[Feature Request] Natively support secrets managed via fnox (instead of .env)

[dakira]

Background

In times of frequent supply chain attacks, enterprises deploy several risk mitigation tactics to prevent harm from the risks that come with supply chain attacks. On the one hand there are many tactics to prevent the attacks themselves, on the other hand there are tactics that mitigate the harm done by successful attacks.

Solution

One of those is not storing plaintext secrets in you filesystem at all, but instead keeping them in trusted keychains and exposing them to you app environment on demand. A popular choice for that is fnox (by the same developer as mise-en-place).

fnox allows for several backends (locally encrypted/git, aws, azure, bitwarden, ...) and works similar to mise or nvm. As soon as you cd into a project directory, the environment variables are loaded. Alternatively you can you server with fnox exec -- php artisan serve to run the local server with all env secrets.

How to do it in Herd?

Of course all of that doesn't work with sites served via Herd out of the box, because the fnox secrets aren't injected into the envionment of sites served via Herd.

So it would be nice if Herd could check if a fnox.toml exists and inject its environment variables into the nginx process that servers the project (regardless of the driver).

I assume a workaround could be to write a custom Herd driver, right?