From 294d270bc113b2a0391307573df7c654209feffe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <bjoern.fromme@ep-reisen.de>
Date: Wed, 21 Oct 2026 15:09:50 +0200
Subject: [PATCH] chore: load secrets from config/system/secrets.php

additional.php is maintained in Git now (taken over from DDEV's
generated file): DDEV settings apply inside DDEV only, and
secrets.php (gitignored, template secrets.example.php) is merged in
everywhere, ignoring empty values. The web container reaches the local
MyE&P project as myep-next.ddev.site, as in EP/website.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .ddev/docker-compose.communicate.yaml |  5 +++
 config/system/.gitignore              |  2 +
 config/system/additional.php          | 59 +++++++++++++++++++++++++++
 config/system/secrets.example.php     | 25 ++++++++++++
 4 files changed, 91 insertions(+)
 create mode 100644 .ddev/docker-compose.communicate.yaml
 create mode 100644 config/system/.gitignore
 create mode 100644 config/system/additional.php
 create mode 100644 config/system/secrets.example.php

diff --git a/.ddev/docker-compose.communicate.yaml b/.ddev/docker-compose.communicate.yaml
new file mode 100644
index 0000000..bc50bb3
--- /dev/null
+++ b/.ddev/docker-compose.communicate.yaml
@@ -0,0 +1,5 @@
+# Reach the local MyE&P DDEV project from this web container (as in EP/website)
+services:
+  web:
+    external_links:
+      - "ddev-router:myep-next.ddev.site"
diff --git a/config/system/.gitignore b/config/system/.gitignore
new file mode 100644
index 0000000..bcf2027
--- /dev/null
+++ b/config/system/.gitignore
@@ -0,0 +1,2 @@
+/secrets.php
+/drushrc.php
diff --git a/config/system/additional.php b/config/system/additional.php
new file mode 100644
index 0000000..c881580
--- /dev/null
+++ b/config/system/additional.php
@@ -0,0 +1,59 @@
+<?php
+
+// Maintained in Git (taken over from DDEV's generated file): DDEV settings locally, secrets
+// from secrets.php everywhere. Empty secret values leave settings.php untouched.
+
+if (getenv('IS_DDEV_PROJECT') == 'true') {
+    $GLOBALS['TYPO3_CONF_VARS'] = array_replace_recursive(
+        $GLOBALS['TYPO3_CONF_VARS'],
+        [
+            'DB' => [
+                'Connections' => [
+                    'Default' => [
+                        'dbname' => 'db',
+                        'driver' => 'mysqli',
+                        'host' => 'db',
+                        'password' => 'db',
+                        'port' => '3306',
+                        'user' => 'db',
+                    ],
+                ],
+            ],
+            // This GFX configuration allows processing by installed ImageMagick 6
+            'GFX' => [
+                'processor' => 'ImageMagick',
+                'processor_path' => '/usr/bin/',
+                'processor_path_lzw' => '/usr/bin/',
+            ],
+            // This mail configuration sends all emails to mailpit
+            'MAIL' => [
+                'transport' => 'smtp',
+                'transport_smtp_encrypt' => false,
+                'transport_smtp_server' => 'localhost:1025',
+            ],
+            'SYS' => [
+                'trustedHostsPattern' => '.*.*',
+                'devIPmask' => '*',
+                'displayErrors' => 1,
+            ],
+        ]
+    );
+}
+
+if (is_file(__DIR__ . '/secrets.php')) {
+    $withoutEmptyValues = static function (array $values) use (&$withoutEmptyValues): array {
+        foreach ($values as $key => $value) {
+            if (is_array($value)) {
+                $values[$key] = $withoutEmptyValues($value);
+            } elseif ($value === '' || $value === null) {
+                unset($values[$key]);
+            }
+        }
+        return $values;
+    };
+    $GLOBALS['TYPO3_CONF_VARS'] = array_replace_recursive(
+        $GLOBALS['TYPO3_CONF_VARS'],
+        $withoutEmptyValues(require __DIR__ . '/secrets.php')
+    );
+    unset($withoutEmptyValues);
+}
diff --git a/config/system/secrets.example.php b/config/system/secrets.example.php
new file mode 100644
index 0000000..e4bf440
--- /dev/null
+++ b/config/system/secrets.example.php
@@ -0,0 +1,25 @@
+<?php
+
+// Template for config/system/secrets.php (not in Git). Values come from the TYPO3 10
+// production LocalConfiguration.php; empty values are ignored.
+return [
+    'SYS' => [
+        // Must be the production key of TYPO3 10: static pages link to cHash URLs served by TYPO3 13
+        'encryptionKey' => '',
+    ],
+    'EXTENSIONS' => [
+        'ep_products' => [
+            // /api/hotel, /api/product, /api/content/* (X-Api-Key or ?key=)
+            'cmsApiKey' => '',
+            // MyE&P OAuth2 client credentials (import, price calendar); locally e.g. https://myep-next.ddev.site/api/
+            'myEpApiBaseUrl' => '',
+            'myEpApiClientId' => '',
+            'myEpApiClientSecret' => '',
+            'myEpApiUrlAuthorize' => '',
+            'myEpApiUrlToken' => '',
+            // bpn-connect (price calendar)
+            'bpnConnectApiBaseUrl' => '',
+            'bpnConnectApiKey' => '',
+        ],
+    ],
+];