Secrets Management Setup

Hey Mattias,

Using the bind key is just for convenience when a parameter will be used in many places.
I wouldn't inject the ParameterBag, I'd only inject the parameter that I need:

parameters:
    basepath: '%env(basepath)%'

services:
    App\SomeService:
        arguments:
            $basePath: '%env(basepath)%'

Cheers!

Oh, but I use my parameters in normal controllers, not in services.

Is my way the correct way of doing it then? Since all of my controllers aren't defined as services at all.

Are you sure your controllers are not services? That's the default since Symfony 4.4, if you can inject services into your controller's arguments, then they are defined as services. I don't usually inject parameters into my controllers, what I usually do is inject the parameter directly into the service that's going to use it. But, if for some reason you're going to use it in a controller, then you can do precisely what you did or just add a new bind key

Cheers!

Hey picks!

Ah, circular reference!

... runs away

Let's... see if we can figure this out ;). It looks like, somehow, you have a parameter that is referencing itself. If you follow the error message, it looks like eventually Symfony sees that the SYMFONY_DECRYPTION_SECRET environment variable is set to env(base64:default::SYMFONY_DECRYPTION_SECRET)"), which then causes a loop.

Can you post the contents of all of the relevant files? Like .env, .env.local, services.yaml (if you have anything relevant there)?

Cheers!

Sure!
My .env file has:

APP_ENV=dev
APP_SECRET=03cbf876e68a6826b4009ef99b30acd9
GOOGLE_ANALYTICS_TRACKING_ID=null
HTTP_PROTOCOL=https
SITE_BASE_SCHEME=$HTTP_PROTOCOL
SITE_BASE_HOST=desmdc.local
SITE_BASE_URL=$SITE_BASE_SCHEME://$SITE_BASE_HOST
CORS_ALLOW_ORIGIN=^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$

I don't use a .env.local for now as I don't need to override anything

And in my services.yml I have many declarations of env parameters (which some are supposed to be stored in the secret vault) like :

parameters:
    asset.request_context.base_path: '%env(SITE_BASE_URL)%'
    asset.request_context.secure: true
    router.request_context.host: '%env(SITE_BASE_HOST)%'
    router.request_context.scheme: '%env(SITE_BASE_SCHEME)%'
App\Service\Geocoder:
    arguments:
        $mapQuestApiKey: '%env(GEOCODING_API_KEY)%'
        $env: '%env(APP_ENV)%'
App\Service\MyDesoutterCloud:
    arguments:
        $iwidApiBaseUri: '%app.iwid_api_base_uri%'
        $iwidApiAdminEmail: '%env(IWID_API_EMAIL)%'
        $iwidApiAdminPassword: '%env(IWID_API_PWD)%'
        $env: '%env(string:APP_ENV)%'
        $cache: '@mdc.cache'

Hello, any news on this subject? I am facing the same problem (<b>php 7.3.5</b>).

I was able to add a first variable in <b>PROD</b>, but when I wanted to edit it, I got the same error.

I also do not have the environment variable "SYMFONY_DECRYPTION_SECRET", I did not manage to generate it. When I tried the command : php -r 'echo base64_encode(require "config/secrets/prod/prod.decrypt.private.php");' :

I got this error
Parse error: syntax error, unexpected 'private' (T_PRIVATE) in Command line code on line 1

Hi Kiuega this has been fixed and merged into SF3.4 apparently => https://github.com/symfony/...

Hey ! (ami Français), On SF 4 and 5, there seems to be nothing. No update available for recipes, it's strange.
On the other hand, did you end up succeeding in generating the environment variable SYMFONY_DECRYPTION_SECRET ?

EDIT : Nicolas Grekas said that it was OK, and that we will just have to wait for the 5.1.3 release

Just saw that yes Kiuega ;) Thanks! In the meantime I could make it work by hardcoding SYMFONY_DECRYPTION_SECRET in my .env prod file with its encoded value...

Good work around! The Pr has been merged, but not tagged yet. I would expect a tag fairly soon, as the last one was 3 weeks ago.

Cheers!

Hey picks!

Hmm. I don't see SYMFONY_DECRYPTION_SECRET anywhere in these files? Where/how are you setting this?

To give you a bit more context, the default value of the "decryption environment value" is base64:default::SYMFONY_DECRYPTION_SECRET. What I mean is, when Symfony tries to decrypt your fault, it looks for this SYMFONY_DECRYPTION_SECRET environment variable , then "base64 decodes" it. It almost looks like the SYMFONY_DECRYPTION_SECRET value is set to itself SYMFONY_DECRYPTION_SECRET... or something similar.

Cheers!

I have no idea, I don't remember setting this value anywhere in my project!
I this something that needs to be done?

Hey picks

Yes, you whether set that env variable up or you ensure that the file config/secrets/prod/prod.decrypt.private.php exists in your project. If that's not the case, double check your env vars and parameters to see if something is trying to use the SYMFONY_DECRYPTION_SECRET env var.

Cheers!

Hi MolloKhan,
If I do a project search for "SYMFONY_DECRYPTION_SECRET" within PhpStorm, it only find references in the cache...
This env is not set anywhere in my project, and I have generated a config/secrets/prod/prod.decrypt.private.php (that's how I managed to generate the first secret, but not the second...). This is weird, really.

So even weirder, if I manually set a SYMFONY_DECRYPTION_SECRET env var within my .env.prod.local file, it now works!!! But I still have my config/secrets/prod/prod.decrypt.private.php...
I'm lost.

That's weird :)
What Symfony version do you have?

MolloKhan I was using a solid 4.4 version at the start of the project, then I upgraded it to 5.0 and 5.1... Maybe it is missing a package or something?

I have the same problem with a second project now! I downloaded a fresh copy of SF5.1 and installed the latest packages I needed, adapted and copied the "old" files(aseets, src, templates, config...), and it did the exact same : first prod secret is generated, second one raises the issue. Unless I add the SYMFONY_DECRYPTION_SECRET env var in my .env.prod.local file... This is insane.

Hey picks!

Yea, this sounds SUPER weird, so I'm checking into it further. So far, I can't repeat the error - I must be missing something that you have. Here's what I've tried so far:

1) I started a new project, and tried to create 2 secrets:

symfony new prod_decrypt_bug
cd prod_decrypt_bug
./bin/console secrets:set --env=prod SECRET1
./bin/console secrets:set --env=prod SECRET2

Both secrets were created without any problems.

2) I downloaded the course code from this page, unzipped it, and moved into the "finish" directory. Then I:

composer install
# I deleted the prod vault so that I could start from scratch
rm -rf  config/secrets/prod
./bin/console secrets:set --env=prod MAILER_DSN
./bin/console secrets:set --env=prod MAILER_DSN2

Again, this had no problems.

Am I doing something different than you are? I assumed that you're getting the error right when you call secrets:set for the 2nd secret, is that correct? Or do you get the error at some other point?

Let me know!

Cheers!

weaverryan yes that's correct, that's only occuring for the 2nd secret... I'll try to set a blanck copy like you did to see if has something to do with my local dev environment... and let you know! Thanks as always.

Awesome! Let me know what you find out! It definitely sounds "fishy", but I can't repeat it :/

weaverryan the issue has been raised at SF, it seems like it is indeed a bug ==> https://github.com/symfony/...

Hey picks!

Great! I mean, not great having a bug... of course :). But at least we know others have the issue and there will be an effort to fix it. I just "pushed" on that PR to try to keep it moving. It's interesting that, on that issue, some people are able to repeat and others cannot. What version of PHP are you on? If we could identify the reason why it happens on some machines but not others, that could help a lot. I tried on PHP 7.4 (and did not get the bug).

Cheers!

weaverryan I am the one saying he his using PHP 7.2 ;)

Come on picks! Where is your brand consistency? :p Ok, when I hover over picks44, I can see VinZ :D

Btw, I see you're from Nantes! We visited there years ago - after the last SymfonyCon in Paris - lovely place - saw the machines de l'île of course ;)

weaverryan haha yes, cool! You should consider participating to the "web2day" event, it is quite big now, and there are lots of conferences dedicated to tech ;) could be awesome.
PS: I registered on Disqu's using FB login, that's why!

Hey TomaszGasior

Yep you are totally right, you can use dd() for it, since Symfony 4.1.

Cheers!