php-nginx-systemd-doppler.md

PHP, NGINX, and Systemd with Doppler

NOTE: This is now outdated. See the Doppler PHP examples repository instead.

Created: 26 October 2020

Author: Ryan Blunden ([email protected])

OS: Ubuntu 20.04

PHP: 7.4

NOTE: You can find other approaches to providing environment variables for PHP applications in our dedicated PHP examples repository that save you from having to mess with process managers such as Systemd.

Overview

This document demonstrates how to configure a PHP application with environment variables from Doppler running under NGINX. It presumes only one PHP application and one Doppler configuration will be used for the machine.

NOTE: All commands in this document require root access and so are run as the root user

1. Install dependencies

apt update
apt install -y nginx php-fpm
add-apt-repository universe
(curl -Ls https://cli.doppler.com/install.sh || wget -qO- https://cli.doppler.com/install.sh) | sh
systemctl start nginx php7.4-fpm.service

2. Configure Doppler

Configure Doppler using a service token:

mkdir /var/doppler # acts as home when doppler is executed by systemd
HOME=/var/doppler doppler configure set token dp.st.XXX --scope=/
HOME=/var/doppler doppler configs # validate service token

3. NGINX

1. Create a new NGINX configuration such as below, which is the most basic site configuration required to test everything works. It should be created an /etc/nginx/sites-available/doppler-test:

server {
        listen 80;
        root /var/www/html;
        index index.php index.html index.htm index.nginx-debian.html;
        server_name my-app-hostname;

        location / {
                try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        }

        location ~ /\.ht {
                deny all;
        }
}

2. Disable the current default site: unlink /etc/nginx/sites-enabled/default
3. Enable the new site: ln -s /etc/nginx/sites-available/doppler-test /etc/nginx/sites-enabled/doppler-test
4. Run nginx -t to confirm there are no configuration issues
5. Create a PHP file at /var/www/html/env.php with the contents <pre><?php print_r($_SERVER); ?></pre>
6. Restart NGINX for the changes to take effect: systemctl restart nginx
7. Open a browser and attempt to view the output of the env.php page, e.g. http://aws-server/env.php

4. PHP

Now that NGINX is working with PHP, let's now alter the php-fpm service to use Doppler:

1. Edit /etc/php/7.4/fpm/pool.d/www.conf, removing the leading semi=color from ;clear_env=no
2. Run systemctl edit php7.4-fpm.service --full:

• Change ExecStart to start with /usr/bin/doppler run --: ExecStart=/usr/bin/doppler run -- /usr/sbin/php-fpm7.4 ...
• Under [Service] add Environment=HOME=/var/doppler

3. Apply change with systemctl daemon-reload && systemctl restart nginx php7.4-fpm.service

You may experience the process hanging, in this case, just send a SIGINT using CTRL+C to detach. This is a known issue and we are working on a fix, but is not a blocker for getting this working.

Now go back to your browser to refresh the env.php page and you should now see new environment variables from Doppler. If you get a 500 error, trying running systemctl daemon-reload && systemctl restart nginx php7.4-fpm.service again and retry.

NOTE: Currently, the PHP service will need to be manually restarted in order to fetch the latest secrets from Doppler and update the environment variables. You could work around this by specifying that the PHP service should restart ever n-seconds with editing the service by again running /etc/php/7.4/fpm/pool.d/www.conf, and adding the following under [Service]:

Restart=always
RuntimeMaxSec=3600

Troubleshooting

To check NGINX is configured correctly: run nginx -t

If the php service fails to start: Run systemctl status php7.4-fpm.service to view the error logs. If the service is unable to start and the service config is correct, it’s most likely caused by an incorrect Doppler service token. You can test the validity of the token by running: HOME=/var/doppler doppler configs

This is great! Small request: can we add here what the result should be?
Change ExecStart to start with /usr/bin/doppler run -- -> Change ExecStart to start with /usr/bin/doppler run --: /usr/bin/doppler run -- ExecStart

Thanks for the suggestion. I've updated the example to add:ExecStart=/usr/bin/doppler run -- /usr/sbin/php-fpm7.4 ...

@ryan-blunden hi!

On one of the servers (staging), I don't use containerization, so I did everything according to these instructions. Doppler runs and runs PHP-FPM (8.0), but even though the token check was successful, the Doppler variables are still not available to me (everything is fine in the dev environment at that). Any tips on what to do?

P.S. The developers stumbled, asked for help, and I have a suspicion that the problem is not on our side.