Yii configuration and git: how to manage sensitive information securely?

user_1065145 0
Viewed 224

What is the common practice for keeping passwords and other sensitive information out of the repository when using a version control system like git for web-application done with Yii framework?

The obvious solution is to add a whole configuration file to .gitignore, but it leaves a web application boneless after all.

yii git
1 Answers
  • Split the configuration file into multiple ones
  • Set default values and no sensitive data into the configuration files that DO get included in GIT
  • Set sensitive data and custom parameters in files that get Ignored in Git

I have a setup like this for a project built with Yii 1, but could be adapted yo Yii2 basic too.

Yii 2 advanced has already the environment functionality and ignores some local config files by default and I think it should be adapted and used.

Anyways, here goes the example for Yii 1:

File list: 

protected/config/main.php
protected/config/params.php
protected/config/custom.params.php // ignored
protected/config/import.php
protected/config/db.common.php
protected/config/db.example.php
protected/config/db.php // ignored

Contents of protected/config/main.php: 

<?php

$params = require(dirname(__FILE__) . '/params.php');

if (file_exists(dirname(__FILE__) . '/custom.params.php')) {
  $params = CMap::mergeArray($params, require(dirname(__FILE__) . '/custom.params.php'));
}

$config= array(
  // ...
  'import' => require(dirname(__FILE__) . '/import.php'),
  'modules' => array(
    // ...
  ),
  // application components
  'components' => array(
    // ...
    'db' => require(dirname(__FILE__) . '/db.common.php'),
  ),
  'params' => $params,
);

return $config;

Contents of protected/config/db.common.php: 

<?php

return CMap::mergeArray(
    array(
        'emulatePrepare' => true,
        'enableProfiling' => true,
        'enableParamLogging' => true,
        'charset' => 'utf8',
        'tablePrefix' => '', 
    ),
    require(dirname(__FILE__).'/db.php') 
);

Contents of protected/config/db.example.php: 

<?php

return array(
    'connectionString' => 'mysql:host=127.0.0.1;dbname=yii_db',
    'username' => 'root',
    'password' => '',
);

How you use it:

  • After cloning your project, it will break because you have no db.php config file
  • So you copy/paste db.example.php to db.php and customize it
  • You optionally can create a custom.params.php file if you want to customize your current application params locally
  • In db.commpn.php you have defaults for the db component, and in db.php you have sensitive data
user_1150500
Related