I am using Drupal 8 and drush cex to commit my configuration to my repository.

However, I want to keep passwords and API keys out of the repository. How do I do that? (selectively exclude sensitive information from configuration management).

For example, I'm using the SMTP module, but I noticed that in addition to the SMTP server and sender's name, etc., it also exports the API key to code, which should not be exposed. I want to manage module configuration with configuration management, but I don't want to commit the key.

  • I don't know about excluding config(I haven' looked into it yet) but you can store such data as state(former variables) which is unique to the site. – user21641 Feb 17 '16 at 8:29
  • I'm using Pantheon hosting and they have an interesting way of achieving this using PHP's $_ENV superglobal: pantheon.io/docs/articles/sites/code/… – stevepurkiss Feb 17 '16 at 10:20

You can't exclude specific keys easily from being exported.

However, you simply can not store the real keys there in the first place, and rely on local overrides through settings.php only, e.g.

$config['yourmodule.settings']['smtp']['api_key'] = '24ztsgfet';

And in the UI, you just store "dummy" or any other string. Note that there's currently no indication that a value is overridden in the backend, it will however display only the value that's actually stored in config, not overrides.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.