#126 - Changes in beta deployment (#127)

* - changes in deployment paths * - switch to harbor registry and adjust deployment workflow * - add sops to dev and beta and corrections * - files corrections * - remove line from Makefile * - changes in .env.beta * - changes in .env.beta * - changes in docker-compose.beta * - remove line * - remove init-unaccent volume * - add volume * - add push to trigger workflow
blumilksoftware · Aug 27, 2024 · 86b0128 · 86b0128
1 parent b504c49
commit 86b0128
Show file tree

Hide file tree

Showing 11 changed files with 177 additions and 77 deletions.
diff --git a/.github/workflows/deploy-to-beta-by-push.yml b/.github/workflows/deploy-to-beta-by-push.yml
@@ -5,6 +5,9 @@ concurrency:
   cancel-in-progress: true
 
 on:
+  push:
+    branches:
+      - main
   workflow_dispatch:
 
 jobs:
@@ -14,7 +17,11 @@ jobs:
     name: Deploy to beta
     runs-on: ubuntu-22.04
     env:
-      REPO_NAME: keating
+      DOCKER_REGISTRY: registry.blumilk.pl
+      DOCKER_REGISTRY_USER_NAME: robot@blumilkbot-harbor
+      DOCKER_REGISTRY_PROJECT_NAME: internal-public
+      DOCKER_REGISTRY_REPO_NAME: keating
+      TARGET_DIR_ON_SERVER: /blumilk/beta/projects
     steps:
       - name: set branch name
         run: echo "BRANCH_NAME=$GITHUB_REF_NAME" >> $GITHUB_ENV
@@ -40,17 +47,21 @@ jobs:
       - name: login to GitHub Container Registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ env.DOCKER_REGISTRY_USER_NAME }}
+          password: ${{ secrets.BLUMILKBOT_HARBOR_TOKEN }}
+
+      - name: set docker image name
+        run: echo "DOCKER_IMAGE_NAME=${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REGISTRY_PROJECT_NAME }}/${{ env.DOCKER_REGISTRY_REPO_NAME }}" >> $GITHUB_ENV
 
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
         with:
-          images: ghcr.io/${{ github.repository_owner }}/${{ env.REPO_NAME }}
-          tags: type=raw,value=beta
-          context: git
+          images: ${{ env.DOCKER_IMAGE_NAME }}
+          tags: |
+            type=raw,value=beta
+          context: workflow
 
       - name: build and push image
         uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
@@ -59,10 +70,10 @@ jobs:
           file: ./environment/prod/app/Dockerfile
           build-args: DEPLOYMENT_PROJECT_VERSION_ARG=${{ env.DEPLOYMENT_PROJECT_VERSION }}
           labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.meta.outputs.tags }}
           push: true
-          tags: ghcr.io/${{ github.repository_owner }}/${{ env.REPO_NAME }}:beta
-          cache-from: type=gha, ref=ghcr.io/${{ github.repository_owner }}/${{ env.REPO_NAME }}-beta-build-cache
-          cache-to: type=gha, ref=ghcr.io/${{ github.repository_owner }}/${{ env.REPO_NAME }}-beta-build-cache, mode=max
+          cache-from: type=gha, ref=${{ env.DOCKER_IMAGE_NAME }}-beta-build-cache
+          cache-to: type=gha, ref=${{ env.DOCKER_IMAGE_NAME }}-beta-build-cache, mode=max
 
       - name: copy files via ssh
         uses: appleboy/scp-action@917f8b81dfc1ccd331fef9e2d61bdc6c8be94634 # v0.1.7
@@ -75,7 +86,7 @@ jobs:
           key: ${{ secrets.VPS_OVH_BF7EC892_SSH_PRIVATE_KEY }}
           passphrase: ${{ secrets.VPS_OVH_BF7EC892_SSH_PRIVATE_KEY_PASSPHRASE }}
           source: "./environment/prod/deployment/beta/*,./environment/prod/deployment/scripts/*,./environment/prod/deployment/postgres/*"
-          target: ${{ secrets.KEATING_VPS_BETA_APP_PATH }}
+          target: ${{ env.TARGET_DIR_ON_SERVER }}/${{ env.DOCKER_REGISTRY_REPO_NAME }}
           rm: true
 
       - name: run deployment script over ssh
@@ -90,6 +101,6 @@ jobs:
           passphrase: ${{ secrets.VPS_OVH_BF7EC892_SSH_PRIVATE_KEY_PASSPHRASE }}
           script_stop: true
           script: |
-            cd ${{ secrets.KEATING_VPS_BETA_APP_PATH }}/environment/prod/deployment/beta
-            make beta-deploy BETA_ENV_KEY=${{ secrets.BETA_ENV_KEY }}
-            docker images --filter dangling=true | grep "ghcr.io/blumilksoftware/${{ env.REPO_NAME }}" | awk '{print $3}'| xargs --no-run-if-empty docker rmi
+            cd ${{ env.TARGET_DIR_ON_SERVER }}/${{ env.DOCKER_REGISTRY_REPO_NAME }}/environment/prod/deployment/beta
+            make beta-deploy SOPS_AGE_KEY=${{ secrets.SOPS_AGE_BETA_SECRET_KEY }}
+            docker images --filter dangling=true | grep "${{ env.DOCKER_IMAGE_NAME }}" | awk '{print $3}'| xargs --no-run-if-empty docker rmi
diff --git a/.gitignore b/.gitignore
@@ -12,7 +12,7 @@
 
 .env
 .env.backup
-.env.beta
+.env.beta.secrets.decrypted
 .phpunit.result.cache
 .php-cs-fixer.cache
 .appversion

diff --git a/.sops.yaml b/.sops.yaml
@@ -0,0 +1,6 @@
+creation_rules:
+
+  - name: beta
+    path_regex: \.env\.beta\.secrets.*$
+    age: >-
+      age1vq7sw98g2xk9md2yg9f959k8xkaz8r32pds27jn3nsfcdue3757s0h7hd8
diff --git a/Makefile b/Makefile
@@ -5,7 +5,6 @@ include .env
 
 SHELL := /bin/bash
 
-DOCKER_COMPOSE_FILE = docker-compose.yaml
 DOCKER_COMPOSE_APP_CONTAINER = app
 DOCKER_COMPOSE_DATABASE_CONTAINER = database
 
@@ -19,7 +18,7 @@ TEST_DATABASE_NAME=keating-test
 init: check-env-file
 	@make build \
     && make run \
-	&& docker compose --file ${DOCKER_COMPOSE_FILE} exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} bash "./environment/dev/scripts/init.sh" \
+	&& docker compose exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} bash "./environment/dev/scripts/init.sh" \
 	&& make create-test-db
 
 check-env-file:
@@ -29,63 +28,55 @@ check-env-file:
 	fi; \
 
 build:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} build --pull
+	@docker compose build --pull
 
 run:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} up --detach
+	@docker compose up --detach
 
 stop:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} stop
+	@docker compose stop
 
 restart: stop run
 
 shell:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} bash
+	@docker compose exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} bash
 
 shell-root:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} exec ${DOCKER_COMPOSE_APP_CONTAINER}
+	@docker compose exec ${DOCKER_COMPOSE_APP_CONTAINER}
 
 dev:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} npm run dev
+	@docker compose exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} npm run dev
 
 test:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} composer test
+	@docker compose exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} composer test
 
 fix:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} bash -c 'composer csf && npm run lintf'
+	@docker compose exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} bash -c 'composer csf && npm run lintf'
 
 queue:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} php artisan queue:work
+	@docker compose exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} php artisan queue:work
 
 create-test-db:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} exec ${DOCKER_COMPOSE_DATABASE_CONTAINER} bash -c 'createdb --username=${DATABASE_USERNAME} ${TEST_DATABASE_NAME} &> /dev/null && echo "Created database for tests (${TEST_DATABASE_NAME})." || echo "Database for tests (${TEST_DATABASE_NAME}) exists."'
-
-encrypt-beta-env:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} run \
-	--rm \
-	--no-deps \
-	--volume ${CURRENT_DIR}/environment/prod/deployment/beta:/envs \
-	--entrypoint "" \
-	--workdir /application \
-	--user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" \
-	${DOCKER_COMPOSE_APP_CONTAINER} \
-	bash -c "cp /envs/.env.beta /application \
-		&& php artisan env:encrypt --env beta --key ${BETA_ENV_KEY} \
-		&& mv .env.beta.encrypted /envs \
-		&& rm .env.beta"
-
-decrypt-beta-env:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} run \
-	--rm \
-	--no-deps \
-	--volume ${CURRENT_DIR}/environment/prod/deployment/beta:/envs \
-	--entrypoint "" \
-	--workdir /application \
-	--user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" \
-	${DOCKER_COMPOSE_APP_CONTAINER} \
-	bash -c "cp /envs/.env.beta.encrypted /application \
-		&& php artisan env:decrypt --env beta --key ${BETA_ENV_KEY} \
-		&& mv .env.beta /envs \
-		&& rm .env.beta.encrypted"
-
-.PHONY: init check-env-file build run stop restart shell shell-root test fix create-test-db queue encrypt-beta-env decrypt-beta-env
+	@docker compose exec ${DOCKER_COMPOSE_DATABASE_CONTAINER} bash -c 'createdb --username=${DATABASE_USERNAME} ${TEST_DATABASE_NAME} &> /dev/null && echo "Created database for tests (${TEST_DATABASE_NAME})." || echo "Database for tests (${TEST_DATABASE_NAME}) exists."'
+
+encrypt-beta-secrets:
+	@$(MAKE) encrypt-secrets SECRETS_ENV=beta
+
+decrypt-beta-secrets:
+	@$(MAKE) decrypt-secrets SECRETS_ENV=beta AGE_SECRET_KEY=${SOPS_AGE_BETA_SECRET_KEY}
+
+decrypt-secrets:
+	@docker compose exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" --env SOPS_AGE_KEY=${AGE_SECRET_KEY} ${DOCKER_COMPOSE_APP_CONTAINER} \
+		bash -c "echo 'Decrypting ${SECRETS_ENV} secrets' \
+			&& cd ./environment/prod/deployment/${SECRETS_ENV} \
+			&& sops --decrypt --input-type=dotenv --output-type=dotenv --output .env.${SECRETS_ENV}.secrets.decrypted .env.${SECRETS_ENV}.secrets \
+			&& echo 'Done'"
+
+encrypt-secrets:
+	@docker compose exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} \
+		bash -c "echo 'Encrypting ${SECRETS_ENV} secrets' \
+			&& cd ./environment/prod/deployment/${SECRETS_ENV} \
+			&& sops --encrypt --input-type=dotenv --output-type=dotenv --output .env.${SECRETS_ENV}.secrets .env.${SECRETS_ENV}.secrets.decrypted \
+			&& echo 'Done'"
+
+.PHONY: init check-env-file build run stop restart shell shell-root test fix create-test-db queue encrypt-beta-secrets decrypt-beta-secrets
diff --git a/environment/dev/app/Dockerfile b/environment/dev/app/Dockerfile
@@ -1,10 +1,28 @@
+FROM alpine:3.20.2@sha256:0a4eaa0eecf5f8c050e5bba433f58c052be7587ee8af3e8b3910ef9ab5fbe9f5 AS secops-tools
+
+# https://github.com/FiloSottile/age/releases
+ARG AGE_VERSION="1.1.1"
+
+# https://github.com/getsops/sops/releases
+ARG SOPS_VERSION="3.8.1"
+
+RUN wget --output-document age.tar.gz "https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-linux-amd64.tar.gz" \
+    && tar --extract --file age.tar.gz \
+    && mv age/age /usr/local/bin \
+    && mv age/age-keygen /usr/local/bin \
+    && wget --output-document /usr/local/bin/sops "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+    && chmod +x /usr/local/bin/sops
+
 FROM composer/composer:2.7.7-bin@sha256:1832641f1ba36c8e748f4b4462f77e7c8836cca7730fdf0540580d703b78f2e7 AS composer-bin
 
 FROM node:21.7.3-bullseye-slim@sha256:50adaf5a166e4e3dc01e77e9bdb4c35e34ef32a1e9e26200019cddb2b154fb34 AS node
 
 FROM php:8.3.10-fpm-bullseye@sha256:857b7cdf42fc4e5b313548e6f6260fce0534439e30915824a5ac3efe9a121dff
 
 COPY --from=composer-bin ./composer /usr/bin/composer
+COPY --from=secops-tools /usr/local/bin/age /usr/local/bin/age
+COPY --from=secops-tools /usr/local/bin/age-keygen /usr/local/bin/age-keygen
+COPY --from=secops-tools /usr/local/bin/sops /usr/local/bin/sops
 
 ARG USER_NAME=host-user
 ARG USER_ID=1000

diff --git a/environment/prod/deployment/beta/.env.beta b/environment/prod/deployment/beta/.env.beta
@@ -0,0 +1,31 @@
+APP_NAME=keating
+APP_ENV=beta
+
+APP_DEBUG=false
+APP_URL=https://dev.keating.blumilk.pl
+KEATING_HOST_NAME=dev.keating.blumilk.pl
+COMPOSE_PROJECT_NAME=keating-beta
+
+LOG_CHANNEL=stack
+LOG_DEPRECATIONS_CHANNEL=null
+LOG_LEVEL=debug
+
+MAIL_MAILER=smtp
+MAIL_HOST=mailpit
+MAIL_PORT=1025
+MAIL_FROM_NAME="${APP_NAME}"
+MAIL_FROM_ADDRESS="hello@example.com"
+
+DB_CONNECTION=pgsql
+DB_HOST=keating-beta-database
+DB_PORT=5432
+
+REDIS_HOST=keating-beta-redis
+REDIS_PORT=6379
+
+BROADCAST_DRIVER=log
+CACHE_DRIVER=redis
+FILESYSTEM_DISK=local
+QUEUE_CONNECTION=redis
+SESSION_DRIVER=redis
+SESSION_LIFETIME=120
diff --git a/environment/prod/deployment/beta/.env.beta.encrypted b/environment/prod/deployment/beta/.env.beta.encrypted
diff --git a/environment/prod/deployment/beta/.env.beta.secrets b/environment/prod/deployment/beta/.env.beta.secrets
@@ -0,0 +1,19 @@
+APP_KEY=ENC[AES256_GCM,data:TTsJs3aACKmy10SUgA8JB5WztpldU02m/8zpQ1C0PGVbMdXS+kxk2/Pek5v6h3JTN12y,iv:oBzH9N1SCfSZhdzhSvihplLSviIAENpsqWvrQhD840Y=,tag:6eH1zx4KFBDLZ2/xqTLFxg==,type:str]
+DOCKER_KEATING_BETA_DB_ROOT_PASSWORD=ENC[AES256_GCM,data:Sp7unHaaBg==,iv:K+ei3PxVGv3EJspPYwOHv8tTiWwP4irin4z51A9emM4=,tag:7VuqtaiB0UxOBm306S3wGg==,type:str]
+DOCKER_KEATING_BETA_DB_DATABASE=ENC[AES256_GCM,data:ZiFpH2f5Nw==,iv:hlf8stwm78YIGYXOk7eglFEnh/1O4X5xhNk6/tfuABU=,tag:FaLSQrq0u99xRwNT184kDg==,type:str]
+DOCKER_KEATING_BETA_DB_USERNAME=ENC[AES256_GCM,data:mtJDVPePcg==,iv:IWJ+/6KmhJ8c1NpKYYdaTo73GS9rA6kB0nI4vDrcj9I=,tag:QVXTtOAOcpVjmQJwWIee0A==,type:str]
+DOCKER_KEATING_BETA_DB_PASSWORD=ENC[AES256_GCM,data:bYiu24RQRtI=,iv:q3fBrU+hQQDcv7S0n/BxmkMUx5sJ+gnwmNhecjSkeB8=,tag:OZd6lk9xtURpRlzRgkKp2w==,type:str]
+DB_DATABASE=ENC[AES256_GCM,data:KSf9w/zgyg==,iv:PNeyBby69egxfrr2nUo/5WozY65eF17WbSFYaE/BoGk=,tag:Pfs1TzQZJWIiSCsc1e2jEg==,type:str]
+DB_USERNAME=ENC[AES256_GCM,data:0M+qZx3Chw==,iv:+GOj7PNlcjzEpJ/fY2S5PFF7LSsIGVGz/FdT1WWU2VU=,tag:3ee+CypnLieVeV4bwKt3fw==,type:str]
+DB_PASSWORD=ENC[AES256_GCM,data:Oxktp0JTisM=,iv:UgtfeMZYNV7YZboZLvw6Twu1N1cBxO4SPQI2dUYhwwo=,tag:l5sZeMd+xtbhixQLU+cHNw==,type:str]
+DB_ROOT_PASSWORD=ENC[AES256_GCM,data:FrWPlpJOdQ==,iv:+fxhR7EESnvQ6bj+WzhlsJuI+wAx1Q6pkjoQc77qIWU=,tag:lMVTy287wN6h2IuJzYt1kQ==,type:str]
+REDIS_PASSWORD=ENC[AES256_GCM,data:6WAHrQ==,iv:ydPKRAjQ+rXAQ4mNPm8/6MtmQLFNPJm+VFT0sLGNVWk=,tag:X89hBximDsHMz9MHfZ6d8w==,type:str]
+MAIL_USERNAME=ENC[AES256_GCM,data:3nsqlw==,iv:my6RAA3AHIhSI5sBEGA3nPLmKWsZ4x2fetxgKPSJH5Y=,tag:dw+uvgXaHM1UVZl6+GDKQA==,type:str]
+MAIL_PASSWORD=ENC[AES256_GCM,data:ai3oXA==,iv:hCiDWPB8z0/Jfy4IhkFOUddAm5pAs4P22BwSiGRbm/o=,tag:LdzQV2wFEkwLGNb/UTFnHw==,type:str]
+MAIL_ENCRYPTION=ENC[AES256_GCM,data:27WHPA==,iv:SvtOxgKa3igVDARcBBvCB/fvFRbxwEoGCgTQsxKQPt0=,tag:WcAiPeCsgAEFjSagQ6CtPw==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXZk40L3hjRllyQjFnZERm\nOUppTFp0bmZPMTY1ejZybHZLOGFmWFJpaUdBCmhDZmxNenFIVXI1Q2N4cVhjcHNl\nbzFvREEvVGg4T3NrN21ZdkViR01TWHcKLS0tIHRGZC94OFIrZUt6NHRKUnQxOUow\nUEJ1YlY5TmhqZndJRG92a1VEU01FYkUKEm6zEUYB8o9ua29m5QS31sizEUN1QcYp\nNPSi6lzm0E4eFuRwjw8XW+Vs936JbHboWpOjcpgA4kiOwDmgypnu/g==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1vq7sw98g2xk9md2yg9f959k8xkaz8r32pds27jn3nsfcdue3757s0h7hd8
+sops_lastmodified=2024-08-21T10:30:14Z
+sops_mac=ENC[AES256_GCM,data:q1Pdp3UhEJldgGdd+WlIkKVEhlgFN06rQS49piUVnc/nVl+eLVM68WUcBLJ1lYzr9nVLmKQ8Iz/6wC/92p91cT/w8MuUS5Y2IErL8CArDuH67L5H8rY170jZn2YAcmZ8kSoBvnxitsJZn0NvmmwEhQbH7ACUCyPYuM4nyOFydVg=,iv:2PkFE9RDP/dzfQ+dwDgzVoIvr+NGyLWa0tIWJXLCaKA=,tag:q51yHRBVHZqQc3GeOsCMLw==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.8.1
diff --git a/environment/prod/deployment/beta/Makefile b/environment/prod/deployment/beta/Makefile
@@ -1,6 +1,8 @@
 export COMPOSE_DOCKER_CLI_BUILD = 1
 export DOCKER_BUILDKIT = 1
 
+MAKEFLAGS += --no-print-directory
+
 DOCKER_COMPOSE_FILENAME = docker-compose.beta.yml
 DOCKER_COMPOSE_APP_CONTAINER = keating-beta-app
 
@@ -11,23 +13,21 @@ BETA_DOCKER_IMAGE = ghcr.io/blumilksoftware/keating:beta
 
 CURRENT_DIR = $(shell pwd)
 
-beta-deploy: decrypt-beta-env create-deployment-file
+beta-deploy: decrypt-secrets create-deployment-file
 	@docker compose --file ${DOCKER_COMPOSE_FILENAME} pull && \
 	docker compose --file ${DOCKER_COMPOSE_FILENAME} up --detach && \
 	echo "App post deploy actions" && \
 	${DOCKER_EXEC_SCRIPT} post-deploy-actions.sh
 
-decrypt-beta-env:
-	@docker run \
-	--rm \
-	--volume ${CURRENT_DIR}:/envs \
-	--entrypoint "" \
-	--workdir /application \
-	${BETA_DOCKER_IMAGE} \
-	bash -c "cp /envs/.env.beta.encrypted /application \
-		&& php artisan env:decrypt --env beta --key ${BETA_ENV_KEY} \
-		&& cp .env.beta /envs/.env.beta \
-		&& cp .env.beta /envs/.env"
+SOPS_VERSION=3.8.1
+
+decrypt-secrets:
+	@wget --output-document ./sops "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+    	&& chmod +x ./sops \
+    	&& mv .env.beta .env \
+    	&& echo "Decrypting secrets" \
+    	&& ./sops --decrypt --input-type=dotenv --output-type=dotenv .env.beta.secrets >> .env \
+    	&& echo "Done"
 
 DEPLOYMENT_DATETIME = $(shell TZ=Europe/Warsaw date --rfc-3339=seconds)
 
@@ -36,4 +36,4 @@ create-deployment-file:
 	DEPLOY_DATE='${DEPLOYMENT_DATETIME}'\
 	" > .deployment
 
-.PHONY: beta-deploy decrypt-beta-env create-deployment-file
+.PHONY: beta-deploy decrypt-secrets create-deployment-file