Chapters

25 Chapters | 2:34:05 |

01

¡Bundles!

4:31
02

Nuevo Bundle, nuevo servicio: KnpTimeBundle

5:09
03

Encontrar y Utilizar los Servicios de un Bundle

6:38
04

El servicio cliente HTTP

6:23
05

El servicio de caché

8:05
06

Bundle Config (para controlar los servicios de bundle)

6:03
07

Configurar el servicio de caché

5:39
08

debug:container y cómo funciona el autowiring

7:41
09

Entornos

8:55
10

El entorno "prod"

6:06
11

Crear un servicio

5:55
12

Inyección de dependencia

9:34
13

Parámetros

6:45
14

Configuración manual del servicio en services.yaml

4:24
15

Todo sobre services.yaml

10:27
16

Vincular argumentos globalmente

3:40
17

Autoconexión con nombre y clientes HTTP con alcance

4:43
18

Servicios no autoconvocables

6:41
19

¡Los controladores también son servicios!

2:49
20

Variables de entorno

7:53
21

La Bóveda de los Secretos

5:46
22

Lectura de secretos frente a variables de entorno

6:53
23

MakerBundle y Autoconfiguración

4:27
24

Personalizar un comando

4:20
25

Comando: Autoconexión y preguntas interactivas

4:38

> Symfony 6 > Fundamentos de Symfony 6: Servicios, Configuración y Entornos

Buy Access to Course

21.

La Bóveda de los Secretos

|

|

Autoplay

Keep on Learning!

If you liked what you've learned so far, dive in! Subscribe to get
access to this tutorial plus video, code and script downloads.

Start your All-Access Pass

Buy just this tutorial for $12.00

Previous Challenge

Next Chapter

With a Subscription, click any sentence in the script to jump to that part of the video!

Login Subscribe

Login or register to check out the script

22 Comments

Sort By

Login or Register to join the conversation

ahmedbhs 13 days ago edited

@Brontie 1) do we need to git commit dev.decrypt.private.php in production, and development environment and why ?

|

Brontie ahmedbhs 13 days ago edited

No — you should not commit dev.decrypt.private.php to production for sensitive secrets. In this chapter’s setup, the dev vault is intentionally committed because it only contains shared, non-sensitive values like CHANGEME, so teammates can run the app locally and Symfony can decrypt those values automatically. The private decrypt key is safe there only because the data it unlocks is meant to be readable by everyone on the team.

For production, you keep secrets truly private and do not commit the production decrypt key. Instead, use real environment variables from the hosting platform when possible, or store prod secrets in the platform’s own secret system / vault so only the production environment can read them.

# dev: committed vault files help local development
config/secrets/dev/dev.decrypt.private.php

# prod: keep private keys out of git
config/secrets/prod/

A common gotcha: committing the dev decrypt key is only okay because the dev vault is not storing actual secrets.

| |

ahmedbhs Brontie 13 days ago edited

@Brontie so in production prod.decrypt.private.php should be stored where, and do we neet it when why try to deploy using gitlab runner and capistrano ?

|

kbond SFCASTS ahmedbhs 13 days ago edited

Take a look at https://symfony.com/doc/current/configuration/secrets.html#deploy-secrets-to-production for the recommended way. I typically use option 2 (the decrypt key as an env var).

Don't forget to run secrets:decrypt-to-local as part of your deployment process.

Hope this helps,
Kevin

1 |

Brontie ahmedbhs 13 days ago edited

prod.decrypt.private.php should not live in your Git repo. In production, it belongs only on the server that needs to decrypt the prod vault, and even then you should only use it if your deployment flow actually relies on Symfony secrets instead of real environment variables. If you're deploying with GitLab Runner + Capistrano, the usual approach is to have Capistrano put the release code on the server, install dependencies, and provide the needed env values through the server/platform rather than checking in a private decrypt key.

If your production secrets are handled by the host or injected as real environment variables, you do not need prod.decrypt.private.php at all. You only need it when the production server itself must decrypt Symfony’s config/secrets/prod/* files.

# on the production server only, if you use Symfony secrets for prod
config/secrets/prod/prod.decrypt.private.php

Common gotcha: don’t copy the dev decrypt key into prod just because it “works” locally — dev secrets are intentionally shareable, while prod secrets must stay private.

| |

ahmedbhs Brontie 13 days ago edited

the production server itself does it need to decrypt them ?@Brontie

|

Brontie ahmedbhs 13 days ago edited

Only if you’re using Symfony’s secrets vault in production. In that setup, the production app needs access to the matching prod.decrypt.private.php file on the server so Symfony can decrypt config/secrets/prod/* and expose those values as environment variables during boot.

If your deployment instead sets real environment variables on the server or platform, then the production server does not need to decrypt anything, so prod.decrypt.private.php is unnecessary.

# if using real env vars
APP_ENV=prod php bin/console cache:clear

| |

ahmedbhs Brontie 13 days ago edited

@Brontie prod.decrypt.private.php is used one to init .env.prod.local files or many times per the symfony app

|

Brontie ahmedbhs 13 days ago edited

It’s used by the Symfony app many times, not just once. When the app boots in prod, Symfony reads the prod secrets vault on demand and decrypts the needed values using prod.decrypt.private.php, so those secrets can be exposed as environment variables whenever the container is built or the app starts. It’s not an initializer for a .env.prod.local file — that file isn’t part of the secrets vault flow.

php bin/console secrets:set GITHUB_TOKEN

Tip: if you’re using real production environment variables from your host, you can skip the vault entirely and prod.decrypt.private.php never comes into play.

| |

phpbutcher 2 years ago edited

Hi all,

I've been trying to use the base64 encrypted version of my private key for the secrets vault and I must be missing something. I have encrypted the password according to the docs

php -r 'echo base64_encode(require "config/secrets/prod/prod.decrypt.private.php");'

and set that value on the server as an environment variable SYMFONY_DECRYPTION_SECRET but the app still doesn't find the variables in the vault.

Am I missing something obvious?
Thanks!

|

phpbutcher phpbutcher 2 years ago

Seems it was obvious. For anybody as thick as me that ends up with the same quandary, the SYMFONY_DECRYPTION_SECRET needs to be in the .env file and not a server environment variable.

|

MolloKhan SFCASTS phpbutcher 2 years ago edited

Hey @phpbutcher

I'd need to double-check but as far as I know, you should be able to set it as a server env var. Is it possible that you were overriding its value in the .env or .env.local file?

Cheers!

|

phpbutcher 2 years ago

So I know I must be missing something simple but I've read the docs and I either missed it or I'm just not getting it. I was under the impression that once I added a variable to the secrets vault it would be available in my controller as $_ENV['MY_SECRET_VARIABLE'] but that doesn't seem to be the case. The only references I've seen in the doc were to use them in config files with '%env(MY_SECRET_VARIABLE)%'.

I'm hoping someone can explain either what I'm missing in the docs or what I need to do to use the secret variables directly in my controllers.

Thanks for any help

|

weaverryan SFCASTS phpbutcher 2 years ago

Hey @phpbutcher!

Yea, this is a good question. The secrets become "environment variables in Symfony", but I'm pretty sure that they're not written back to $_ENV (and your experience confirms that). But to answer your question, to use a value directly in your controller, I would:

public function myAction(
    #[Autowire(env: 'MY_SECRET_VARIABLE') string $mySecretVariable
)
{
}

That should do it :). The Autowire attribute is relatively new (the env argument is even newer), but this can be used for controller args or the __construct() method in any service.

Let me know if that helps!

Cheers!

|

phpbutcher weaverryan 2 years ago edited

Thanks for the reply Ryan!

That would be an awesome suggestion except I lied a little in my OP. Some of the secret variables I am indeed trying to use in a controller that extends AbstractController but some are not. I did manage to solve my problem in those cases this morning by binding them in /config/services.yaml. I originally thought that wasn't working because I put the bind in like so ( for the future benefit of others like me) and it threw an error because it seems as soon as you put a bind variable in services.yaml it has to be used somewhere and I hadn't done that yet.

services:
    _default:
        bind:
            $myVar: '%env(MY_SECRET)%'`

And then in my LoginFormAuthenticator class:

__construct(UserProvider $userProvider, RouterInterface $router, string $myVar)

If there's a better/easier way to do it I'd love to hear it.

Thanks again Ryan! I will make use of the Autowire(env: thing in my Controllers. It makes it much more obvious to others where that value is coming from.

|

phpbutcher phpbutcher 2 years ago

Ryan,

It seems I didn't read your reply close enough. Your Autowire suggestion does work in both the Controller and LoginFormAuthenticator.

Thanks for taking the time to Respond. It makes the Symfony Casts so much more valuable.

1 |

weaverryan SFCASTS phpbutcher 2 years ago

Sweeet! Super happy it worked!

|

Rufnex 3 years ago

A tutorial on deployment might be an interesting idea :)

|

Victor SFCASTS Rufnex 3 years ago edited HIGHLIGHTED

Hey Rufnex,

We do have a tutorial about deployment already! :) Take a look at Ansistrano tool: https://symfonycasts.com/screencast/ansistrano - it's based on Ansible automation language, but you're not required to know it to start this deployment course as its syntax is pretty descriptive. Moreover we explain it during the course well I think. But in case you're interested in Ansible to learn its syntax deeper - we also have a separate tutorial about it here: https://symfonycasts.com/screencast/ansible

Cheers!

2 |

Rufnex Victor 3 years ago

Thank you Victor. I will check it out.

|

Victor SFCASTS Rufnex 3 years ago

Hey Rufnex,

You're welcome! If you have any use cases that are not covered with that Ansistrano deploy tutorial - please, let us know in the comments! It would definitely help us to plan a new deploy tutorial in the future :)

Cheers!

1 |

sadikoff Rufnex 3 years ago

Hey,

Thanks for the feedback, I'll put your idea in our list =)

Cheers!

1 |

Symfony 6.1

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": ">=8.1",
        "ext-ctype": "*",
        "ext-iconv": "*",
        "knplabs/knp-time-bundle": "^1.18", // v1.19.0
        "symfony/asset": "6.1.*", // v6.1.0-RC1
        "symfony/console": "6.1.*", // v6.1.0-RC1
        "symfony/dotenv": "6.1.*", // v6.1.0-RC1
        "symfony/flex": "^2", // v2.4.5
        "symfony/framework-bundle": "6.1.*", // v6.1.0-RC1
        "symfony/http-client": "6.1.*", // v6.1.0-RC1
        "symfony/monolog-bundle": "^3.0", // v3.8.0
        "symfony/runtime": "6.4.3", // v6.4.3
        "symfony/twig-bundle": "6.1.*", // v6.1.0-RC1
        "symfony/ux-turbo": "^2.0", // v2.1.1
        "symfony/webpack-encore-bundle": "^1.13", // v1.14.1
        "symfony/yaml": "6.1.*", // v6.1.0-RC1
        "twig/extra-bundle": "^2.12|^3.0", // v3.4.0
        "twig/twig": "^2.12|^3.0" // v3.4.0
    },
    "require-dev": {
        "symfony/debug-bundle": "6.1.*", // v6.1.0-RC1
        "symfony/maker-bundle": "^1.41", // v1.42.0
        "symfony/stopwatch": "6.1.*", // v6.1.0-RC1
        "symfony/web-profiler-bundle": "6.1.*" // v6.1.0-RC1
    }
}

Previous Challenge

Next Chapter