Hacker News Reader

Why don't more people keep configuration / api keys / etc in the database?

1. Your configuration is backed up along with your data.

2. You can share configuration with multiple applications easily.

3. Use postgresql's LISTEN/NOTIFY to tell your applications about new configuration changes in real-time.

4. Your configuration is as secret as your data.

If you're vulnerable to a sql injection or something similar, though, then you've potentially made all of that data web accessible.

If you are vulnerable to sql injection, you are completely screwed anyways.

that's probably true.

Where do you store the configuration for where and how to access the configuration database?

That's the only thing I keep as an env var (as DATABASE_URL: ie "postgres://monkey:pass@localhost/tanga_dev")