Server provisioning in Vagrant using Rails' secrets

Vagrantfile

require 'yaml'

Vagrant.configure(2) do |config|
  config.vm.box = "ubuntu/trusty64"
  config.vm.network "forwarded_port", guest: 80, host: 8080
  
  # Parse secrets from Rails' config file (ignored in the repo)
  secrets_file = File.expand_path(File.join(File.dirname(__FILE__), 'config', 'secrets.yml'))
  secrets = YAML::load_file secrets_file

  database = secrets['production']['database']['database']
  username = secrets['production']['database']['username']
  password = secrets['production']['database']['password']

  # The provisioning script receives the environment variables in the env hash.
  # This allows us to keep things secret and use a single source of truth instead of
  # having databags and similar around many places. Single Source of Truth.
  config.vm.provision "shell", path: './config/deploy/server_provisioning.sh', env: {
    PRODUCTION_DATABASE_DATABASE: database,
    PRODUCTION_DATABASE_USERNAME: username,
    PRODUCTION_DATABASE_PASSWORD: password,
    NGINX_HOSTNAME: 'my.hostname.com'
  }
end