6 ms·
pro-tip: don't use .env files. They're a hack anyway.
by withinboredom 2y ago
pro-tip: don't use .env files. They're a hack anyway.
- 383toast 2y agoWhat do you use instead???
- falconertc 2y agoTools like direnv gets .env files out of repo paths and improves things a lot. You can integrate secrets management in code, but with that there's still no getting away with the assumption that some kind of auth mechanism exists in your env
- prophesi 2y agoWouldn't direnv just mean it will now send up your .envrc file? I think what would work even better is combining direnv with pass[0] so that if it does get uploaded, it will be encrypted. ie: export SECRET_KEY=$(pass work/secret_key) [0] https://www.passwordstore.org/ https://www.passwordstore.org/
- threatofrain 2y agoOne might use a variation on the idea, like how 1Password does it. Everything in your .env is just a pointer so it's safe to commit.
- anshumankmr 2y agohashicorp vault + launch.json on VSCode
- withinboredom 2y agoboring configuration files in ~/.config
- nunez 2y agoI disagree. Almost every application out there supports environment variables for configuration, and every language supports reading data from the environment. dotenvs are a clean and lightweight way of using this pattern that works regardless of tech stack. If the language doesn't have a library for loading dotenvs, you can usually write a simple library for it with a few lines of code. In Golang-land, this is much easier than having to boilerplate your way through a Config interface with a Config struct for defining the YAML schema, though I suppose this is a non-issue with LLMs now. Ensuring that plain-text dotenvs aren't in gitignore and that encrypted dotenvs are can be enforced with client-side Git hooks, which are painless to set up, in my opinion. That said, I mostly use sops with PGP these days. YAML is more expressive than dotenv, though sops works well with dotenvs. I would recommend sops + Vault for enterprise scenarios.
- withinboredom 2y ago> Almost every application out there supports environment variables for configuration It didn't used to be that way, surprisingly. Most configuration was done via files using INI. Then people started using JSON, and now YAML -- if they have a configuration file at all. Containers pretty much required using environment for configuration because it was the only way to "inject" configuration before we got volumes and fancy stuff like secrets. That doesn't make it any less of a hack instead of a proper configuration format.
- nunez 2y agoInteresting! I thought the concept of environment variables was a Linux kernel primitive used by apps since forever. Admittedly, my first experience with computers was on Windows.