Bug 41774 - Add ability to read encryption key from environment variable
Summary: Add ability to read encryption key from environment variable
Status: Failed QA
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Kyle M Hall (khall)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-02-04 19:49 UTC by Kyle M Hall (khall)
Modified: 2026-02-05 05:21 UTC (History)
1 user (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 41774: Add ability to read encryption key from environment variable (5.36 KB, patch)
2026-02-04 19:59 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall (khall) 2026-02-04 19:49:10 UTC
From a security standpoint it would be useful to be able to store Koha's encryption key in an environment variable. This is particularly useful in containerized environments, but is not limited to that use case.
Comment 1 Kyle M Hall (khall) 2026-02-04 19:59:17 UTC
Created attachment 192496 [details] [review]
Bug 41774: Add ability to read encryption key from environment variable

From a security standpoint it would be useful to be able to store Koha's encryption key in an environment variable. This is particularly useful in containerized environments, but is not limited to that use case.

Test plan:
1) Apply this patch
2) Remove or comment out the encryption key in koha-conf.xml
3) Restart plack
4) Browse to the "System information" tab of the about page
5) Note the missing encryption_key warning on the page
6) restart plack again, inject the encryption key as an environment variable:
   sudo KOHA_ENCRYPTION_KEY=t0P_secret koha-plack --restart kohadev
7) Reload the about page
8) Note the warning is gone!
Comment 2 David Cook 2026-02-05 05:21:54 UTC
I'm going to have to disagree with you on this one. From a security standpoint, you don't want to put sensitive data like an encryption key in an environmental variable. 

You'd want to put the encryption key in a file and then the environmental variable could point to the location of that file. 

With a containerized environment like Docker, you can either do a bind mount yourself, or you can use secrets which does some of that for you: https://docs.docker.com/compose/how-tos/use-secrets/