Config Enforce

Enforce your Config for seamless deployments and DX wins!

Derek Laventure

derek@consensus.enterprises

Land Back!

Guelph is traditional territory (Treaty 3, Haldimand Treaty) for:

Anishinabewaki ᐊᓂᔑᓈᐯᐗᑭ
Haudenosaunee
Attiwonderonk
Mississaugas of the Credit

Ottawa is traditional territory (Crawford’s Purchase Treaty) for:

Algonquin
Haudenosaunee
Mohawk

I offer respect and gratitude to the people who are past, present and future caretakers of this land.

Resources: https://whose.land & https://native-land.ca

Drupal Creds

Building Drupal sites since 4.6

Building PHP/MySQL sites for several years prior

On Drupal.org for 25 years 1 month (spiderman@drupal.org)

Attended many DrupalCamps and several DrupalCons

Aegir 3 User/Developer, Aegir 5 Maintainer

Contributor to *many* Drupal related projects over the years

At Consensus, 8+ years toward Drupal as application framework

Consensus Enterprises

We help small teams do big things.

Making open and responsible tech accessible to purpose-driven teams

Gratitude

A brief history of production deployments
Drupal as application framework
CMI 2.0
Config Enforce
Demo
Q&A / Discussion

A brief history of production deployments

pre-Drupal 8

Config vs. Content -> all in the DB

Large mysqldump files

hook_update() functions

Pantheon-like workflows: DEV -> TEST -> LIVE

Features modules

Exportables

Clobbered production config values!

devs had local mysqldump files on their workstation
updates to config required custom hook_update() code to implement db schema changes as well as updates to variables/settings directly in the database.
If a relevant config had changed in production, the deployment would either:
- clobber the production value, replacing it wholesale
- hook_update would conditionally check for expected values before changing, and ideally handle granular updates as best we could
  - this would entail careful testing on the developer’s part, carefully setting up their local install to match the pre-update config, then iteratively running their hook_update() to ensure it properly handles all cases, which realistically is not likely to happen consistently
Pantheon-like workflows enabled us to refresh a “dev” instance relatively easily, and run hook_update() against known-production values, which helped to validate and troubleshoot deployment issues early. Still, it was a pain!
Reminder: in Drupal 7 we had the advent of Features modules, which were born out of a Drupal 6 itch the community had related to “packaging” config in a modular/reusable way

Configuration Management

drush cim/cex -> config distinct and exportable

Large config/sync YAML directories

(still) hook_update() functions

Config Split

Config vs. Content? not a clean line

Clobbered production config values!

Now we have config-import and config-export, enabling config entities to be distinguished from content entities, and commit exported YAML files to git repositories
Developers now pass around config/sync directories managed manually by cim and cex commands, often using config_split to allow for environment-indicator type customizations such as disabling email or visually flagging DEV vs PROD
- Caveat 1: we don’t tend to get very granular with config_split or the config-export mechanism, and most teams appear to simply commit the entire site’s config/sync directory into git at the outset, and track changes from there.
- Caveat 2: there is still a lot of “config” that lives in the database, as the distinction between what constitutes a “config entity” and a “content entity” is not always clear.
  - example: menu items, taxonomy terms, etc (see Structure Sync, Content Sync)
Deployments still rely heavily on hook_update()s to run smoothly (to update db schema or config entities) but we also need config-sync commands added to the deployment pipeline
- The problem of clobbering production values is still present! It’s a little bit easier to iteratively test a hook_update() that will avoid clobbering “drifted” production values, especially at a granular level (eg. a views.view.yml file that needs a new )

Drupal as application framework

(a small detour)

Sites with complex behaviour

Install profiles

CI/CD for automated testing

Grouping config into logical units

CMI 2.0

2018: Angie Byron collected ideas on CMI 2.0

1x Blog: Configuration Management with Drupal Distributions

Config Enforce

What if production config didn’t “drift”?

How it works

Disable config forms for those entities

Block API-level changes (`drush cset`)

In DEV, allow editing, and auto-export changes

Push exported updates to PROD

Enforce configs (`drush config-enforce:enforce`)

Config Enforce is 2 modules

Config Enforce (CE) - install in production

Config Enforce Devel (CED) - install in dev

Config Enforce disables forms (& blocks API changes)

Config Enforce Devel provides a UI to "register" configs to enforce

Config Devel

Config Devel enables automatic cim/cex

Config Enforce patches Config Devel with hooks

CED implements these hooks to tell Config Devel to import/export enforced configs

Config Devel does the actual writing to disk

Introspection

We use PHP reflection to invoke protected methods to access eg. getEditableConfigNames() methods.

Enforcement levels are lying!

But we’ve gained a really nice development workflow!

Resources

Project:
https://drupal.org/project/config_enforce
Docs:
https://config-enforce.consensus.enterprises

Drupal 11 and beyond

We need a consistent mechanism to identify config entities (to avoid Page manager spelunking)!

10.2 introduced #config_target in the form array uses Config Schema (issue)

Config transformation events

Config Filter now recommends using this new API instead!

Demo

Bootstrap project with Drumkit

Install and enable Config Enforce (enable patching!)

Basic settings & Default target module

Generate new target module

Enforce simple config (enforced by default!)

Enforce Fields, Views config

Generate from Active

Setup:

init-repo dc-ottawa
install-drumkit
init-drupalcamp-project dc-ottawa
source d; make start build install tests
init-gitignore
init-config-enforce
https://dc-ottawa.ddev.site

Run through basic install with Drumkit
Show basic settings
- Ignore settings
- Default target module
- Generate new target module
Enforce simple config
- ENFORCE BY DEFAULT!!
Create field and enforce it
- Off-canvas display!
Generate from Active storage
Generate from modules
Demonstrate enforcing?
- update a config on disk, then drush cee

Functions:

function init-repo() {
  repo=$1
  mkdir $1; cd $1; git init; touch README; git add . ; git commit -m "Initial commit."
}
function install-drumkit() {
wget -O - https://drumk.it/installer | bash
git add .
git commit -m "Install Drumkit."
}
function init-drupalcamp-project() {
project=$1
make init-project-drupal PROJECT_NAME=$1 SITE_NAME="DrupalCamp Ottawa 2026" COMPOSER_BASE_PROJECT_VERSION=10.6.7
git add .
git commit -m "Initialize Drupal project."
}
function init-gitignore() {
echo 'web/' >> .gitignore
echo '!web/modules' >> .gitignore
echo 'web/modules/' >> .gitignore
echo '!web/modules/custom' >> .gitignore
echo '!web/modules/custom/*' >> .gitignore
git add .gitignore
git commit -m "Fix .gitignore."
}
function init-config-enforce() {
ddev composer config extra.enable-patching "true"
ddev composer config minimum-stability "dev"
ddev composer require "cweagans/composer-patches:^1.0"
ddev composer require "drupal/config_enforce:^2.0beta"
ddev composer require –dev "drupal/config_enforce_devel:^2.0beta"
git add composer.*
git commit -m "Composer install Config Enforce."
}

Discussion / Q&A

Resources

Project:
https://drupal.org/project/config_enforce
Docs:
https://config-enforce.consensus.enterprises

Config Enforce

Enforce your Config for seamless deployments and DX wins!

Derek Laventure

derek@consensus.enterprises

Land Back!

Drupal Creds

Consensus Enterprises

We help small teams do big things.

Gratitude

Table of Contents

A brief history of production deployments

pre-Drupal 8

Configuration Management

Drupal as application framework

(a small detour)

CMI 2.0

Config Enforce

How it works

Config Enforce is 2 modules

Config Devel

Introspection

Enforcement levels are lying!

Resources

Drupal 11 and beyond

Demo

Discussion / Q&A

Resources

Thank you!

Config Enforce

Enforce your Config for seamless deployments and DX wins!

Derek Laventure

derek@consensus.enterprises

Land Back!

Who am I?

Derek Laventure (he/they)

Drupal Creds

Consensus Enterprises

We help small teams do big things.

Gratitude

Table of Contents

A brief history of production deployments

pre-Drupal 8

Configuration Management

Drupal as application framework

(a small detour)

CMI 2.0

Config Enforce

How it works

Config Enforce is 2 modules

Config Devel

Introspection

Enforcement levels are lying!

Resources

Drupal 11 and beyond

Demo

Discussion / Q&A

Resources

Thank you!