Update settings.php to accept env var for shield configuration.

[steveworley]

No description provided.

[simesy]

At ACMA we had a couple of cases where they wanted to turn shield off for a short time to do dns testing. What does this change mean for that workflow? Could we add a comment to describe how DRUPAL_SHIELD_* variables get set?

[steveworley]

This enforces shield on non-prod environments (PR, Develop, Stage) production will not have the values set and will rely on the DB to determine if it needs to enable shield or not.

If we want to disable it for particular branches for any kind of testing we would follow the Lagoon docs on environment variable inheritance https://lagoon.readthedocs.io/en/stable/using_lagoon/environment_variables/.

They're set in the build process in Openshift (the scaffolding repos will have the implementation of how they're set in Lagoon). They will define .lagoon.env which will provide the default values and then .lagoon.env.master which will provide overrides for the master branch.

[simesy]

Sorry i meant more from a process point of view, since we pretty much force the value with no apology. I've had experiences where I trawled through code for an hour or two, only to realise I could only change it through a helpdesk ticket. Eg. if I google "govcms DRUPAL_SHIELD_USER" I get to https://github.com/srowlands/govcms-devkit/blob/master/example.config.yml#L92 which is coincidentally super misleading!

(Happy for this to go in, because all the settings files need to be fixed anyway.)