amtgard / host-env-vault

v0.2.0 2026-10-16 15:31 UTC

Requires

• php: ^8.4
• ext-sockets: *
• amtgard/builder-traits: ^2.0
• jedibc/optional: ^1.0
• psr/log: ^3.0

Requires (Dev)

• infection/infection: ^0.29
• monolog/monolog: ^3.7
• phpunit/phpunit: ^11.5

MIT

Published on Packagist.org on 2026-10-16 15:32 UTC

README

Composer library for host-env-vault runtime profiles: fetch env and file secrets over the profile unix socket while serve is running.

Inject-mode secrets (render + secrets.env) stay plain file reads; this package covers the framed socket protocol only.

Requirements

• PHP 8.4+
• ext-sockets

Install

composer require amtgard/host-env-vault

Usage

Point at the socket path ({runtime_dir}/sockets/{profile}.sock) or pass runtime_dir + profile name:

use Amtgard\HostEnvVault\RuntimeVaultClient;

$client = RuntimeVaultClient::builder()
    ->build()
    ->forRuntimeProfile('/run/host-env-vault', 'app-worker');

$apiSecret = $client->fetchEnv('API_SECRET');
$pem = $client->fetchFile('signing.pem');

Custom socket path:

$client = RuntimeVaultClient::builder()
    ->build()
    ->socketPath('/var/run/host-env-vault.sock');

Optional PSR-3 logger (debug on success, info on deny):

$client->logger($logger);

Complete each fetch promptly; the agent holds decrypted material under a short lease (see host-env-vault docs).

CLI

After composer install, vendor/bin/fetch-runtime-secret fetches one runtime entry. Pass the socket or runtime directory explicitly (no environment-variable defaults):

fetch-runtime-secret \
  --entry API_SECRET \
  --runtime-dir /run/host-env-vault \
  --profile app-worker

fetch-runtime-secret \
  --entry signing.pem \
  --file \
  --socket /run/host-env-vault/sockets/app-worker.sock

Secret bytes are written to stdout (for scripts and entrypoints).

Wire format

Matches host-env-vault serve:

Direction	Bytes
Request	opcode (u8) + length (u32 LE) + entry name (UTF-8)
Response	status (u8, 0=ok) + length (u32 LE) + secret bytes

Opcodes: 1 env, 2 file.

Development

composer install
composer test

See docs/reference/milestones.md for coverage and mutation targets on this repo.