Symfony finally swiped right on envvars (the gifless edition)

(Or, “why do we keep baking secrets into our artifacts?”)

A paper on the talk I gave at the Melbourne Symfony Developers group on September 26, 2017. Slides are available here.

Back to the Future

Symfony is unique as a web framework.

Most frameworks and applications re-read configuration with each boot.

$ bin/elasticsearch

… wait 30 seconds $ curl localhost:9200 [timeout] … wait 30 more seconds… $ curl localhost:9200 [timeout] … wait 30 more seconds…

Symfony compiles the DI container to PHP, including all configuration values.

But first… Let’s talk about secrets.

What is a secret?

The modern app has so many!

Summary: An application secret is anything you wouldn’t be comfortable putting directly in the HTML markup itself.

Here’s why we get a bad rep as PHP developers

Here are some ways I’ve seen secret management in production apps. Let’s take a look back through some ways PHP apps have managed secrets before the current generation.

The know it all “pattern”

The build it & they’ll come “pattern”

My biggest professional fuck-up, probably?

Dropping a production database because a test-site was misconfigured to use it by one of the above secret management methods (you can guess)

The config.yml is the new Config class …. “pattern”

Into today

(As is common in many Symfony projects)

The Fabien told me to “pattern”

What’s wrong with this approach?

OK, so what’s the answer?

Introducing environment variables (“envvars”) - the good

Introducing environment variables (“envvars”) - the not so good

Porting an existing application is easy

While you’re porting

Any gotchas?

The Dotenv component in Symfony 3.3


You can use Docker in development!

Docker is now quite stable on Mac and Windows!

It’s not (all) about security

I've talked a bit about how this is really all about security, but there's one big gotcha:

Fabien Potencier's note about environment variables

Note about environment variables not providing any security

Environment variables are not perfect

How do I make this better?

Further reading