Move the environment variables to an EnvironmentFile

site-cookbooks/kredits-github/recipes/default.rb

@@ -41,6 +41,7 @@ user deploy_user do
 end
 
 path_to_deploy = "/opt/#{app_name}"
+environment_file = "/home/deploy/.kredits-github_environment"
 application path_to_deploy do
   owner deploy_user
   group deploy_group
@@ -66,6 +67,22 @@ application path_to_deploy do
     owner deploy_user
     group deploy_group
     mode '0440'
+    sensitive true
+  end
+
+  env = {
+    'LOG_LEVEL'        => "info",
+    'APP_ID'           => credentials['app_id'],
+    'PRIVATE_KEY_PATH' => "#{path_to_deploy}/github_app_key.pem",
+    'WEBHOOK_SECRET'   => credentials['webhook_secret'],
+  }
+
+  file environment_file do
+    content env.sort.map {|k, v| "#{k}=#{v}" }.join("\n")
+    owner deploy_user
+    owner deploy_group
+    mode '0440'
+    sensitive true
   end
 
   template "/lib/systemd/system/#{app_name}.service" do
@@ -78,12 +95,7 @@ application path_to_deploy do
       group: deploy_group,
       app_dir: path_to_deploy,
       entry: "/usr/bin/node /usr/bin/npm start",
-      environment: {
-        'LOG_LEVEL'        => "info",
-        'APP_ID'           => credentials['app_id'],
-        'PRIVATE_KEY_PATH' => "#{path_to_deploy}/github_app_key.pem",
-        'WEBHOOK_SECRET'   => credentials['webhook_secret'],
-      }
+      environment_file: environment_file
     )
     notifies :run, "execute[systemctl daemon-reload]", :delayed
     notifies :restart, "service[#{app_name}]", :delayed

site-cookbooks/kredits-github/templates/default/nodejs.systemd.service.erb

@@ -6,9 +6,7 @@ ExecStart=<%= @entry %>
 WorkingDirectory=<%= @app_dir %>
 User=<%= @user %>
 Group=<%= @group %>
-<% unless @environment.empty? -%>
-Environment=<% @environment.each do |key, value| -%>'<%= key %>=<%= value %>' <% end %>
-<% end -%>
+EnvironmentFile=<%= @environment_file %>
 Restart=always
 
 [Install]