Laravel without a plaintext .env on the server

Laravel loads .env with phpdotenv in immutable mode. A variable that is already in the environment is never replaced by the file. Laravel's docs say the same: external environment variables override .env.

npx getmyenv run puts the values in the environment before PHP starts. env() and config() read them as usual. Laravel boots without a .env file, so you can delete it.

In the project folder, import the file, then delete it. For a new APP_KEY, key:generate --show prints a key without writing any file. set APP_KEY asks for the value.

bash
npx getmyenv import
rm .env
php artisan key:generate --show
npx getmyenv set APP_KEY

This fills Development. Only the owner sets Read-only values, in the dashboard. Set Production values, APP_KEY included, there.

bash
npx getmyenv run -- php artisan serve
npx getmyenv run -- php artisan migrate

Keep the .env file deleted. While one exists, artisan serve passes only a short list of names to its PHP server and reads the file again when it changes. Without the file, or with --no-reload, it passes the whole environment.

On the server, set GETMYENV_TOKEN to a server token for Production. Then wrap each command that starts PHP. Node and npx must be installed on the server.

bash
npx getmyenv run production -- php artisan migrate --force
npx getmyenv run production -- php artisan octane:start
npx getmyenv run production -- php artisan queue:work

PHP-FPM clears the environment of its workers by default. To pass the values through, set clear_env = no in the pool config and start PHP-FPM in the foreground under run, for example npx getmyenv run production -- php-fpm -F. The binary name depends on your distribution. Or use the config cache below.

A queue worker keeps the values it started with. After a value changes, run npx getmyenv run production -- php artisan queue:restart. Workers exit after their current job, and your process manager starts them again. Put the same run command in its config so they get the new values.

config:cache captures every config value when it runs. Run it under getmyenv, or it caches defaults instead of your values. optimize runs it too.

bash
npx getmyenv run production -- php artisan config:cache

• The cache is a plaintext PHP file, bootstrap/cache/config.php. It holds the resolved values, secrets included.
• With a cached config, Laravel stops reading .env, and the app uses the values from cache time. Run the command again after a value changes.
• If you want no plaintext file on the server, skip the cache and start PHP under run.

More frameworks: /docs/languages. Server tokens and approval: /docs/machine-access.