I use vim to edit files, you can and should replace vim with nano or any other editor of choice if you're not familiar with it.
Note 3: Always use random and long passwords, don't share them between applications and don't lose them. Also never commit unencrypted secrets to public repos.

This recipe works for me, but I would love to hear your thoughts on how it went for you! If something breaks or you do it differently, leave a comment below so I and the community can discuss and help out.

SSH Setup

Local



$ ssh root@SERVER_IP_ADDRESS
  # Enter password

Remote



$ adduser deploy
  # Create password, skip rest
$ adduser deploy sudo
$ exit

Local - (optional) Add sshkey for easier login



  # You need a ssh-key generated beforehand, run command
  # below if you never did that before and follow instructions
  # ssh-keygen 
$ ssh-copy-id deploy@SERVER_IP_ADDRESS
  # Enter password
$ ssh deploy@SERVER_IP_ADDRESS

Remote - (optional) Disallow root login via ssh



$ sudo vim /etc/ssh/sshd_config
  # Set line 'PermitRootLogin yes' to 'PermitRootLogin no'
$ sudo service sshd restart

Remote - (optional) Set hostname



$ sudo hostnamectl set-hostname HOSTNAME
$ sudo hostnamectl

rbenv and Ruby install

Remote



$ sudo apt update; sudo apt upgrade -y
$ sudo apt install rbenv
$ rbenv init
  # Follow instructions: append 'eval "$(rbenv init -)"' to ~/.bashrc
$ source ~/.bashrc # or disconnect and reconnect
$ mkdir -p "$(rbenv root)"/plugins
$ sudo apt install git
$ git clone https://github.com/rbenv/ruby-build.git "$(rbenv root)"/plugins/ruby-build
$ git clone https://github.com/rbenv/rbenv-vars.git "$(rbenv root)"/plugins/rbenv-vars
$ curl -fsSL https://github.com/rbenv/rbenv-installer/raw/main/bin/rbenv-doctor | bash
$ rbenv install 3.0.3

Image by rawpixel

Webserver Setup

Nginx install (remote)



$ sudo apt install nginx

Passenger install (remote)



$ sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 561F9B9CAC40B2F7
$ sudo sh -c 'echo deb https://oss-binaries.phusionpassenger.com/apt/passenger focal main > /etc/apt/sources.list.d/passenger.list'
$ sudo apt install ca-certificates 
$ sudo apt update
$ sudo apt install libnginx-mod-http-passenger
$ if [ ! -f /etc/nginx/modules-enabled/50-mod-http-passenger.conf ]; then sudo ln -s /usr/share/nginx/modules-available/mod-http-passenger.load /etc/nginx/modules-enabled/50-mod-http-passenger.conf ; fi
$ sudo ls /etc/nginx/conf.d/mod-http-passenger.conf
  # Verify that file exists
$ sudo vim /etc/nginx/conf.d/mod-http-passenger.conf
  # Change passenger_ruby line to to following (without #): 
  # passenger_ruby /home/deploy/.rbenv/shims/ruby;
$ sudo service nginx restart
$ sudo /usr/bin/passenger-config validate-install
$ sudo /usr/sbin/passenger-memory-stats

Config Nginx (remote)



$ sudo rm /etc/nginx/sites-enabled/default
$ sudo vim /etc/nginx/sites-available/APPNAME

Insert content below



server {
  listen 80;
  listen [::]:80;

  server_name YOUR_DOMAIN.ORG;
  # If you deploy without DNS and SSL, you could leave servername blank like below
  # server_name _;
  root /home/deploy/APPNAME/current/public;
  client_max_body_size 10m; # Set max upload size

  passenger_enabled on;
  passenger_app_env production;
  passenger_env_var RUBYOPT '-r bundler/setup'; # Cf issue: https://github.com/phusion/passenger/issues/2409

  # Uncomment if you use ActionCable and/or Turbo Streams
  # location /cable {
  #   passenger_app_group_name APPNAME_ws;
  #   passenger_force_max_concurrent_requests_per_process 0;
  # }  

  location ~ ^/assets {
    expires max;
    gzip_static on;
  }
}



$ sudo ln -s /etc/nginx/sites-available/APPNAME /etc/nginx/sites-enabled/APPNAME
$ sudo service nginx reload

Image by rawpixel

Database Setup

Postgres install (remote)



$ sudo apt install postgresql postgresql-contrib libpq-dev
$ sudo service postgresql@12-main status
$ sudo su - postgres
$ createuser --pwprompt deploy
  # Enter password
$ createdb -O deploy DBNAME
  # check db existence with 'psql' then '\l', quit with '\q'
$ exit

Redis install (remote) - Skip if you don't use ActionCable or Turbo Streams



$ sudo apt install redis
$ sudo service redis-server status

Image by rawpixel

Deploy Tool config - Capistrano

Local

Add to Gemfile



group :development do
  # ...
  gem 'capistrano'
  gem 'capistrano-rails'
  gem 'capistrano-passenger'
  gem 'capistrano-rbenv'
end



$ bundle install
$ bundle exec cap install STAGES=production

Add to Capfile



require 'capistrano/rails'
require 'capistrano/passenger'
require 'capistrano/rbenv'

set :rbenv_type, :user
set :rbenv_ruby, '3.0.3'

Edit config/deploy.rb



set :application, "APPNAME"
set :repo_url, "git@github.com:USERNAME/APPNAME.git"
# Also works with non-github repos, I roll my own gitolite server
set :deploy_to, "/home/deploy/#{fetch :application}"
set :rbenv_prefix, '/usr/bin/rbenv exec' # Cf issue: https://github.com/capistrano/rbenv/issues/96
append :linked_dirs, 'log', 'tmp/pids', 'tmp/cache', 'tmp/sockets', 'vendor/bundle', '.bundle', 'public/system', 'public/uploads'

Edit config/deploy/production.rb



server 'IP ADDRESS or DOMAIN', user: 'deploy', roles: %w{app db web}

Parts of this section are inspired from GoRails

Deployment

Remote - Prepare env vars



$ mkdir ~/APPNAME
$ vim ~/APPNAME/.rbenv-vars
  # Set envvars like
  # DATABASE_URL=postgresql://deploy:PASSWORD@127.0.0.1/APPNAME
    # This above can also be set in your database.yml file in your rails project if you prefer...
  # RAILS_MASTER_KEY=YOUR_KEY_IN_master.key
  # SECRET_KEY_BASE=SOME_OTHER_RANDOM_KEY

Local - Deploy! 🍾🍾🍾



$ bundle exec cap production deploy
  # Go visit your page already!

Remote - Connect to console



$ cd APPNAME/current
$ bundle exec rails c
  # You need to have the debug gem in prod env enabled! (Gemfile)

Image by rawpixel

DevOps Toolbox

These tools help you to stay on top of your DevOps game, if you have any other recommendations, leave a comment below.

Remote



$ top
$ netstat -nlp
$ tail -100 PATH_TO_LOGFILE
$ hostnamectl
$ df -h
$ sudo du -h -d 1 /

Local



$ dig DOMAIN

Bonus #1 - Install SSL

You need to have your DNS A-Record set up beforehand

Remote - Install Certbot



$ sudo apt install snapd
$ sudo snap install core; sudo snap refresh core
$ sudo snap install --classic certbot
$ sudo ln -s /snap/bin/certbot /usr/bin/certbot
$ sudo certbot --nginx

Bonus #2 - Enable HTTP2

Remote



$ sudo vim /etc/nginx/sites-available/APPNAME
  # Add http2 to listem command, see below
  # listen [::]:443 ssl http2 ipv6only=on;
  # listen 443 ssl http2;
$ sudo service nginx restart

How was your last deploy or are you planning your first one? What were the biggest hurdles you had to jump? What are you doing differently? Feel free to join the discussion below

Top image by rawpixel