3 ms·

I'm not sure if I understood something wrong, but .env files are for development, not production. It never crossed my mind to use .env files for production depl

by diggan 2y ago

I'm not sure if I understood something wrong, but .env files are for development, not production. It never crossed my mind to use .env files for production deployments, but skimming the blog post, it seems like people do ship a .env file to their production environment?

stackskipton 2y ago
SRE here, most of time when that happens, it's people leaving .env in git where it's not ignored and build process just does COPY * * to runtime environment. EDIT: Or it's just small time developers who don't care about security and ship whatever works.
- deleted 2y ago
  [deleted]
- hinkley 2y ago
  Hidden files get checked/built in all the time. Too many people don’t think to look for them.
  - cwbriscoe 2y ago
    That is why I like "Allow Listing" in my .gitignore file. Much harder to add stuff by accident. # Ignore everything * # But not these files... !/.gitignore !*.go !go.sum !go.mod
    - hinkley 2y ago
      I do the same. But as I do it my mental image of myself is of someone holding their nose and typing one handed. It’s the least shit solution, but it’s definitely a shit solution. Npm has another way to default exclude but I don’t think git does, and if docker got one I don’t recall what it is.
- diggan 2y ago
  > it's people leaving .env in git Ah, makes sense it could get exposed then. The pattern I've always followed is having `.env.template`, `.env.dev` or similar in SCM, then require the development setup to manually/automatically copy it to `.env`, which is .gitignore'd. Seems that pattern might not have been as widespread as I thought :)
0cf8612b2e1e 2y ago
I bet many .envs have been mistakenly shipped to production. I will continue to use .envs. The alternatives invoke much more friction.
vinnymac 2y ago
Encrypting dotenv files is a thing, I would even say it has become popular! https://dotenvx.com https://dotenvx.com https://github.com/getsops/sops https://github.com/getsops/sops
- theozero 2y ago
  also check out https://dmno.dev/docs/plugins/encrypted-vault/ https://dmno.dev/docs/plugins/encrypted-vault/
- nunez 2y ago
  And it's super easy to do. I used GPG with a passphrase before I adopted sops and PGP keypairs. Just make sure that you gitignore the plain-text dotenv. That's the hard part (on a team)

by diggan 2y ago

stackskipton 2y ago

SRE here, most of time when that happens, it's people leaving .env in git where it's not ignored and build process just does COPY * * to runtime environment. EDIT: Or it's just small time developers who don't care about security and ship whatever works.

deleted 2y ago
[deleted]
hinkley 2y ago
Hidden files get checked/built in all the time. Too many people don’t think to look for them.
- cwbriscoe 2y ago
  That is why I like "Allow Listing" in my .gitignore file. Much harder to add stuff by accident. # Ignore everything * # But not these files... !/.gitignore !*.go !go.sum !go.mod
  - hinkley 2y ago
    I do the same. But as I do it my mental image of myself is of someone holding their nose and typing one handed. It’s the least shit solution, but it’s definitely a shit solution. Npm has another way to default exclude but I don’t think git does, and if docker got one I don’t recall what it is.
diggan 2y ago
> it's people leaving .env in git Ah, makes sense it could get exposed then. The pattern I've always followed is having `.env.template`, `.env.dev` or similar in SCM, then require the development setup to manually/automatically copy it to `.env`, which is .gitignore'd. Seems that pattern might not have been as widespread as I thought :)

0cf8612b2e1e 2y ago

I bet many .envs have been mistakenly shipped to production. I will continue to use .envs. The alternatives invoke much more friction.

vinnymac 2y ago

Encrypting dotenv files is a thing, I would even say it has become popular! https://dotenvx.com https://dotenvx.com https://github.com/getsops/sops https://github.com/getsops/sops

theozero 2y ago
also check out https://dmno.dev/docs/plugins/encrypted-vault/ https://dmno.dev/docs/plugins/encrypted-vault/
nunez 2y ago
And it's super easy to do. I used GPG with a passphrase before I adopted sops and PGP keypairs. Just make sure that you gitignore the plain-text dotenv. That's the hard part (on a team)