How to store credentials in sql configuration file as environment variables - mysql

Question

I've got an SQL configuration file that's something like this:
[client]
database = dev
host = my-host.com
user = dev
password = super-secret-password
default-character-set = utf8
Is there any way I can swap out the plaintext host and password with some sort of environment variable, so I don't have to push it to GitHub directly? To deploy, I've been pushing to GitHub, making a docker image of the code pushed, pulling it onto an AWS server, and running it.
I'd rather not push the plaintext config file directly so I was wondering how to get around this.

Answer 1

You can use Github Secret to store sensitive data for your projects .
Read more about it from here ; Creating encrypted secrets for a repository
Create Env Variable using Github Action:
steps:
- name: Execute script
env:
PASSWORD: ${{ secrets.SCRIPT_CREDENTIALS }}
run: # your script to connect the database here .
for example to use a PHP script you can follow this method :
<?php
$servername = "localhost";
$username = "username";
$password = getenv("PASSWORD");
$conn = new mysqli($servername, $username, $password);
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
echo "Connected successfully";
?>
To make a change on a .cfg file you can also use githubaction like that :
steps:
- name: Edit your config file
env:
PASSWORD: ${{ secrets.SCRIPT_CREDENTIALS }}
run: echo "password = ${{ secrets.SCRIPT_CREDENTIALS }}" >> file.cfg

Answer 2

Update on this for anyone using Django and having a similar issue, I was able to figure it out like this.
Before, my database connection file was set up like this:
DATABASES = {
"default": {
"ENGINE": "django.db.backends.mysql",
"OPTIONS": {
"read_default_file": "local.cnf",
},
}
}
rather than doing this, it's easier to do something like:
DATABASES = {
"default": {
"ENGINE": "django.db.backends.mysql",
'NAME': 'dev',
'USER': 'dev',
'PASSWORD': os.environ['DEV_PASS'],
'HOST': os.environ['DEV_HOST']
}
}
so then you can specify your environment variables as usual.