Storing private information in the file system

Storing private information in the file system

To place this directory:

1. Sign in to your infrastructure using SSH.

2. Create the following directory:

   copy

   /mnt/gfs/[sitename].[env]/nobackup

3. Create any required subdirectories in the nobackup directory for organizing your files, such as the following:

   • /mnt/gfs/mysite.dev/nobackup/apikeys
   • /mnt/gfs/mysite.test/nobackup/apikeys
   • /mnt/gfs/mysite.prod/nobackup/apikeys

   Because the system does not copy the nobackup directory between environments, you must create and populate the nobackup directory and its credential files separately on each environment.

You can now use the nobackup directory and any of its subdirectories to store your private files.

Retrieving sensitive keys

If you are storing required credentials in the nobackup directory, you can use Acquia-provided environmental variables to retrieve those credentials for your application. To enable this functionality:

1. In your nobackup directory or one of its subdirectories, create a PHP file. The PHP file can have any name, including the following example:

   copy

   /mnt/gfs/$AH_SITE_GROUP.$AH_SITE_ENVIRONMENT/nobackup/apikeys/mysite_apikeys.php

2. Edit the PHP file and add one or more environmental variables, similar to the following:

   copy

   putenv('MY_API_KEY_NAME=[key_value]');

3. Save the PHP file.

4. Edit your application's settings.php file and add code similar to the following to dynamically build the path to the credentials file and include it:

   copy

   $env = $_ENV['AH_SITE_ENVIRONMENT'];
   $site_group = $_ENV['AH_SITE_GROUP'];
   $key_file = "/mnt/gfs/{$site_group}.{$env}/nobackup/apikeys/mysite_apikeys.php";
   if (file_exists($key_file)) {
     require $key_file;
   }

5. Create settings variables for Drupal's use by adding the following lines to your settings.php file:

   Drupal version	Code
   Drupal 7	copy $conf['mysite_apiname'] = getenv('SOME_API_KEY_NAME'); $conf['mysite_apikey'] = getenv('SOME_API_KEY');
   Current Drupal version	copy $settings['mysite_apiname'] = getenv('SOME_API_KEY_NAME'); $settings['mysite_apikey'] = getenv('SOME_API_KEY');

6. Save the settings.php file.

Best practice for environment-specific credential file naming

As a belt-and-braces approach, consider naming your credential files with an environment suffix. This ensures that each environment loads only its own credentials even in the unlikely event that files are synchronized between environments.

Recommended naming conventions:

• apikeys.prod
• apikeys.dev
• searchstax.prod.json
• searchstax.dev.json

The full path pattern using environment variables is:

/mnt/gfs/$AH_SITE_GROUP.$AH_SITE_ENVIRONMENT/nobackup/apikeys.$AH_SITE_ENVIRONMENT

Add the following code to your settings.php to dynamically load the correct credential file for the current environment:

$env = $_ENV['AH_SITE_ENVIRONMENT'];
$site_group = $_ENV['AH_SITE_GROUP'];
$key_file = "/mnt/gfs/{$site_group}.{$env}/nobackup/apikeys.{$env}";
if (file_exists($key_file)) {
  require $key_file;
}

The AH_SITE_ENVIRONMENT environment variable contains the current environment name, such as prod, dev, or test. For On-Demand Environments (ODEs), this value displays as ode1 or ode2. Therefore, each ODE searches for its own uniquely named credential file.

For documentation on the AH_SITE_GROUP and AH_SITE_ENVIRONMENT environment variables, refer to Using environment variables Using environment variables.

To place this directory:

1. Sign in to your infrastructure using SSH.

2. Create the following directory:

   copy

   /mnt/gfs/[sitename].[env]/nobackup

3. Create any required subdirectories in the nobackup directory for organizing your files, such as the following:

   • /mnt/gfs/mysite.dev/nobackup/apikeys
   • /mnt/gfs/mysite.test/nobackup/apikeys
   • /mnt/gfs/mysite.prod/nobackup/apikeys

   Because the system does not copy the nobackup directory between environments, you must create and populate the nobackup directory and its credential files separately on each environment.

You can now use the nobackup directory and any of its subdirectories to store your private files.

Retrieving sensitive keys

If you are storing required credentials in the nobackup directory, you can use Acquia-provided environmental variables to retrieve those credentials for your application. To enable this functionality:

1. In your nobackup directory or one of its subdirectories, create a PHP file. The PHP file can have any name, including the following example:

   copy

   /mnt/gfs/$AH_SITE_GROUP.$AH_SITE_ENVIRONMENT/nobackup/apikeys/mysite_apikeys.php

2. Edit the PHP file and add one or more environmental variables, similar to the following:

   copy

   putenv('MY_API_KEY_NAME=[key_value]');

3. Save the PHP file.

4. Edit your application's settings.php file and add code similar to the following to dynamically build the path to the credentials file and include it:

   copy

   $env = $_ENV['AH_SITE_ENVIRONMENT'];
   $site_group = $_ENV['AH_SITE_GROUP'];
   $key_file = "/mnt/gfs/{$site_group}.{$env}/nobackup/apikeys/mysite_apikeys.php";
   if (file_exists($key_file)) {
     require $key_file;
   }

5. Create settings variables for Drupal's use by adding the following lines to your settings.php file:

   Drupal version	Code
   Drupal 7	copy $conf['mysite_apiname'] = getenv('SOME_API_KEY_NAME'); $conf['mysite_apikey'] = getenv('SOME_API_KEY');
   Current Drupal version	copy $settings['mysite_apiname'] = getenv('SOME_API_KEY_NAME'); $settings['mysite_apikey'] = getenv('SOME_API_KEY');

6. Save the settings.php file.

Best practice for environment-specific credential file naming

As a belt-and-braces approach, consider naming your credential files with an environment suffix. This ensures that each environment loads only its own credentials even in the unlikely event that files are synchronized between environments.

Recommended naming conventions:

• apikeys.prod
• apikeys.dev
• searchstax.prod.json
• searchstax.dev.json

The full path pattern using environment variables is:

/mnt/gfs/$AH_SITE_GROUP.$AH_SITE_ENVIRONMENT/nobackup/apikeys.$AH_SITE_ENVIRONMENT

Add the following code to your settings.php to dynamically load the correct credential file for the current environment:

$env = $_ENV['AH_SITE_ENVIRONMENT'];
$site_group = $_ENV['AH_SITE_GROUP'];
$key_file = "/mnt/gfs/{$site_group}.{$env}/nobackup/apikeys.{$env}";
if (file_exists($key_file)) {
  require $key_file;
}

The AH_SITE_ENVIRONMENT environment variable contains the current environment name, such as prod, dev, or test. For On-Demand Environments (ODEs), this value displays as ode1 or ode2. Therefore, each ODE searches for its own uniquely named credential file.

For documentation on the AH_SITE_GROUP and AH_SITE_ENVIRONMENT environment variables, refer to Using environment variables Using environment variables.