I struggled with figuring out this issue, too. (It's not a Heroku-specific issue.)
Bottom line: an environment variable named RAILS_PRODUCTION_KEY
(or any other Rails environment-flavored variable name) is not a thing–Rails doesn't pay attention to it.
From the (weak, IMO) Rails documentation on the Rails 6 credentials feature, I had wrongly assumed that the production key (either in the RAILS_PRODUCTION_KEY
env variable or config/credentials/production.key
) would decrypt config/credentials/production.yml.enc
, the master key (either in the RAILS_MASTER_KEY
env variable or config/master.key
) would decrypt config/credentials.yml.enc
, and that a value for a given secrets key in config/credentials/production.yml.enc
would override the value for that key in config/credentials.yml.enc
. This is not the case.
This is how it actually works:
- Rails 6 uses a single key to decrypt a single encrypted secrets file.
- The default location of the decryption key is
config/master.key
and the default location of the secrets file is config/credentials.yml.enc
.
- If an environment variable of
RAILS_MASTER_KEY
is defined, Rails will read the decryption key from the environment variable, not from config/master.key
.
- When running in a given Rails environment (
production
/development
/etc.), if a corresponding secrets file exists in config/credentials
(e.g., config/credentials/production.yml.enc
), then Rails will use that secrets file only, and it will use the corresponding decryption key (e.g., config/credentials/production.key
) only to decrypt it.
- If an environment variable of
RAILS_MASTER_KEY
is defined, Rails will read the decryption key from the environment variable, not from the decryption key file. NOTE: regardless of the Rails environment, the environment variable that overrides the decryption key file is always RAILS_MASTER_KEY
.