freebuu/laravel-vault

Laravel package for HashiCorp Vault

dev-master 2023-08-20 20:42 UTC

Requires

• php: ^7.4 || ^8.0
• csharpru/vault-php: ^4.2
• guzzlehttp/guzzle: ^6.3 || ^7.2
• http-interop/http-factory-guzzle: ^1.0
• illuminate/console: ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10
• illuminate/support: ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10

Requires (Dev)

• mockery/mockery: ^1.0
• orchestra/testbench: ^4.0
• phpunit/phpunit: ^8.0
• squizlabs/php_codesniffer: ^3.6

MIT

• Maksim

• laravel
• vault
• hashicorp

README

Get your .env from remote (HaspiCorp Vault) on deploy

Warning! This is very beginning alpha version without usable realise. Not recommended for using now

Quickstart

Install

composer require freebuu/laravel-vault
php artisan vendor:publish --tag=config --provider="FreeBuu\LaravelVault\LaravelVaultServiceProvider"

Configure

Add patches from Vault and variables to secrets in vault.php

'vars' => [
    'patches' => [
        '/secret/database/{env}'
    ],
    'patch_variables' => [
        'env' => 'production',
    ],
  ]

Override credentials

Make vault.json file with Vault options - structure MUST be same as vault.php

You can override here ALL options from vault.php

{
  "connections": {
    "vault": {
      "host": "http://vault",
      "role_id": "your_secret_id",
      "secret_id": "your_secret_id"
    }
  }
}

Use

base64 -w 0 vault.json | php artisan vault:get --stdin --b64

If all OK (credentials is actual and have access to secret patches), you see merged values from all patches:

+---------+------------+
| Key     | Value      |
+---------+------------+
| secret1 | value1     |
| secret2 | value2     |
+---------+------------+

• For save this in .env - add option --output=currentEnv
• For save this in .env.next - add option --output=nextEnv

Use in CI

Here is a shorthand command special from CI

• On runner, obtain a token docs
• Obtain .env with that token

php artisan vault:ci s.JYVfe67632rRDtyf --app=my_project --env=production

• s.JYVfe67632rRDtyf - Vault one-time token
• my_project - App name, set the 'app' patch variable. Optional.
• production - App env, set the 'env' patch variable. Optional.