Vault
Overview
HashiCorp Vault is used for secrets management in production. Sensitive credentials (database passwords, API keys, encryption keys) are stored in Vault instead of .env files or hardcoded config.
Usage
Local Development
In development, secrets are stored in .env files as usual. Vault is only required for production and CI environments.
Production
Vault provides secrets via its HTTP API. The application reads secrets at boot time through Laravel's configuration system.
php
// config/services.php (example pattern)
'imagekit' => [
'public_key' => env('IMAGEKIT_PUBLIC_KEY'),
'private_key' => env('IMAGEKIT_PRIVATE_KEY'),
'url_endpoint' => env('IMAGEKIT_URL_ENDPOINT'),
],In production, these env() calls are resolved from Vault-injected environment variables rather than .env.
Secret Structure
secret/sutomo/production/
├── app_key
├── db_password
├── redis_password
├── imagekit_public_key
├── imagekit_private_key
└── ...Deployment Integration
During ECS deployment, the CI/CD pipeline:
- Authenticates to Vault using an IAM role
- Reads required secrets
- Injects them as environment variables to the ECS task definition
- The application reads them via
env()at boot
Key Files
| File | Purpose |
|---|---|
config/ | Laravel config files that call env() |
.github/workflows/deploy.yml | CI/CD pipeline with Vault authentication |
| ECS Task Definition | Environment variable injection from Vault |