use aws secret

config/dotenv.rb

@@ -1,25 +1,41 @@
 # frozen_string_literal: true
 
-if ENV['RAILS_ENV'] == 'production' && ENV['SECRET_KEY_BASE'].to_s.empty?
-  require 'dotenv'
-  require 'securerandom'
+if ENV['RAILS_ENV'] == 'production'
+  if !ENV['AWS_SECRET_MANAGER_ID'].to_s.empty?
+    require 'aws-sdk-secretsmanager'
 
-  dotenv_path = "#{ENV.fetch('WORKDIR', '.')}/docuseal.env"
+    client = Aws::SecretsManager::Client.new
 
-  unless File.exist?(dotenv_path)
-    default_env = <<~TEXT
-      DATABASE_URL= # keep empty to use sqlite or specify postgresql database URL
-      SECRET_KEY_BASE=#{SecureRandom.hex(64)}
-    TEXT
+    secret_id = ENV.fetch('AWS_SECRET_MANAGER_ID', '')
 
-    File.write(dotenv_path, default_env)
+    client.get_secret_value(secret_id:).secret_string.split("\n").each do |line|
+      key, value = line.split('=', 2)
+
+      ENV[key] = value if !key.to_s.empty? && !value.to_s.empty?
+    end
+
+    RubyVM::YJIT.enable if ENV['RUBY_YJIT_ENABLE'] == 'true'
+  elsif ENV['SECRET_KEY_BASE'].to_s.empty?
+    require 'dotenv'
+    require 'securerandom'
+
+    dotenv_path = "#{ENV.fetch('WORKDIR', '.')}/docuseal.env"
+
+    unless File.exist?(dotenv_path)
+      default_env = <<~TEXT
+        DATABASE_URL= # keep empty to use sqlite or specify postgresql database URL
+        SECRET_KEY_BASE=#{SecureRandom.hex(64)}
+      TEXT
+
+      File.write(dotenv_path, default_env)
+    end
+
+    database_url = ENV.fetch('DATABASE_URL', nil)
+
+    Dotenv.load(dotenv_path)
+
+    ENV['DATABASE_URL'] = ENV['DATABASE_URL'].to_s.empty? ? database_url : ENV.fetch('DATABASE_URL', nil)
   end
-
-  database_url = ENV.fetch('DATABASE_URL', nil)
-
-  Dotenv.load(dotenv_path)
-
-  ENV['DATABASE_URL'] = ENV['DATABASE_URL'].to_s.empty? ? database_url : ENV.fetch('DATABASE_URL', nil)
 end
 
 if ENV['DATABASE_URL'].to_s.split('@').last.to_s.split('/').first.to_s.include?('_')