GRgreenleafjacob·Dec 29, 2014
I looked around for best practices regarding how to manage configuration around credentials like secrets, tokens, etc. John Resig talks about both approaches - the one you mentioned, and my approach [1].
The major downfall of the approach is that configuration files, regardless of whether they contain secrets or not, tend to be exactly the kind of thing you want in source control. Maybe not the same repository, but having the files in source control has nice properties like keeping it up to date across servers. There are even tools [2] to validate a configuration file that you end up creating, because the real file (in Resig's example, settings.json) is usually in gitignore and outside of source control. Why not keep it in source control? Heroku suggests [4] using their proprietary configuration management system. This is a simple open s
Read the rest
ource way to do so with no configuration management system required and almost no overhead.
I don't like that approach because it's easy to get the settings sample JSON out of date, and moreover I don't like the fact that the settings files themselves aren't under source control. Why not?
This [3] stack overflow post goes over a few approaches and I agree - "Public Key Cryptography is the most flexible answer."
[1] http://ejohn.org/blog/keeping-passwords-in-source-control/
[2] https://github.com/jkassemi/conf_conf
[3] http://programmers.stackexchange.com/a/163792
[4] https://devcenter.heroku.com/articles/config-vars