Add Laravel Environment Decryption Support

[angus-mcritchie]

I have created a custom script to automate the Laravel environment decryption which I've pasted below.

Is this something you'd like added to the image @jaydrogers?

entrypoint.d/20-decrypt-environment-file.sh

#!/bin/sh

if [ -z "$APP_ENV" ]; then
    APP_ENV="production"
fi

# check $APP_BASE_DIR is set, i not set to '/var/www/html'
if [ -z "$APP_BASE_DIR" ]; then
    APP_BASE_DIR="/var/www/html"
fi

# check APP_BASE_DIR/.env.$APP_ENV file exists, i not skip decryption
if [ ! -f "$APP_BASE_DIR/.env.$APP_ENV.encrypted" ]; then
    echo "🔐 $APP_BASE_DIR/.env.$APP_ENV.encrypted file not found. Skipping decryption."
    return 0
fi

if [ -f "$APP_BASE_DIR/.env.$APP_ENV" ]; then
    echo "🔐 $APP_BASE_DIR/.env.$APP_ENV file already decrypted. Skipping decryption."
    return 0
fi

# check $LARAVEL_ENV_ENCRYPTION_KEY is set, i not skip decryption
if [ -z "$LARAVEL_ENV_ENCRYPTION_KEY" ]; then
    echo "🔐 LARAVEL_ENV_ENCRYPTION_KEY not set. Skipping decryption."
    return 0
fi

# check $APP_BASE_DIR/artisan file exists, i not skip decryption
if [ ! -f "$APP_BASE_DIR/artisan" ]; then
    echo "🔐 Artisan file not found. Skipping decryption."
    return 0
fi

if grep -q "APP_KEY" ".env.$APP_ENV.encrypted"; then
    echo "ℹ️ .env.$APP_ENV.encrypted contains APP_KEY variable, so attempting to decrypting values only."
    php "$APP_BASE_DIR/artisan" env:decrypt --env=$APP_ENV --only-values
else
    echo "🔐 Decrypting .env.$APP_ENV.encrypted file..."
    php "$APP_BASE_DIR/artisan" env:decrypt --env=$APP_ENV
fi

Congrats on V4 BTW. Awesome stuff, I love using serversideup PHP images 😄

[jaydrogers]

Thanks for your compliments! ❤️

I should definitely swing back to this and take a look for natively supporting encrypted .env files. Now that we restructured the Laravel Automations in v4, it should be much easier to expand and support new features like this.

Let me get through some other things on my plate before I swing back to this. Otherwise, you have my upvote for this feature ✅

[angus-mcritchie]

No dramas, thanks for the reply 😄 No pressure on my end, I would create a PR but it would take me a bit to understand how to contribute.

On related note, when I upgraded to the v4 image, I noticed this script didn't work when I ran like the docker-php-serversideup-s6-init as the docs outline here . But I didn't actually need it so I removed it, I'm not sure if that's expected or not.

I refined the simple script a little following the best practices from the new docs so I'll just paste it below.

I doubt you'd want to support it but I'm also using a Veil which Laravel News has a nice little write up on.

Probably outside the scope / too niche but if that was supported somehow, that would be very neat. Perhaps with a .env variable like LARAVEL_AUTORUN_ENV_DECRYPT_EXTRA_PARAMETERS as someone may want to configure Veil further.

#!/bin/sh

# Set default values if not already set
APP_ENV=${APP_ENV:-production}
APP_BASE_DIR=${APP_BASE_DIR:-/var/www/html}

# Check if the encrypted environment file exists
if [ ! -f "$APP_BASE_DIR/.env.$APP_ENV.encrypted" ]; then
    echo "🔐 $APP_BASE_DIR/.env.$APP_ENV.encrypted file not found. Skipping decryption."
    exit 0
fi

# Check if the environment file is already decrypted
if [ -f "$APP_BASE_DIR/.env.$APP_ENV" ]; then
    echo "🔐 $APP_BASE_DIR/.env.$APP_ENV file already decrypted. Skipping decryption."
    exit 0
fi

# Check if the encryption key is set
if [ -z "$LARAVEL_ENV_ENCRYPTION_KEY" ]; then
    echo "🔐 LARAVEL_ENV_ENCRYPTION_KEY not set. Skipping decryption."
    exit 0
fi

# Check if the artisan file exists
if [ ! -f "$APP_BASE_DIR/artisan" ]; then
    echo "🔐 Artisan file not found. Skipping decryption."
    exit 0
fi

# Attempt to decrypt the environment file
if grep -q "APP_KEY" "$APP_BASE_DIR/.env.$APP_ENV.encrypted"; then
    echo "ℹ️ $APP_BASE_DIR/.env.$APP_ENV.encrypted contains APP_KEY variable. Attempting to decrypt values only."
    php "$APP_BASE_DIR/artisan" env:decrypt --env="$APP_ENV" --only-values
else
    echo "🔐 Decrypting $APP_BASE_DIR/.env.$APP_ENV.encrypted file..."
    php "$APP_BASE_DIR/artisan" env:decrypt --env="$APP_ENV"
fi

exit 0