"Config Management" means something else to systems folks. Suggest adding "for node projects" or something akin to the title to clarify.
Show HN: From dotenv to dotenvx – better config management
11–20 of 223 posts
Re: Show HN: From dotenv to dotenvx – better config management
#12"Config Management" means something else to systems folks. Suggest adding "for node projects" or something akin to the title to clarify.
[deleted]
Re: Show HN: From dotenv to dotenvx – better config management
#13Secrets in env vars in production is not too secure either, ideally you’ll move to your app pulling secrets in-process from your infrastructure at boot-up or upon use. This also gives a nice advantage of not needing to rebuild the app or container or whatever to rotate a secret.
Re: Show HN: From dotenv to dotenvx – better config management
#14I don't get it. Dotenv is only good for local dev. Otherwise you should put your secrets in environment variables (the "env" in ".env"). That people put .env files in prod is a mistake itself, and the proposed fixes here seem to not really do much about that.
Just set those env vars in your IDE. Let your IDE or docker-compose or whatever read an .env file if you must. But don't do it directly from your application code, indeed you're one lazy dev away from putting an .env file on prod servers. Using dotenv-like constructions is, in my eyes, an antipattern.
And it need not even be an IDE. Whatever environment you use for development, set environment variables in that.
Re: Show HN: From dotenv to dotenvx – better config management
#15There's a typo in the article, if the author reads this :
> But I think we have a solution to all three today - with dotenvx. In reverse problem order
The URL in `dotenvx` points to https://gitub.com/dotenvx/dotenvx (gitub without the h)
Re: Show HN: From dotenv to dotenvx – better config management
#16Secrets in env vars in production is not too secure either, ideally you’ll move to your app pulling secrets in-process from your infrastructure at boot-up or upon use. This also gives a nice advantage of not needing to rebuild the app or container or whatever to rotate a secret.
This just moves the problem to a different step. How are you going to manage access to said secrets, especially when your application lives off premises?
Re: Show HN: From dotenv to dotenvx – better config management
#17Seems odd to announce new features without calling out to the fact that libraries with the same name in other languages have had those same features for years. (for example, the dotenv gem in Ruby)
Node.js already has built in support for .env https://nodejs.org/en/blog/release/v20.6.0#built-in-env-file...
True, but the dotenv npm package has been around much longer than that support (11 years vs 9 months), and the .env support in Node doesn't yet support features like auto-inclusion of environment-specific files.
Re: Show HN: From dotenv to dotenvx – better config management
#18I don't get it. Dotenv is only good for local dev. Otherwise you should put your secrets in environment variables (the "env" in ".env"). That people put .env files in prod is a mistake itself, and the proposed fixes here seem to not really do much about that.
> Dotenv is only good for local dev.
It wouldn't surprise me if many VPS use .env files.
Re: Show HN: From dotenv to dotenvx – better config management
#19I don't get it. Dotenv is only good for local dev. Otherwise you should put your secrets in environment variables (the "env" in ".env"). That people put .env files in prod is a mistake itself, and the proposed fixes here seem to not really do much about that.
[deleted]
Re: Show HN: From dotenv to dotenvx – better config management
#20Seems odd to announce new features without calling out to the fact that libraries with the same name in other languages have had those same features for years. (for example, the dotenv gem in Ruby)
[deleted]