Daily Note - May 18, 2022

🌡 Weather

Feels Like: 66.2°F

Business

• Heroku sent an email saying that if I was using config vars within review apps, those might have been compromised during their security breach. I was using Heroku review apps for my Paddle-to-ConvertKit app and it has my CK API key and secret in there. Doesn’t look like you can rotate your keys (WTF!) in CK, so I contacted them about it. The first support person who responded didn’t understand the issue and recommended I turn on 2FA.

• After I explained the security implications, they sent my request to the appropriate team and they rotated them for me! Hopefully they will allow people to rotate their keys on demand, which is a standard security practice.

• Checked to see if the Ohana apps were affected, but it doesn’t look like they have any pipelines. I thought I had enabled review apps when I was testing the Rails 6 upgrade. Maybe they got removed when the apps got transferred to a team?

• While rotating secrets for the staging app, the first thing I did was remove SECRET_KEY_BASE from the Heroku config. I don’t see any references to it in the code. Then I looked at the activity and saw this warning from Sentry:

WARN -- sentry: You are running on Heroku but haven't enabled Dyno Metadata.
For Sentry's release detection to work correctly, please run `heroku labs:enable runtime-dyno-metadata`

• So I enabled that, then tested the sign up flow but got an error:

ArgumentError (SMTP-AUTH requested but missing secret phrase)

• Looks like the code is expecting the password to be SENDGRID_API_KEY but in staging it’s SENDGRID_PASSWORD and SENDGRID_USERNAME. I remember doing something with Sendgrid for another app. Looks like I’ll need the API key for staging as well. Yeah, it’s the same issue where they closed the account due to inactivity.

• Using the same Sendgrid account, I created a new API key but gave it only access to send mail.

• OK, this time it looks like it got past the auth issue but now it’s complaining that the from address is missing:

ArgumentError (SMTP From address may not be blank: nil):

• That’s because I updated the code to use the EMAIL_SENDER ENV var, but it wasn’t set in staging. The admin_support_email in settings.yml is listed on various admin pages as the contact person for people to send support emails to. It’s not used for sending mail from the app.

• After setting it to one of the verified senders in the SendGrid account, it worked.

• In Heroku, you can rotate the Heroku DB credentials by going to Resources, then click on Heroku DB, then Credentials tab, then Rotate all credentials. Heroku Postgres Credentials | Heroku Dev Center

• Next, I commented out config.secret_key in devise.rb because it’s supposed to use the Rails secret_key_base. So then I tried to deploy this branch to staging app, but of course the GitHub integration is still disabled, and using the Heroku CLI it said to clone the app, but for some reason it has older code than the prod app, even though it’s been connected to the GitHub repo and I can see that it’s been getting pushes from the Activity feed.

• I think what I need is to set staging as a git remote and then push to it. That worked: git remote add staging https://git.heroku.com/[redacted]-staging.git, then git push staging rotate-keys:master -f because the heroku remote was super behind. I thought that having it connected to GitHub would automatically update the Heroku remote but that’s not the case.

• That worked, and removing that Devise setting didn’t break anything. I can still sign in.

• I then removed the DEVISE_SECRET_KEY from config vars and sign in still works.

• Next is the google geocoding API. Looked it up here: https://console.cloud.google.com/google/maps-apis/credentials, then click edit API Key, then regenerate key at the top.

• Removed PUMA_WORKERS. It’s not referenced in the app. In puma.rb, the workers section uses WEB_CONCURRENCY, but it’s commented out right now.

• Rotated SECRET_TOKEN with rake secret

• Removed SENDGRID_USERNAME and SENDGRID_PASSWORD. They don’t seem to be used anymore.

• Fixed Ohana app feedback form. It wasn’t working because the Sendgrid account had been disabled. So I created a new API key and updated the SMTP settings, but it still failed because the email sender was being set to the email of the submitter, or defaulting to “anonymous@none.com”. Instead, I set the sender to a verified sender in the Sendgrid account, and put the submitter’s email in the body of the message.

To Do

• Test chruby-fish and submit PR to fix prefix for M1 macs