Storing public/private key in .env for Laravel 5.8+

[rennokki]

I am currently running Laravel app on a multi-node infra and i cannot keep the keys locally, i need to find a way to centralize 'em.

Since 5.8, Laravel got shipped with https://github.com/vlucas/phpdotenv/releases/tag/v3.0.0 - support for multi-line .env, i think that would be a great choice to load the public & private keys from variables in the .env file:

PASSPORT_PUBLIC_KEY="------BEGIN PUBLIC KEY-----MJNHFGBASIYEYRA..."
PASSPORT_PRIVATE_KEY="-------BEGIN RSA PRIVATE KEY-----ASFOANasdara..."

Any thoughts?

[driesvints]

I'm not sure tbh. At one point I'd like to say yes because it's obviously easy to do so but at another point these really are separate key files in essence. It just seems weird to prop everything into an .env file.

[rennokki]

Seems weird that the env might just get bloated with a spaghetti string. I was thinking that maybe having keys on just one machine and running a command just on that machine to cache the keys during deployment or smth, but this looks like a potential security issue

[rahimnathwani]

Storing keys in environment variables is a good option when using a hosting environment without a persistent filesystem (e.g. Heroku).

I'm using the workaround from this comment, i.e.

• Storing the keys in environment variables, configured in Heroku's dashboard
• Creating the key files composer.json / post-install-cmd

[rahimnathwani]

@rennokki
What you're asking for appears to already exist, as of a year ago:
passport.php

Have I misunderstood?

[driesvints]

@rahimnathwani that's for file paths, not actual keys.

[rahimnathwani]

@driesvints It looks like #683 added the ability to store actual keys in those config variables.

[driesvints]

@rahimnathwani aha, good find. I'll try to document this 👍