@@ -240,32 +240,32 @@ Deploy Secrets to Production
240
240
Due to the fact that decryption keys should never be committed, you will need to
241
241
manually store this file somewhere and deploy it. There are 2 ways to do that:
242
242
243
- 1) Uploading the file:
243
+ #. Uploading the file
244
244
245
- The first option is to copy the **production decryption key ** -
246
- ``config/secrets/prod/prod.decrypt.private.php `` to your server.
245
+ The first option is to copy the **production decryption key ** -
246
+ ``config/secrets/prod/prod.decrypt.private.php `` to your server.
247
247
248
- 2) Using an Environment Variable
248
+ #. Using an Environment Variable
249
249
250
- The second way is to set the ``SYMFONY_DECRYPTION_SECRET `` environment variable
251
- to the base64 encoded value of the **production decryption key **. A fancy way to
252
- fetch the value of the key is:
250
+ The second way is to set the ``SYMFONY_DECRYPTION_SECRET `` environment variable
251
+ to the base64 encoded value of the **production decryption key **. A fancy way to
252
+ fetch the value of the key is:
253
253
254
- .. code-block :: terminal
254
+ .. code-block :: terminal
255
255
256
- # this command only gets the value of the key; you must also set an env var
257
- # in your system with this value (e.g. `export SYMFONY_DECRYPTION_SECRET=...`)
258
- $ php -r 'echo base64_encode(require "config/secrets/prod/prod.decrypt.private.php");'
256
+ # this command only gets the value of the key; you must also set an env var
257
+ # in your system with this value (e.g. `export SYMFONY_DECRYPTION_SECRET=...`)
258
+ $ php -r 'echo base64_encode(require "config/secrets/prod/prod.decrypt.private.php");'
259
259
260
- To improve performance (i.e. avoid decrypting secrets at runtime), you can decrypt
261
- your secrets during deployment to the "local" vault:
260
+ To improve performance (i.e. avoid decrypting secrets at runtime), you can decrypt
261
+ your secrets during deployment to the "local" vault:
262
262
263
- .. code-block :: terminal
263
+ .. code-block :: terminal
264
264
265
- $ php bin/console secrets:decrypt-to-local --force --env=prod
265
+ $ php bin/console secrets:decrypt-to-local --force --env=prod
266
266
267
- This will write all the decrypted secrets into the ``.env.prod.local `` file.
268
- After doing this, the decryption key does *not * need to remain on the server(s).
267
+ This will write all the decrypted secrets into the ``.env.prod.local `` file.
268
+ After doing this, the decryption key does *not * need to remain on the server(s).
269
269
270
270
Rotating Secrets
271
271
----------------
0 commit comments