PHPackages ixnode/php-vault - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [DevOps & Deployment](/categories/devops) 4. / 5. ixnode/php-vault ActiveLibrary[DevOps & Deployment](/categories/devops) ixnode/php-vault ================ Secure PHP Vault v1.3.0(4y ago)4982[1 issues](https://github.com/ixnode/php-vault/issues)MITPHPPHP ^7.4 || ^8.0 Since Apr 18Pushed 4y ago1 watchersCompare [ Source](https://github.com/ixnode/php-vault)[ Packagist](https://packagist.org/packages/ixnode/php-vault)[ Fund](https://ko-fi.com/bjoernhempel)[ RSS](/packages/ixnode-php-vault/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (10)Dependencies (3)Versions (13)Used By (0) PHPVault ======== [](#phpvault) [![CI workflow](https://github.com/ixnode/php-vault/actions/workflows/ci-workflow.yml/badge.svg?branch=master)](https://github.com/ixnode/php-vault/actions/workflows/ci-workflow.yml)[![PHP](https://camo.githubusercontent.com/69d249022de0850e66c6380742dfee2dd1e56415bfa5eec046b3307ba40e0e74/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d372e34253230253236253230382e302d3737376262332e7376673f6c6f676f3d706870266c6f676f436f6c6f723d7768697465266c6162656c436f6c6f723d353535353535267374796c653d666c6174)](https://www.php.net/supported-versions.php)[![PHPStan](https://camo.githubusercontent.com/f3eb7f82e8aff9545215cf56332a4d7b84b6ef2287b84e61d02473f67e1f1aef/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d4c6576656c253230382d627269676874677265656e2e7376673f7374796c653d666c6174)](https://phpstan.org/user-guide/rule-levels)[![LICENSE](https://camo.githubusercontent.com/7f01c72c66194a1c08441472d646243f804d0e74e2bfab2d9f4a0b50ed8ab760/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d3432386637652e7376673f6c6f676f3d6f70656e253230736f75726365253230696e6974696174697665266c6f676f436f6c6f723d7768697465266c6162656c436f6c6f723d353535353535267374796c653d666c6174)](https://github.com/ixnode/php-vault/blob/master/LICENSE) PHPVault is a PHP library that can create, read, encrypt and decrypt environment files (so-called dotenv files). For example is `.env` a plain file, `.env.enc` an encrypted file, etc. Within your project you can automatically load these encrypted environment variables from `.env.enc` into `getenv()`, `$_ENV` and `$_SERVER`. The corresponding key-value pairs within these dotenv files are encrypted and decrypted using an asymmetric encryption method ([Public-key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography)). Private keys are only available on productive systems for decrypting dotenv values. The public key, on the other hand, can be safely checked into the repository and is used everywhere to encrypt new values. The strict separation of configuration and code is a fundamental principle of software development and is based on the [The Twelve-Factor App](https://www.12factor.net/config) methodology. One way to do this is to store these data into separate configuration files such as the dotenv files mentioned above. These are mostly unencrypted, but usually contain very *sensitive* data such as database access and API keys. They must therefore never be checked into the code repository! Since these are usually files within the project, there is still a risk that this could happen by mistake. The PHPVault approach preserves the principle of separation and goes one step further: It encrypts plain dotenv files and allows them to be checked into the code repository. To decrypt and use the data on a productive system, simply exchange the private key. This approach is great for providing secure and automated deployment processes ([CI/CD](https://en.wikipedia.org/wiki/CI/CD), etc.). To start simply run: ``` $ composer require ixnode/php-vault ``` This requires [Composer](https://getcomposer.org/), a dependency manager for PHP. Command line command `vendor/bin/php-vault` ------------------------------------------- [](#command-line-command-vendorbinphp-vault) The basis of all operations is the command line tool `vendor/bin/php-vault`. Help can be displayed at any time: ``` $ vendor/bin/php-vault --help PHPVault command line interpreter. PHPVault, version v1.0.7 Commands: decrypt-file df Decrypts a given file. Requires a private key. display d Displays the environment variables from given file. display-env de Displays the environment variables from server. encrypt-file ef Encrypts a given file. Requires a public key. generate-keys gk Generates and displays a private and public key. info i Shows information. set s Sets or updates a new variable. Needs a public key. Run ` --help` for specific help ``` ``` $ vendor/bin/php-vault --version v1.0.7 ``` On development system --------------------- [](#on-development-system) Usually, you need the *public* key in this environment. Examples can be found below. There are several [ways](docs/ENVIRONMENT.md) to pass the public key to the `php-vault` interpreter. In the following, the key is loaded from the `.keys` directory (`--public-key`). ### Generate keys [](#generate-keys) ``` $ vendor/bin/php-vault generate-keys --persist The key pair is written to folder ".keys" Never add the private key to the repository! ``` - **Attention!**: - Keep the private key safe for the productive systems (`.keys/private.key`). - Delete the private key file `.keys/private.key` if you have saved it and submitted it to the admin for the productive system. - Use the public key on development and local systems (`.keys/public.key`). ### Create environment file [](#create-environment-file) - Add key-value pair `DB_USER=secret.user` with description `"DB Configs"` - Add key-value pair `DB_PASS=secret.pass` - Add key-value pair `DB_HOST=secret.host` - Add key-value pair `DB_NAME=secret.name` - Use public key (`--public-key` → read from `.keys/public.key`). ``` # Create file .env.enc $ vendor/bin/php-vault set .env.enc DB_USER secret.user "DB Configs" --public-key --create # Adds values to .env.enc $ vendor/bin/php-vault set .env.enc DB_PASS secret.pass --public-key $ vendor/bin/php-vault set .env.enc DB_HOST secret.host --public-key $ vendor/bin/php-vault set .env.enc DB_NAME secret.name --public-key ``` ### Display the environment file [](#display-the-environment-file) - The contents displayed are encrypted. - Do not need any key. ``` $ vendor/bin/php-vault display .env.enc --load-encrypted ... ``` On production system -------------------- [](#on-production-system) Usually, you need the *private* key in this environment. Examples can be found below. There are several [ways](docs/ENVIRONMENT.md) to pass the private key to the `php-vault` interpreter. In the following, the key is loaded from the `.keys` directory (`--private-key`). ### Display an encrypted file [](#display-an-encrypted-file) - Use private key (`--private-key` → read from `.keys/private.key`). ``` $ vendor/bin/php-vault display .env.enc --load-encrypted --display-decrypted --private-key +---------+-------------+-------------+ | Key | Value | Description | +---------+-------------+-------------+ | DB_USER | secret.user | DB Configs | | DB_PASS | secret.pass | | | DB_HOST | secret.host | | | DB_NAME | secret.name | | +---------+-------------+-------------+ ``` ### Decrypt an encrypted file [](#decrypt-an-encrypted-file) - Never add the produced decrypted file `.env` to the repository! - Use private key (`--private-key` → load from `.keys/private.key`). ``` $ vendor/bin/php-vault decrypt-file .env.enc --private-key The file was successfully written to ".env". ``` ### Display the decrypted file without encryption [](#display-the-decrypted-file-without-encryption) - Do not need any key. ``` $ vendor/bin/php-vault display .env --display-decrypted +---------+-------------+-------------+ | Key | Value | Description | +---------+-------------+-------------+ | DB_USER | secret.user | DB Configs | | DB_PASS | secret.pass | | | DB_HOST | secret.host | | | DB_NAME | secret.name | | +---------+-------------+-------------+ ``` Using the PHPVault class ------------------------ [](#using-the-phpvault-class) ### Load the private key from a given file [](#load-the-private-key-from-a-given-file) ```