It’s a good question and idea.

I’ve been trending towards treating secrets and non-secrets differently.

For non-secrets, I tend to have a config discovery mechanism that lets me read config from files, then from env, then from cli args as final fallback. This is mostly for ergonomics. I prefer to use files for deployed processes, and env vars or cli params when debugging or working interactively. Env vars are handy for cli args I’m going to be repeating a lot.

But for secrets I’ve tended to only fetching those from files, but allowing the file location to be specified by env var or cli arg for quick changes.

It sounds kinda complicated, but you write that logic into a library and then everything behaves the way you expect consistently.