search

vlucas / phpdotenv

Loads environment variables from `.env` to `getenv()`, `$_ENV` and `$_SERVER` automagically.
BSD 3-Clause "New" or "Revised" License
13.15k stars 626 forks source link

Add reader with support for secret files #552

Open Radiergummi opened 1 year ago

Radiergummi commented 1 year ago

On some platforms such as Kubernetes or Docker Swarm, it's possible to pass sensitive configuration values to containers in files instead of environment variables. This is a good thing, and makes applications more secure.
Using secret files usually means the following dance:

  1. Check for the variable we need in the process environment (so we can override a secret locally, for example).
  2. If it isn't defined, check if a matching secret file exists.
  3. If it does, read it, trim the content, and return that; a fallback, if given, otherwise.


Some software systems also use variables suffixed with _PATH, so instead of passing a password as an environment variable, you can pass the path of a file that contains it. This alters the flow to:

  1. Check for the variable we need in the process environment.
  2. If it isn't defined, check if a variable named {$variable}_PATH exists instead.
  3. If it doesn't, or does not contain a valid filesystem path, return a fallback, if given.
  4. Read the given path, trim the content, and return it.


It would be cool to have a reader available that does those things! In the larger picture, I'm trying to get this implemented in Laravel (see the related feature request).
Happy to provide a PR.

hosni commented 4 months ago

Hi @GrahamCampbell Thanks for your great project, I just want to inform you that I'm ready to implement this. If you have a plan for it just let me know.