Download the PHP package moselwal/secret-resolver without Composer

On this page you can find all versions of the php package moselwal/secret-resolver. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of moselwal/secret-resolver

Informations about the package secret-resolver

moselwal/secret-resolver

Runtime secret resolution for TYPO3 YAML configuration.

What does this extension do?

TYPO3 supports %env(VAR)% in site configuration YAML — but only for plain environment variables. In container and Kubernetes environments, secrets are often mounted as files (/run/secrets/) or referenced via *_FILE environment variables. And in production setups with HashiCorp Vault, AWS Secrets Manager or similar tools, you may want to resolve secrets directly from these backends.

This extension adds the %secret(KEY)% syntax that resolves secrets from configurable sources — with a built-in cascade for file-based secrets and an extensible provider architecture for direct backend integration.

Installation

text

Usage

Simple keys (cascade resolution)

The key is resolved through all registered providers in priority order. First match wins.

Extended keys (provider-targeted resolution)

text

Extended key format: %secret(provider:path/to/secret.subKey)%

Part Required Description
provider Yes Provider name (e.g. vault, aws-sm) — routes directly to that provider
path No Secret path with / separators (e.g. kv-v2/database)
subKey No JSON sub-key after last . in the final path segment — extracts a field from a JSON response

Sub-key extraction: If the provider returns a JSON string like {"password":"s3cret","username":"admin"}, the sub-key password extracts "s3cret" automatically.

Simple keys (without :) continue to work exactly as before — fully backward-compatible.

Built-in resolution cascade

For simple keys like %secret(DB_PASSWORD)%:

Priority Provider Source Example
30 FileEnvSecretProvider DB_PASSWORD_FILE env → read file DB_PASSWORD_FILE=/vault/secrets/db-pass
20 RunSecretsSecretProvider /run/secrets/db_password Docker/K8s secret mount

First match wins. Empty values and whitespace-only files are skipped.

Works in all TYPO3 YAML files

The %secret()% placeholder hooks into TYPO3's central YamlFileLoader, so it works in all TYPO3 YAML configurations — not just Site Configuration:

Caching

Resolved values are cached by TYPO3 in cache.core (identical to %env()%). After secret rotation:

Implementing a custom SecretProvider

The extension is designed for extensibility. Any TYPO3 extension can add its own secret provider — no modification of the core package required.

Step 1: Implement SecretProviderInterface

text

Step 2: Register via Services.yaml

No manual registration needed — the provider is automatically discovered. TYPO3's DI container picks up all SecretProviderInterface implementations via the _instanceof auto-tagging configured by this extension.

Just make sure your extension's Configuration/Services.yaml has autowiring enabled (TYPO3 default):

The VaultClient dependency is injected automatically if registered in your extension's DI container.

Step 3: Use it

text

SecretKey properties available to providers

Property Type Description
$key->raw string Original input (DB_PASSWORD or vault:kv-v2/db.password)
$key->upperCase string Upper-cased key name (without provider prefix)
$key->lowerCase string Lower-cased key name (without provider prefix)
$key->provider ?string Provider name (vault) or null for simple keys
$key->path ?string Path segment (kv-v2/db) or null
$key->subKey ?string Sub-key for JSON extraction (password) or null
$key->isExtended() bool true if provider prefix is present
$key->getKeyName() string Key without provider prefix (kv-v2/db.password)
$key->getSecretPath() ?string Path without sub-key (kv-v2/db) or null

Priority guidelines

Priority Use case
50+ Override everything (e.g. local dev mock provider)
40 Primary backend (Vault, AWS SM, Azure Key Vault)
30 File-based env vars (built-in)
20 Docker/K8s secret mounts (built-in)
10 Fallback / last resort

Requirements

All versions of secret-resolver with dependencies

PHP Build Version
Package Version
Requires php Version ^8.5
typo3/cms-core Version ^14.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package moselwal/secret-resolver contains the following files

Loading the files please wait ...