0

I'm working on a project that's using Drupal Commerce and wondering about the possible options to secure the API keys exported as configuration YAML files.

We have the config directory outside of the web root and are fairly careful overall with security, but we currently have those committed to our private Git repository - should those be removed from the repository entirely, regenerated, and added to .gitignore?

Improve this question
1
  • Use config-ignore module on those config items. You can include a file outside of webroot on the prod server that overwrites the config at runtime with the values. SSH in to create it.
    – Kevin
    Commented Jun 6, 2021 at 21:51

1 Answer 1

Reset to default
3

I use the Key module, combined with the Config Split module. You can set up the key module to use a file to store the API values. You can then use the config split module to create a conditional split on the configuration created for your production server. Put the values in the file on the production server, but do not commit that file to GIT. That way it is only on your production server, and not part of the GIT repository. For other non-production environments you can store test data in configuration rather than in a file, so that your test (sandbox) data can be committed to GIT.

Improve this answer
1
  • We're already using Config Split, so I guess we're halfway there already. I'll take a look at the Key module and try to set that up. Thanks!
    – Ambient.Impact
    Commented Jun 7, 2021 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.