That looks like an overly complicated solution to a problem that doesn't exist. Synching stuff that is in git? Why not just use.... git?
Also npm.... and the example has an env var named "DB_PASS" in it. You never put passwords in version control.
It is generally considered a bad idea to use envs for passing secrets in general since envs for process n are available to other processes which have access and permission.
Exactly, you never check passwords into version control.
So what happens when you need to share those values with other team members?
The github example is not to put a .env file into a repo but to add the secrets to github’s native secret manager, which is what products like actions use to read envs.
10 Comments
cr1cket@sopuli.xyz · 17 pts · 1y
Oh wow.
That looks like an overly complicated solution to a problem that doesn't exist. Synching stuff that is in git? Why not just use.... git? Also npm.... and the example has an env var named "DB_PASS" in it. You never put passwords in version control.
dragonfly4933@lemmy.dbzer0.com · 5 pts · 1y
It is generally considered a bad idea to use envs for passing secrets in general since envs for process n are available to other processes which have access and permission.
TheCommieAxolotl@programming.dev · 0 pts · 1y
Exactly, you never check passwords into version control. So what happens when you need to share those values with other team members? The github example is not to put a .env file into a repo but to add the secrets to github’s native secret manager, which is what products like actions use to read envs.
Boomkop3@reddthat.com · 9 pts · 1y
Environment variable abuse
mehdi_benadel@lemmy.balamb.fr · 7 pts · 1y
Waiting for the leak announcements
bizdelnick@lemmy.ml · 4 pts · 1y
The best way to manage environment variables: don't use environment variables.
PolarKraken@programming.dev · 6 pts · 1y
What do you do instead for dynamic values that are needed at runtime and inappropriate to check in to version control?
thedeadwalking4242@lemmy.world · 1 pts · 1y
Config files, key store services with real permission controls
bizdelnick@lemmy.ml · 0 pts · 1y
I'd rather prefer CI-level variables (macros?) that are not exported to the environment. Unfortunately, most CI developers don't care about security.
Corbin@programming.dev · 3 pts · 1y
Nah, just use direnv instead, comrade.
chonkyninja@lemmy.world · -4 pts · 1y