PHP 357 tests

Laravel Doppler

Render a Laravel .env from Doppler secrets safely, atomically, and with a round-trip guarantee.

Installation

composer require alexhackney/laravel-doppler
php artisan vendor:publish --tag=doppler-config
php artisan env:sync

Why it exists

Rendering an env file looks like a one-liner. It is not. The env-no-quotes format silently truncates any value containing #, which random-generated passwords contain routinely. A shell redirect truncates the target file before the command that fills it has even run. And mv across two filesystems is not atomic, so it leaves a window where the file is half written.

This package closes all of those by construction. Before anything is written, the rendered bytes are loaded back through the full phpdotenv stack, the same one Laravel boots with, and compared value by value against what Doppler sent. Any mismatch is a refusal that names the offending keys, and nothing is written.

What it does

Round-trip guarantee

Rendered bytes are parsed back through phpdotenv and compared to source values. Mismatch means refusal, not a corrupted file.

Atomic writes

Temp-and-rename within the target directory, so the write is a real rename() syscall and never degrades to copy-then-unlink.

Four commands

env:sync to write, env:diff to report drift (exit 10, safe to schedule), env:doctor to diagnose with no network and no secrets printed, env:snapshot for an encrypted local fallback.

Multiple targets

Laravel, systemd, docker, and shell grammars, with api, cli, and snapshot drivers.

Token discovery

Finds service tokens automatically, with /etc/doppler/.token recommended so it survives a switch to atomic deploys.

Verified escaping

Hashes, spaces, quotes, backslashes, $, ${}, tabs, newlines, CRLF, UTF-8, PEM keys, JSON, and 4KB values of the above are all covered by test.

Requirements

›PHP 8.2 or newer
›Laravel 12 or 13
›A Doppler service token