From a security standpoint it would be useful to be able to store Koha's encryption key in an environment variable. This is particularly useful in containerized environments, but is not limited to that use case.
Created attachment 192496 [details] [review] Bug 41774: Add ability to read encryption key from environment variable From a security standpoint it would be useful to be able to store Koha's encryption key in an environment variable. This is particularly useful in containerized environments, but is not limited to that use case. Test plan: 1) Apply this patch 2) Remove or comment out the encryption key in koha-conf.xml 3) Restart plack 4) Browse to the "System information" tab of the about page 5) Note the missing encryption_key warning on the page 6) restart plack again, inject the encryption key as an environment variable: sudo KOHA_ENCRYPTION_KEY=t0P_secret koha-plack --restart kohadev 7) Reload the about page 8) Note the warning is gone!
I'm going to have to disagree with you on this one. From a security standpoint, you don't want to put sensitive data like an encryption key in an environmental variable. You'd want to put the encryption key in a file and then the environmental variable could point to the location of that file. With a containerized environment like Docker, you can either do a bind mount yourself, or you can use secrets which does some of that for you: https://docs.docker.com/compose/how-tos/use-secrets/