Thoughts on support for importing secrets via environment variables?

[drobinson]

Has there been any thought or desire to include the ability to import secret config (api user/password, merchant ids, etc) via environment variables? I might pick this up unless there has already been some work done somewhere else, or opinions on how to handle this differently.

[drobinson]

Would likely repourpose this: https://github.com/AOEpeople/StackFormation/blob/master/src/StackFormation/ValueResolver/Stage/EnvironmentVariable.php

[therouv]

Hi @drobinson! Configuration for different environments are usually handled by creating a dedicated folder and placing the yaml files in this folder (see here) You can place the configuration in these yaml files.

Not exactly the same like environment variables but it works similar.

[drobinson]

Ah, sorry for the confusion. I understand the usage for different environments, and that's how I intend to use this tool. However, for certain configuration fields our current process involves using credstash to pull in credentials from a secret store and set them on environment variables on the server. This way the creds wouldn't need to be pushed to a repo with the other yaml files in plain text, but instead could be referenced via a placeholder like {env:SECRET_FIELD} which would get replaced when we run magento config:data:import with the value stored in the server environment.

I'll likely fork this repo and submit a pull request tomorrow so you can see what I mean.

[ktomk]

Most likely you're looking for environment variable substitution for or within settings. Typically this is ${VARNAME} (e.g. compare with Docker compose, Bash etc.). Please add a PR and reference this issue here so that it's more clear how you intend to implement this feature.

Next to that IIRC there is a feature in Magento (2) itself for environment variable substitution within configuration settings as they needed this for the cloud edition, so this is worth to check beforehand.

[peterjaap]

@ktomk what you're talking about is this; https://experienceleague.adobe.com/docs/commerce-operations/configuration-guide/deployment/examples/example-environment-variables.html

So if you wanted to store an API key for a certain vendor in environment variables, you could set it in CONFIG__WEBSITES__WEBSITENL__VENDORX__GENERAL__APIKEY where websitenl is your website code and the config path is vendorx/general/apikey.

Edit; changed the _ into __ as per @ktomk's remark below

[ktomk]

Yes, and take note the use of a double underscore __ as separator. Makes sense as it prevents clashes with other/common namespaces in environment parameters that use single underscore _. No idea if you intend to implement support for this therefore just FYI @peterjaap

[peterjaap]

Nah I'm not thinking about implementing that notation into this extension because of this reason; https://github.com/semaio/Magento2-ConfigImportExport/issues/46#issuecomment-1261302549

[ktomk]

Yes and interpolation in the data files is often more flexible, with these keys I'd go crazy honestly.

[therouv]

Closing. Feature has been implemented in #48