production:
    secret_key_base: 800afb35d5086b2c60ebd35c01b2bd2b522c2492
    db_username: ...
    db_password: ...

{{ role }}:
    secret_key_base: {{ secret_key }}
    db_username: {{ db_user }}
    db_password: {{ db_pass }}

{{ role }}:
    secret_key_base: ||secret_key_base||
    db_username: {{ db_user }}
    db_password: {{ db_pass }}

/srv/salt/rails/secrets.yml:
  cmd.run:
# Fill in the secret key base (used for cookies).  We can't use
# jinja2 for this, since jinja would complain about the other
# variables that it doesn't know how to replace.  We want our
# output to be a jinja template.
- name: |
    cat /srv/salt/rails/secrets.yml.in |
      sed -e 's/||secret_key_base||/{{ salt['random.get_str'](length=80) }}/;' |
      cat > /srv/salt/rails/secrets.yml
    chmod 400 /srv/salt/rails/secrets.yml
- creates: /srv/salt/rails/secrets.yml
- runas: root

/var/railroad/{{host_role}}/shared/config/secrets.yml:
  file.managed:
- source: salt://rails/secrets.yml
- mode: 400
- user: railroad-{{host_role}}
- group: railroad-{{host_role}}
- template: jinja
- defaults:
    role: host_role
    db_username: m_u
    db_password: m_p