@@ -239,32 +239,32 @@ Deploy Secrets to Production
239
239
Due to the fact that decryption keys should never be committed, you will need to
240
240
manually store this file somewhere and deploy it. There are 2 ways to do that:
241
241
242
- 1) Uploading the file:
242
+ #. Uploading the file
243
243
244
- The first option is to copy the **production decryption key ** -
245
- ``config/secrets/prod/prod.decrypt.private.php `` to your server.
244
+ The first option is to copy the **production decryption key ** -
245
+ ``config/secrets/prod/prod.decrypt.private.php `` to your server.
246
246
247
- 2) Using an Environment Variable
247
+ #. Using an Environment Variable
248
248
249
- The second way is to set the ``SYMFONY_DECRYPTION_SECRET `` environment variable
250
- to the base64 encoded value of the **production decryption key **. A fancy way to
251
- fetch the value of the key is:
249
+ The second way is to set the ``SYMFONY_DECRYPTION_SECRET `` environment variable
250
+ to the base64 encoded value of the **production decryption key **. A fancy way to
251
+ fetch the value of the key is:
252
252
253
- .. code-block :: terminal
253
+ .. code-block :: terminal
254
254
255
- # this command only gets the value of the key; you must also set an env var
256
- # in your system with this value (e.g. `export SYMFONY_DECRYPTION_SECRET=...`)
257
- $ php -r 'echo base64_encode(require "config/secrets/prod/prod.decrypt.private.php");'
255
+ # this command only gets the value of the key; you must also set an env var
256
+ # in your system with this value (e.g. `export SYMFONY_DECRYPTION_SECRET=...`)
257
+ $ php -r 'echo base64_encode(require "config/secrets/prod/prod.decrypt.private.php");'
258
258
259
- To improve performance (i.e. avoid decrypting secrets at runtime), you can decrypt
260
- your secrets during deployment to the "local" vault:
259
+ To improve performance (i.e. avoid decrypting secrets at runtime), you can decrypt
260
+ your secrets during deployment to the "local" vault:
261
261
262
- .. code-block :: terminal
262
+ .. code-block :: terminal
263
263
264
- $ APP_RUNTIME_ENV=prod php bin/console secrets:decrypt-to-local --force
264
+ $ APP_RUNTIME_ENV=prod php bin/console secrets:decrypt-to-local --force
265
265
266
- This will write all the decrypted secrets into the ``.env.prod.local `` file.
267
- After doing this, the decryption key does *not * need to remain on the server(s).
266
+ This will write all the decrypted secrets into the ``.env.prod.local `` file.
267
+ After doing this, the decryption key does *not * need to remain on the server(s).
268
268
269
269
Rotating Secrets
270
270
----------------
0 commit comments