Discussion on "Dotenv-vault: The New Way to Manage .env"

Hoh Shen Yien · 2023-05-23T16:05:52.865Z

Sharing .env values manually through copy-pasting seems to still be the most common approach in the software industry. However, I thought we've always been boasting about our technological prowess, but why are we stuck with this old-school tradition?...

Thanks Hoh Shen Yien. I had saw it when I researched the dotenv-expand package, but I didn't pay much attention.

With this information, I'd like to try it in my future projects.

(By the way, I like your custom design much.)

Great Post Shen. Nice breakdown of things. As to your thought here:

Disclaimer: I am not sure how will dotenv and Docker work in a serverless environment (Vercel), maybe it'll retrieve it for every different server?

Checkout the .env.vault file. It is not well documented yet, but it is the future here today. Rather than syncing your secrets and scattering them across multiple 3rd parties, you include an encrypted .env.vault with your deploy, and then set a single DOTENV_KEY on your server/serverless/etc. On boot, your .env.vault file is decrypted just in time and your app runs correctly.

This new approach to security will prevent breaches like the CircleCI breach being effective.

This is an essential difference between dotenv-vault and other SecretOps solutions. It's important to us.

Thanks for the explanation, it makes a lot of sense to me now!

Also thanks for the amazing dotenv-vault, I really enjoy using it!

This looks great!!! Could be a project with huge potential.

Neat post! Just featured it.

This looks nice, will try it out for personal projects 😄, but from the article it seems it still pulls the config value which will reside in the .env file. Look at how Doppler handles it, it doesn't put the value in files. you can see the secret using command but it's mostly abstracted, and it has better integrations with all PaaS providers like vercel, heroku

Ahhh, I haven't actually heard of Doppler before, will look into it, thanks for the recommendation! 😆

Doppler is doing great work. Good to have more solutions solving this problem. BUT Doppler does write to your local machine as well. It writes to a central location on your machine - usually inside a hidden folder in your user root.

We thought about this long and hard but opted to stay 'decentralized' with project-centric .env files. Makes it more difficult if an attacker gained access to your machine. They would have to do much more work to access your secrets - iterate through all your projects on your machine. With doppler, the attacker can access a single location to find all your secrets.

Discussion

Dotenv-vault: The New Way to Manage .env

Responses(5)

Recent discussions

Search Hashnode

Dotenv-vault: The New Way to Manage .env

Responses(5)

Recent discussions