Not to store FTP password in Vagrantfile (Vagrant push FTP strategy)

Question

I am developing a small site. I use vagrant for development environment and want to use it for deploy to production. Vagrant docs says that there is Vagrant push FTP strategy.

Config:

config.push.define "ftp" do |push|
  push.host = "ftp.company.com"
  push.username = "username"
  push.password = "password"
end

Usage:

vagrant push

It is quite enough for me, but thing that is stopping me is storing ftp host, username and password in Vagrantfile that is going to my Version Control System and it is bad practice.

Can you give any workaround for this case?

Answer 1

Generate hashed password and store it

openssl passwd -1 "Your_password"

Answer 2

I found solution using config file. Inspired with this question, I moved my sensitive data to separate file. I called it ftp.yml and added to .gitignore

ftp.yml

ftp_host: "host"
ftp_user: "username"
ftp_pass: "password"

.gitignore

ftp.yml

Vagrantfile

# loading FTP config
require 'yaml'
settings = YAML.load_file 'ftp.yml'

Vagrant.configure("2") do |config|

# vm config omitted

    config.push.define "ftp" do |push|
      push.host = settings['ftp_host']
      push.username = settings['ftp_user']
      push.password = settings['ftp_pass']
    end
end

It worked fine for me.

Answer 3

A simple solution is use of environment variable. It has the important benefit to not store password in clear text.

Vagrantfile:

config.push.define "ftp" do |push|
  push.host = "ftp.company.com"
  push.username = "username"
  push.password = ENV["FTP_PASSWORD"]
end

And export password in environment variable before call to vagrant:

export FTP_PASSWORD='super_secret'
vagrant push

Personally, I use 1Password command-line tool to retrieve password from my vault:

export FTP_PASSWORD=$(op get item ftp.company.com | jq '.details.fields[] | \
                        select(.designation=="password").value' -r)
vagrant push