I have inherited some code that was written with PHP 5.2, and rather than installing myself, I have it running in a Docker container.
This system also depends on MySQL, so using Docker Compose and extracting the database credentials to a more secured location...
version: "3"
services:
mariadb:
image: mariadb:10.5
environment:
MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
MYSQL_USER: ${DB_USER}
MYSQL_PASSWORD: ${DB_PASSWORD}
MYSQL_DATABASE: ${DB_DATABASE}
volumes:
- ./conf/mariadb/initdb.d:/docker-entrypoint-initdb.d/:ro
ports:
- "3306:3306"
nginx:
image: nginx:alpine
depends_on:
- php-fpm
volumes:
- ${LOCAL_WORKING_DIR}:${REMOTE_WORKING_DIR}
- ./conf/nginx/nginx.conf:/etc/nginx/nginx.conf
- ./conf/nginx/conf.d/:/etc/nginx/conf.d/
# - ./conf/nginx/ssl/:/etc/nginx/ssl/
ports:
- "8080:80"
# - "8443:443"
php-fpm:
build:
context: docker/app
args:
APP_ENV: ${APP_ENV}
PHP_VERSION: ${PHP_VERSION}
REMOTE_WORKING_DIR: ${REMOTE_WORKING_DIR}
depends_on:
- mariadb
working_dir: ${REMOTE_WORKING_DIR}
volumes:
- ${LOCAL_WORKING_DIR}:${REMOTE_WORKING_DIR}
- ./conf/php/www.conf:/usr/local/etc/php-fpm.d/www.conf:ro
# - ./conf/php/xdebug.ini:/usr/local/etc/php/conf.d/xdebug.ini:ro
- ./conf/php/php-ini-overrides.ini:/usr/local/etc/php/conf.d/99-overrides.ini:ro
environment:
DB_HOST: mariadb:3306
DB_USER: ${DB_USER}
DB_PASSWORD: ${DB_PASSWORD}
DB_DATABASE: ${DB_DATABASE}
ports:
- "9000:9000"
Dockerfile
FROM devilbox/php-fpm:5.2-base
EXPOSE 9000
CMD ["php-fpm"]
Using phpinfo() shows none of those values in $_ENV or $_SERVER, and getenv() returns empty strings.
I have seen latest php-fpm related issues saying this is solved with clear_env: no, but this is only available in PHP-FPM 5.4+
I have tried to use composer to install dotenv, but that seemed to require PHP7. Same for trying to install Vault to read database credentials remotely.
What else could I try to get this code to run as-is with minimal changes?
Options I have thought:
- Start up a secondary REST server that exposes a preconfigured environment, then request to that from PHP... Seems hacky, but better than hard-coding database creds in any code, and would achieve a similar result as using Vault.
- Mount my
.envfile, then parse it out, but that requires more code changes that would be removed later anyway
