@@ -236,32 +236,32 @@ Deploy Secrets to Production
236
236
Due to the fact that decryption keys should never be committed, you will need to
237
237
manually store this file somewhere and deploy it. There are 2 ways to do that:
238
238
239
- 1) Uploading the file:
239
+ #. Uploading the file
240
240
241
- The first option is to copy the **production decryption key ** -
242
- ``config/secrets/prod/prod.decrypt.private.php `` to your server.
241
+ The first option is to copy the **production decryption key ** -
242
+ ``config/secrets/prod/prod.decrypt.private.php `` to your server.
243
243
244
- 2) Using an Environment Variable
244
+ #. Using an Environment Variable
245
245
246
- The second way is to set the ``SYMFONY_DECRYPTION_SECRET `` environment variable
247
- to the base64 encoded value of the **production decryption key **. A fancy way to
248
- fetch the value of the key is:
246
+ The second way is to set the ``SYMFONY_DECRYPTION_SECRET `` environment variable
247
+ to the base64 encoded value of the **production decryption key **. A fancy way to
248
+ fetch the value of the key is:
249
249
250
- .. code-block :: terminal
250
+ .. code-block :: terminal
251
251
252
- # this command only gets the value of the key; you must also set an env var
253
- # in your system with this value (e.g. `export SYMFONY_DECRYPTION_SECRET=...`)
254
- $ php -r 'echo base64_encode(require "config/secrets/prod/prod.decrypt.private.php");'
252
+ # this command only gets the value of the key; you must also set an env var
253
+ # in your system with this value (e.g. `export SYMFONY_DECRYPTION_SECRET=...`)
254
+ $ php -r 'echo base64_encode(require "config/secrets/prod/prod.decrypt.private.php");'
255
255
256
- To improve performance (i.e. avoid decrypting secrets at runtime), you can decrypt
257
- your secrets during deployment to the "local" vault:
256
+ To improve performance (i.e. avoid decrypting secrets at runtime), you can decrypt
257
+ your secrets during deployment to the "local" vault:
258
258
259
- .. code-block :: terminal
259
+ .. code-block :: terminal
260
260
261
- $ APP_RUNTIME_ENV=prod php bin/console secrets:decrypt-to-local --force
261
+ $ APP_RUNTIME_ENV=prod php bin/console secrets:decrypt-to-local --force
262
262
263
- This will write all the decrypted secrets into the ``.env.prod.local `` file.
264
- After doing this, the decryption key does *not * need to remain on the server(s).
263
+ This will write all the decrypted secrets into the ``.env.prod.local `` file.
264
+ After doing this, the decryption key does *not * need to remain on the server(s).
265
265
266
266
Rotating Secrets
267
267
----------------
0 commit comments