Add reader with support for secret files

[Radiergummi]

On some platforms such as Kubernetes or Docker Swarm, it's possible to pass sensitive configuration values to containers in files instead of environment variables. This is a good thing, and makes applications more secure.
Using secret files usually means the following dance:

1. Check for the variable we need in the process environment (so we can override a secret locally, for example).
2. If it isn't defined, check if a matching secret file exists.
3. If it does, read it, trim the content, and return that; a fallback, if given, otherwise.

Some software systems also use variables suffixed with _PATH, so instead of passing a password as an environment variable, you can pass the path of a file that contains it. This alters the flow to:

1. Check for the variable we need in the process environment.
2. If it isn't defined, check if a variable named {$variable}_PATH exists instead.
3. If it doesn't, or does not contain a valid filesystem path, return a fallback, if given.
4. Read the given path, trim the content, and return it.

It would be cool to have a reader available that does those things! In the larger picture, I'm trying to get this implemented in Laravel (see the related feature request).
Happy to provide a PR.

[hosni]

Hi @GrahamCampbell
Thanks for your great project, I just want to inform you that I'm ready to implement this.
If you have a plan for it just let me know.

[eznix86]

Any update on this?

[hosni]

Any update on this?

Hi @eznix86
Nothing yet, I am ready to implement this feature, but I need to be sure how @GrahamCampbell think about this idea.

[Radiergummi]

Just in case, I'd like to offer my help again; we're running a few bigger Laravel deployments relying on environment variables read from secret files, and I have experience in DevOps and cloud deployments, so if there are any concerns over the broader impact of this feature, I'm happy to chip in.

[GrahamCampbell]

Thanks for the thoughtful write-up, and to everyone who offered to implement it. I'm going to close this rather than leave it hanging. The repository adapters in this library model where the environment lives, and reading secrets out of files by naming convention is a different concern that I'd rather not take on here, not least because the conventions vary between platforms (_PATH, _FILE, /run/secrets, and so on) and any choice the library made would be the wrong one for someone.

The good news is that it doesn't need anything from this library. ReaderInterface is a single read() method and readers are consulted in order, so the env-then-file flow is just:

$repository = RepositoryBuilder::createWithDefaultAdapters()
    ->addReader(new SecretsFileReader('/run/secrets'))
    ->immutable()
    ->make();

with SecretsFileReader being a few lines in your own codebase or a small package. For the Laravel case that's the right layer anyway, since Laravel builds its own repository and can wire a reader in there.

[eznix86]

@GrahamCampbell thank you so much for this,

@Radiergummi It was a long wait, here it is https://github.com/eznix86/laravel-secrets-loader