How to disable Nelmio UI in production? - symfony

Question

Is there a way to turn off all of the Nelmio Swagger UI docs? In production I want the outside world to see nothing at the following URLs, but in dev they should display useful docs & sandbox as normal:
http://ourserver.com/api/doc
http://ourserver.com/api-docs
http://ourserver.com/api-docs/*
Seems like there should be an easy switch for this in the Nelmio config, but I haven't found it. My company is using the Nelmio API Doc bundle in Symfony to develop APIs for a non-public API. The API server is exposed to the public, but we're not interested in publishing its usage to the world.

Answer 1

#gp_sflover's comment got me on the right track, but there's more to it than just disabling NelmioApiDocBundle on prod in AppKernel.php. Configs & routes that refer to Nelmio will generate errors until you move them into dev-specific files. The following change in app/AppKernel.php was the first step:
public function registerBundles()
{
$bundles = [
new Symfony\Bundle\FrameworkBundle\FrameworkBundle(),
...
// new Nelmio\ApiDocBundle\NelmioApiDocBundle(), // <-- REMOVED FROM HERE
new Nelmio\CorsBundle\NelmioCorsBundle(),
new AppBundle\AppBundle(),
];
if (in_array($this->getEnvironment(), ['dev', 'test'], true)) {
$bundles[] = new Nelmio\ApiDocBundle\NelmioApiDocBundle(); // <-- ADDED HERE
$bundles[] = new Symfony\Bundle\DebugBundle\DebugBundle();
...
To eliminate the config errors, I had to move the following stuff out of app/config/config.yml and into config_dev.yml:
# nelmio Configuration
nelmio_api_doc:
sandbox:
enabled: true
name: 'DLAP API Bridge'
swagger:
...
cache:
enabled: false
Likewise, the following stuff came out of app/config/routing.yml and moved to routing_dev.yml:
NelmioApiDocBundle:
resource: "#NelmioApiDocBundle/Resources/config/routing.yml"
prefix: /api/doc
nelmio_api_swagger:
resource: "#NelmioApiDocBundle/Resources/config/swagger_routing.yml"
resource: null
prefix: /api-docs

Answer 2

Now with symfony4 and flex you can install the bundle normally
composer require nelmio/api-doc-bundle
(So it won't be set as a require-dev depandency in your composer.json)
Now you change the setting in the project/config/bundles.php to:
Nelmio\ApiDocBundle\NelmioApiDocBundle::class => ['dev' => true]
So you don't get errors (eg from annotations), but it wont be loaded from Kernel.php

Answer 3

For disabling the Nelmio api-doc-bundle on specific environment, after some investigation, I ended up doing the following:
only enable the bundle on your target environment, i.e. on project/config/bundles.php have:
Nelmio\ApiDocBundle\NelmioApiDocBundle::class => ['dev' => true]
put the config annotation on env specific (put nelmio_api_doc.yaml inside ./config/packages/dev/)
put the route file nelmio_api_doc.yaml inside ./config/routes/dev (instead of being in the ./config/routes), otherwise, if you call the route for another environment which doens't have the bundle loaded, instead of 404, you will see 500)

Answer 4

not loading the bundle in config/bundles.php throws an exception in Symfony 4.3 with NelmioApiDocBundle Version 3:
There is no extension able to load the configuration for "nelmio_api_doc"
I ended up disabling the route for the api docs with a redirect in the environment, which needed to be disabled (prod):
#config/routes/prod/nelmio_api_doc.yaml
app.swagger:
path: /api/doc.json
methods: GET
defaults:
_controller: FrameworkBundle:Redirect:urlRedirect
path: /
permanent: true
app.swagger_ui:
path: /api/doc
methods: GET
defaults:
_controller: FrameworkBundle:Redirect:urlRedirect
path: /
permanent: true