Skip to content

Environment Configuration

Overview

Configuration is layered and loaded in this order at runtime (site/config/application.php):

  1. site/.env — loaded first; typically contains only DOTENV_KEY in non-local environments
  2. site/.env.vault — encrypted secrets decrypted by dotenv-vault using DOTENV_KEY
  3. site/.env.override — local overrides applied last (git-ignored)
  4. site/config/environments/{WP_ENV}.php — PHP constants per environment

Later sources take precedence over earlier ones.

The WP_ENV constant

Controls which environment config file is loaded. Defaults to production if not set.

Value Config file Used for
development config/environments/development.php Docker local dev
staging config/environments/staging.php Staging server
production config/environments/production.php Production server

Dotenv Vault

Production and staging secrets are stored encrypted in site/.env.vault and committed to the repo. They are decrypted at runtime using DOTENV_KEY, which is the only secret that needs to be provisioned externally (e.g. as a server environment variable or CI secret).

# Pull the latest .env from the vault (writes to site/.env.staging, site/.env.production, etc.)
cd site && yarn env:pull

# Push local .env changes to the vault
cd site && yarn env:push

# Rebuild the encrypted .env.vault file
cd site && yarn env:build

Never commit plain-text environment files (.env.production, .env.staging). These are git-ignored.

Docker environment mounting

The root .env (repo root, not site/) is used to configure Docker. In docker-compose.override.yml:

  • Root .env → mounted as site/.env.override (local overrides)
  • .env.cloud → mounted as site/.env (holds DOTENV_KEY for vault decryption)

This means local development values go in the root .env, which override whatever the vault decrypts.

Local overrides (site/config/local.php)

The file site/config/local.php is git-ignored and loaded automatically by the environment config. Use it for machine-specific temporary filters, ngrok URL rewrites for webhook testing, or disabling features locally:

// Example: rewrite URLs for ngrok webhook testing
add_filter('home_url', function($url) {
    return str_replace('barberklingen.dk-local', 'abc123.ngrok-free.app', $url);
});

Key environment variables

Variable Purpose
WP_HOME Full public URL of the site
WP_SITEURL WordPress core URL ({WP_HOME}/wp)
DB_* Database connection (or use DATABASE_URL)
DOTENV_KEY Decryption key for .env.vault
KLAVIYO_API_PRIVATE_KEY / KLAVIYO_API_PUBLIC_KEY Klaviyo email/SMS integration
MOBILEPAY_* MobilePay payment gateway
GATEWAYAPI_KEY / GATEWAYAPI_SECRET SMS via GatewayAPI
GTM_ID Google Tag Manager container ID
WP_ROCKET_KEY / WP_ROCKET_EMAIL WP Rocket caching plugin license
DISABLE_WP_CRON Set true to use system cron instead of WP-Cron
SENTRY_AUTH_TOKEN Sentry source map uploads