Heroku "highly recommends using PostgreSQL during development" so that's what I've been doing for the last several months. I'm using rails 3.2.8 and between Daniel Kehoe's excellent Rails Heroku Tutorial and Ryan Bates's railscast on Migrating to PostgreSQL I've been able to get apps running and deployed. My problem is that there's a lot that postgreSQL is doing under the hood (with roles, users, superusers, etc.) that I have no insight into. I'm particularly concerned about the fact that I've been using "trust" authentication both locally and in deployment. Does that mean that random people could access my app's database somehow?
Every now and then on the rails/github interwebs I come across references to keeping the app's config/database.yml file off of github (possibly only public or shared repositories) since that file contains password information. I always look at that file and scratch my head. I'm not putting password info there. Here's what that file looks like for development, test and production (Note, I'm only showing one of the three for brevity since they're all the same code.):
[development, test or production]:
adapter: postgresql
encoding: unicode
database: [myapp]_[development, test or production]
pool: 5
username: [myapp]
password:
I'm afraid to know what I should be doing to get postgreSQL set up right and deployed securely in my rails apps. Thanks in advance for any thoughts. You'll make the world a safer place!