Rails Deployment

Kamal Essentials

• Use Kamal 2 for zero-downtime deployments to VPS/bare metal (default in Rails 8)
• Kamal Proxy fronts the app (replaces Traefik) — TLS via Let's Encrypt is built in
• kamal deploy for production, kamal deploy -d staging for staging
• Secrets live in .kamal/secrets (env interpolation, not committed)
• Pull the registry password from encrypted credentials so only RAILS_MASTER_KEY is needed on the deployer: KAMAL_REGISTRY_PASSWORD=$(kamal secrets fetch --account myuser kamal/registry_password) or rails credentials:fetch kamal.registry_password (Rails 8.1)
• Registry-free Kamal (2.8+) runs a local registry by default; remote still recommended at scale
• Clear env vars in env.clear, secret refs in env.secret

deploy.yml Structure

service: myapp
image: myapp