Download the PHP package paeire/laravel-secrets-manager without Composer

On this page you can find all versions of the php package paeire/laravel-secrets-manager. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of paeire/laravel-secrets-manager

Informations about the package laravel-secrets-manager

Laravel Secrets Manager

Load secrets from AWS Secrets Manager into Laravel's configuration at boot before the database (or anything else) is used. It supports two modes (a general "full config" secret and an RDS rotation secret), configurable caching, and a command to refresh the cache.

Requirements

Installation

The service provider is auto-discovered. Optionally publish the config:

How it works

Secrets are loaded in the provider's register() which runs after Laravel loads its configuration but before any service (database, cache, mail, ...) is resolved. Values are written with config()->set(), so they override whatever config/*.php produced from .env, regardless of when the connection is first used.

Configuration

All settings are driven by environment variables (see config/secrets.php):

Variable Default Description
FULL_CONFIG false Enable the general secret loader.
AWS_SECRET_ID laravel-prod-secrets Secret id for the general loader.
AWS_DEFAULT_REGION us-east-1 AWS region.
RDS_ROTATION false Enable the RDS rotation loader.
AWS_SECRET_ID_RDS laravel-prod-secrets Secret id for the RDS loader.
RDS_READ_WRITE false Mirror the resolved host onto the read/write connection.
SECRETS_THROW_ON_FAILURE false Re-throw on load failure instead of only logging.
SECRETS_CACHE false Cache the general secret.
SECRETS_CACHE_STORE (default store) Cache store for the general secret.
SECRETS_CACHE_TTL 300 General secret cache TTL (seconds).
SECRETS_RDS_CACHE false Cache the RDS secret (off by default).
SECRETS_RDS_CACHE_STORE (default store) Cache store for the RDS secret.
SECRETS_RDS_CACHE_TTL 60 RDS secret cache TTL (seconds).

Mode 1 Full config

Set FULL_CONFIG=true. Each key in the secret's JSON is applied to the config repository and exported to the process environment, so it works whether your code reads it via config() or via env():

Only scalar values are exported to env(); structured (array) values are applied to config() only, since environment variables can't hold them.

Mode 2 RDS rotation

Set RDS_ROTATION=true. The secret uses the standard AWS RDS rotation shape; only the keys below are mapped onto database.connections.mysql, and any extra keys (engine, dbname, dbClusterIdentifier, ...) are ignored:

With RDS_READ_WRITE=true, the resolved host is also written to database.connections.mysql.read.host and ...write.host.

Caching

General secrets change rarely, so caching avoids an AWS call on every boot. RDS rotation secrets are not cached by default on purpose: a cached, rotated password would break authentication.

Caveat: if your cache store itself depends on a secret this package loads (for example a Redis password loaded via FULL_CONFIG), point SECRETS_CACHE_STORE at a self-contained store such as file, or leave caching disabled otherwise the cache can't be read before the secret it needs is loaded.

Refreshing the cache

After rotating or changing a cached secret, clear the cache so it is re-fetched on the next boot:

The command runs in its own process, so it invalidates the cache; the fresh values are loaded on the next request/boot.

Failure handling

By default, a failure to load secrets is logged (without leaking values) and the app continues to boot. Set SECRETS_THROW_ON_FAILURE=true to fail fast when secrets are mandatory.

Testing

License

MIT

All versions of laravel-secrets-manager with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
aws/aws-sdk-php Version ^3.0
illuminate/support Version ^10.0|^11.0|^12.0
illuminate/console Version ^10.0|^11.0|^12.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package paeire/laravel-secrets-manager contains the following files

Loading the files please wait ...