# Local vs Remote Settings

**URL:** <https://discourse.slimframework.com/t/local-vs-remote-settings/1054>\
**Category:** Questions\
**Created:** [January 5, 2017, 11:35pm UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054 "2017-01-05T23:35:01Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![bionary](https://avatars.discourse-cdn.com/v4/letter/b/9de053/32.png) [@bionary](https://discourse.slimframework.com/u/bionary)\
**Post date:** [January 5, 2017, 11:35pm UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/1 "2017-01-05T23:35:02Z")

</div>

Hey all,

Just wondering what’s the Slim way of managing settings local vs remote. id: db credentials, etc. I like most (i think) develop everything locally and then push code to remote server (occasionally ftp but ideally with version control )

In the past I used to grab the url and sniff out the environment that way. So I would have a settings file with 2 sets of credentials. **What do you slim guys & gals do?**

---

<div class="post-metadata">

**Author:** ![tflight](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/tflight/32/1205_2.png) [@tflight](https://discourse.slimframework.com/u/tflight)\
**Post date:** [January 6, 2017, 2:29am UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/2 "2017-01-06T02:29:46Z")

</div>

I have a settings.php file that is not under version control. The values vary by environment (production, staging, development, local, etc). I manually edit them as needed, but the only values in each one are the ones valid for that environment.

---

<div class="post-metadata">

**Author:** ![bionary](https://avatars.discourse-cdn.com/v4/letter/b/9de053/32.png) [@bionary](https://discourse.slimframework.com/u/bionary)\
**Post date:** [January 6, 2017, 3:55am UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/3 "2017-01-06T03:55:04Z")

</div>

Yes, I suppose that’s a good way to do it.

---

<div class="post-metadata">

**Author:** ![akrabat](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/akrabat/32/9_2.png) [@akrabat](https://discourse.slimframework.com/u/akrabat)\
**Post date:** [January 7, 2017, 5:59pm UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/4 "2017-01-07T17:59:16Z")

</div>

I wrote up my thoughts here: [https://akrabat.com/configuration-in-slim-framework/](https://akrabat.com/configuration-in-slim-framework/)

---

<div class="post-metadata">

**Author:** ![bionary](https://avatars.discourse-cdn.com/v4/letter/b/9de053/32.png) [@bionary](https://discourse.slimframework.com/u/bionary)\
**Post date:** [January 7, 2017, 10:49pm UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/5 "2017-01-07T22:49:40Z")

</div>

Interesting Rob, I had never heard of dotenv [https://packagist.org/packages/vlucas/phpdotenv](https://packagist.org/packages/vlucas/phpdotenv) before but after reading through your post and about dotenv it does make sense. Maybe I’m wrong but I think having the configs as a hidden file ( .env) is safer?

---

<div class="post-metadata">

**Author:** ![akrabat](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/akrabat/32/9_2.png) [@akrabat](https://discourse.slimframework.com/u/akrabat)\
**Post date:** [January 8, 2017, 8:37am UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/6 "2017-01-08T08:37:50Z")

</div>

A .env file is not safer at all.

.env is interesting as in production/staging you use proper environment variables (or have them given to you if it’s a cloud provider) and the .env file for local dev.

---

<div class="post-metadata">

**Author:** ![tflight](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/tflight/32/1205_2.png) [@tflight](https://discourse.slimframework.com/u/tflight)\
**Post date:** [January 8, 2017, 12:47pm UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/7 "2017-01-08T12:47:24Z")

</div>

There is also a case for **not** using environment variables to store configuration, particularly when it comes to anything sensitive. See [How to keep a secret](https://blog.fortrabbit.com/how-to-keep-a-secret) for that point of view. Their point hinges around:

> Environment variables in PHP are _possibly_ exposed to public

(Emphasis mine.) This can be avoided, but **can** also become a simple mistake with big consequences.

---

<div class="post-metadata">

**Author:** ![bionary](https://avatars.discourse-cdn.com/v4/letter/b/9de053/32.png) [@bionary](https://discourse.slimframework.com/u/bionary)\
**Post date:** [January 8, 2017, 1:03pm UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/8 "2017-01-08T13:03:36Z")

</div>

So… does .env makes it easier to track the environmental configs rather than monkey around with fragmented settings all over the place… i.e.: http conf vhosts htaccess php.ini etc. does this .env allow you to have all that stuff in there instead? Otherwise I’m not quite sure what’s the point.

---

<div class="post-metadata">

**Author:** ![diegoluisr](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/diegoluisr/32/244_2.png) [@diegoluisr](https://discourse.slimframework.com/u/diegoluisr)\
**Post date:** [January 9, 2017, 6:43pm UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/9 "2017-01-09T18:43:19Z")

</div>

Others frameworks uses “Environment Variables” and I think that is a good solution.  
You have a similar problem like [this](http://discourse.slimframework.com/t/site-settings-using-them-throughout-app/1044)

---

<div class="post-metadata">

**Author:** ![bionary](https://avatars.discourse-cdn.com/v4/letter/b/9de053/32.png) [@bionary](https://discourse.slimframework.com/u/bionary)\
**Post date:** [January 9, 2017, 9:57pm UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/10 "2017-01-09T21:57:47Z")

</div>

An okay discussion that left my head spinning although they seem to be talking more about global settings like siteName, etc… I was wondering about config stuff like db passwords, etc.

I honestly can’t understand why putting settings in code (i.e.: settings.php) is any more dangerous then using an .env file (some seem to believe so ) If your site gets hacked, it’s hacked and the hackers have access to all your files regardless.

---

<div class="post-metadata">

**Author:** ![tflight](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/tflight/32/1205_2.png) [@tflight](https://discourse.slimframework.com/u/tflight)\
**Post date:** [January 10, 2017, 12:58pm UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/11 "2017-01-10T12:58:37Z")

</div>

> [@bionary](#):
>
> If your site gets hacked, it’s hacked and the hackers have access to all your files regardless.

That isn’t **necessarily** true. There are numerous types of vulnerabilities which have different levels of exposure. But I wholeheartedly agree that if your site is compromised you should _treat_ the situation as though everything was accessed.

I personally dislike using environment variables, partially because I use PAAS type hosting which _could_ increase the risk of exposure.

But for the type of settings you are talking about I put them in a settings.php file which returns an array. Should I make any changes that require a change to that settings file I manually update each environment since it is outside of version control.

---

<div class="post-metadata">

**Author:** ![bionary](https://avatars.discourse-cdn.com/v4/letter/b/9de053/32.png) [@bionary](https://discourse.slimframework.com/u/bionary)\
**Post date:** [January 11, 2017, 1:27am UTC](https://discourse.slimframework.com/t/local-vs-remote-settings/1054/12 "2017-01-11T01:27:40Z")

</div>

Seems simple, yet reasonable (as per usual with your advice ) Thanks for taking the time to explain. I always look forward to our discussions.