Hacker News Reader

Comment by diggan | Hacker News Reader

I'm not sure if I understood something wrong, but .env files are for development, not production. It never crossed my mind to use .env files for production deployments, but skimming the blog post, it seems like people do ship a .env file to their production environment?

View on HN

SRE here, most of time when that happens, it's people leaving .env in git where it's not ignored and build process just does COPY * * to runtime environment.

EDIT: Or it's just small time developers who don't care about security and ship whatever works.

Hidden files get checked/built in all the time. Too many people don’t think to look for them.

That is why I like "Allow Listing" in my .gitignore file. Much harder to add stuff by accident.

# Ignore everything

# But not these files...

!/.gitignore

!*.go

!go.sum

!go.mod

I do the same. But as I do it my mental image of myself is of someone holding their nose and typing one handed.

It’s the least shit solution, but it’s definitely a shit solution.

Npm has another way to default exclude but I don’t think git does, and if docker got one I don’t recall what it is.

> it's people leaving .env in git

Ah, makes sense it could get exposed then.

The pattern I've always followed is having `.env.template`, `.env.dev` or similar in SCM, then require the development setup to manually/automatically copy it to `.env`, which is .gitignore'd.

Seems that pattern might not have been as widespread as I thought :)

I bet many .envs have been mistakenly shipped to production.

I will continue to use .envs. The alternatives invoke much more friction.

Encrypting dotenv files is a thing, I would even say it has become popular!

https://dotenvx.com

https://github.com/getsops/sops

also check out https://dmno.dev/docs/plugins/encrypted-vault/

And it's super easy to do. I used GPG with a passphrase before I adopted sops and PGP keypairs.

Just make sure that you gitignore the plain-text dotenv. That's the hard part (on a team)

Reply on news.ycombinator.com