dotenv

> NOTICE: cross-env still works well, but is in maintenance mode. Which is why I recently kicked all the cross-env out of my nodejs projects and replaced it with Ruby's dotenv[0] (in projects that already used ruby alongside) and zenv[1], in Rust for projects that don't. Basically "start": "zenv --file .env.production -- node ./index.js" [0] https://github.com/bkeepers/dotenv [1] https://lib.rs/crates/zenv (readenv is an alternative, but that doesn't allow overriding the .env file)

Unfortunately, there is tooling, and a subculture that builds tooling, that uses configuration files in the same directory as the source code. Say you're deploying with cool-deploy-tool. cool-deploy-tool finds the password for the server by looking for a file called "Coolfile" in the project root. You have to create that file to use it. Now you have a footgun lying around. I associate this stuff with the Ruby community, but it's spread far and wide, notably to the Node and Go communities, which i think have large Ruby emigrant populations. As a prototypal example, consider dotenv, which began in Ruby: https://github.com/bkeepers/dotenv And has travelled to Node: https://github.com/motdotla/dotenv And Go: https://github.com/joho/godotenv

See also https://github.com/bkeepers/dotenv

I always use environment variables, you can just use ENV['AWS_S3_KEY'] or whatever in your application code. Keep the keys in your local environment, and add separate sets of keys to the staging / production environments. These files probably live in your project (.env or similar) in development but are gitignored. On production, they can be in your web-server or application configuration wherever appropriate, as long as they get loaded. If you are using a tool to manage deployment, you probably just need a step to verify on deploy the files / lines containing keys exist. I can't think of a widely-used programming language that doesn't support environment variables, though support may be less than exemplary in your language of choice. In ruby land, I use https://github.com/bkeepers/dotenv

Certainly everything in moderation - I only give letters to commands I literally type hundreds of times daily. Over the past 10 years, I've accumulated 5: b=`bundle exec`, though this is becoming less often used and I may remove it d=dotenv to easily wrap a command in environment variables (https://github.com/bkeepers/dotenv) g=git h=hub (GitHub's extensions to Git) j=autojump to move to common directories using just a few characters from their name (https://github.com/wting/autojump)

dotenv is a good way to handle such configuration problems - https://github.com/bkeepers/dotenv Just .gitignore the .env file.

The implementation varies depending on your framework and personal preferences. For development, I usually use a file named .env in the same directory as my project, and then do whatever I can to guarantee that this file won't be added to my repo (or other public places). I use .gitignore_global to exclude .env files, for instance. For production, if you're running your app on a service like Heroku, they have commands you can execute to securely set environment variables on their server (since they discourage accessing the filesystem to load the .env file). For Rails, take a look at the dotenv-rails gem. It's pretty convenient. https://github.com/bkeepers/dotenv Here is the Heroku article on the topic (might not apply directly to your situation, but the principal is key): https://devcenter.heroku.com/articles/config-vars