Laravel Way
Laravel uses .env.php files to solve this for you: http://laravel.com/docs/configuration#protecting-sensitive-configuration. But as you still need to set the environment in your start.php file, I prefer to do it differenlty:
My Way
I create a .environment file in my app root folder with things like:
<?php
return [
'LARAVEL_ENV' => 'development',
'DOMAIN' => 'myapp.com',
'DEBUG_MODE' => true,
'MAIN.DATABASE_HOST' => 'localhost',
'MAIN.DATABASE_NAME' => 'databasename',
'MAIN.DATABASE_USER' => 'myusername',
'MAIN.DATABASE_PASSWORD' => 'basswort',
];
I have a class to load the environment file:
<?php
namespace PragmaRX\Support;
use Exception;
class Environment {
protected static $loaded = false;
public static function load($file = null)
{
if ( ! static::$loaded)
{
if ( ! file_exists($file))
{
throw new Exception('Environment file (.environment) was not set or does not exists: '.$file);
}
foreach(require $file as $key => $value)
{
if ($value === false)
{
$value = '(false)';
}
else
if ($value === null)
{
$value = '(null)';
}
else
if (empty($value))
{
$value = '(empty)';
}
putenv(sprintf('%s=%s', $key, $value));
}
static::$loaded = true;
}
}
public static function getDetectionClosure($file = null)
{
static::load($file);
return function() { return getenv('LARAVEL_ENV'); };
}
}
Then in my app/bootstrap/start.php I just need to load it this way:
$env = $app->detectEnvironment(
\App\Environment::getDetectionClosure(__DIR__.'/../.environment')
);
As you can see, the closure will return the current LARAVEL_ENV, stored in my .environment file. But it also will load all keys to the PHP environment, so, now, in my application I just need to
<?php
return [
'fetch' => PDO::FETCH_CLASS,
'default' => 'main',
'connections' => [
'main' => [
'driver' => 'pgsql',
'host' => getenv('MAIN.DATABASE_HOST'),
'database' => getenv('MAIN.DATABASE_NAME'),
'username' => getenv('MAIN.DATABASE_USER'),
'password' => getenv('MAIN.DATABASE_PASSWORD'),
'charset' => 'utf8',
'prefix' => '',
'schema' => 'public',
],
],
];
Add the .environment file to your gitignore file and you should be safe, but you'll have to, of course, create (or copy and edit) the file every time you set a new server.
About Security
Everything in your system is a file, you are protected if your files are protected. It's that simple. A VirtualHost file is a file accessible by your webserver, if someone hacks your webserver you'll have not only your .environment file exposed, but also your VirtualHost one, so IMO you're not securer using one or another.
