Skip to content
My Beast
Cart
Developer docsMenu

Secrets · Guides

Pull variables on a server

A server, a deploy or a CI job reads one environment with a token of its own. It can write the variables to a .env, or start a command with them and write nothing.

What a machine needs

  1. A service token for the environment it reads, made on the project's Tokens page. One per machine, so each can be revoked alone: see Manage service tokens.
  2. The CLI, mybeast-secrets: see Install.
  3. Two lines in its environment, the address and the token, shown together when the token is made:
Terminal
export MYBEAST_SECRETS_URL=https://services.my-beast.com/secrets
export MYBEAST_SECRETS_TOKEN=st_….…

In a shell or its profile, as they are. In a CI's secrets or a server's settings, set the two names to these values. The CLI hands the token to curl on its standard input, never on a command line, where other users could see it.

Write a .env

In the app's folder:

Terminal
mybeast-secrets pull
  • It writes .env, readable by its owner only. --out config/app.env writes somewhere else; --out - prints the file and writes nothing.
  • The file is written next to its place and moved there whole, so the app never reads half of it.
  • If Secrets can't be reached or refuses the token, nothing is written: the .env there stays as it was.
  • It overwrites only a .env it wrote itself, which it knows by its first line. To replace a hand-made one, move it away or add --force.

Laravel caches its configuration

After php artisan config:cache, Laravel no longer reads .env. Pull before caching, and cache again after each pull, as in the deploy below.

Start a command with them

Terminal
mybeast-secrets run -- php artisan queue:work

run reads the environment, puts every variable into the command's environment and starts the command in its place, so signals and the exit status are the command's own. Nothing is written to disk.

If the read fails, the command isn't started: an app never starts without its variables. Each start reads again, so a restart picks up the latest values.

Pull or run

  • pull when the app reads a .env file, or should start even while Secrets can't be reached: the last file stays.
  • run when no secret should be on disk, and the process is started again to take a change.

In a deploy or CI

A deploy that builds a release in its own folder pulls into it before anything reads the configuration:

deploy.sh
cd /var/www/shop/releases/42
mybeast-secrets pull
php artisan config:cache

In CI, keep the two lines as the CI's secrets, install a pinned release rather than latest, and run the job's command with the variables:

CI step
curl -fsSLo ~/.local/bin/mybeast-secrets https://github.com/my-beast/cli/releases/download/v0.1.0/mybeast-secrets
chmod +x ~/.local/bin/mybeast-secrets
~/.local/bin/mybeast-secrets run -- ./vendor/bin/phpunit

Give CI a token of its own, for the environment the job needs, such as staging for tests.

Without the CLI

Anything that can make an HTTPS request can read the environment as JSON, a .env or shell lines, with the same token. See the API.