Remove the parameters.yml file from the skeleton

[leofeyer]

Implements #6070

[aschempp]

This would remove the defaut kernel secret, are you sure this still allows the application to boot and generate the auto secret etc.?

[ausi]

This would remove the defaut kernel secret

The secret from the parameters.yaml is not used anywhere, it does not define the kernel.secret parameter. (AFAIK)

[fritzmg]

The secret from the parameters.yaml is not used anywhere, it does not define the kernel.secret parameter. (AFAIK)

It is still used. If you do not define APP_SECRET, then the secret parameter is used as a fallback:

contao/manager-bundle/src/ContaoManager/Plugin.php

Lines 208 to 210 in 74c56f0

	if (!isset($_SERVER['APP_SECRET'])) {
	$container->setParameter('env(APP_SECRET)', $container->getParameter('secret'));
	}

Same goes for the database credentials. If you do not use DATABASE_URL, then the database_* parameters are used as a fallback.

[ausi]

The secret from the parameters.yaml is not used anywhere

I was wrong it seems. I thought I searched for all getParameter('secret') 🙈

[leofeyer]

We can probably replace secret with kernel.secret in line 209?

The database_* parameters are fine IMHO, because we still want to support them in case someone has a parameters.yml file in their app.

[ausi]

The database_* parameters are fine IMHO, because we still want to support them in case someone has a parameters.yml file in their app.

But we probably need to adjust the Plugin code to check for hasParameter('database_…') so that it does not fail without the defaults from the parameters.yaml

[fritzmg]

We can probably replace secret with kernel.secret in line 209?

That won't work since that's just %env(APP_SECRET)%. That's why we set

$container->setParameter('env(APP_SECRET)', $container->getParameter('secret'));

in order to have a fallback to the secret parameter.

[fritzmg]

While we could introduce hasParameter everywhere and thus implement the skeleton in PHP, we might as well just leave the parameters skeleton may be (and only remove it in Contao 6, where we will drop support for these parameters altogether).

[ausi]

While we could introduce hasParameter everywhere and thus implement the skeleton in PHP, we might as well just leave the parameters skeleton may be

I’d prefer the hasParameter() checks as I find it very confusing that I have a paramter %secret% in all my projects that always has the value ThisTokenIsNotSoSecretChangeIt, even though my %kernel.secret% is set correctly. This is actually how I noticed that these obsolete parameters are still there.

[leofeyer]

That won't work since that's just %env(APP_SECRET)%.

I see. Then maybe we should indeed leave everything as is and discuss this again for Contao 6.