Where .env Went Wrong

c-hendricks a day ago | parent | next [-]

Also mise: https://mise.jdx.dev/environments/

Seconded. I've also had great luck with the same author's fnox secret manager, especially because you can tell it to fetch some secrets from the user's laptop's OS keychain, and some out of 1Password, and some out of AWS KMS, and some out of [probably your own favorite provider (https://fnox.jdx.dev/providers/overview)].

▲

domenkozar a day ago | parent [-]

fnox is mostly a copy of secretspec (and it's good to have one!), so you'll find the same kind of support in both. I wish instead we'd collaborate with Jeff, but oh well.

The difference is that we're providing an interface for applications to build with, with 8 SDKs available so you can have first-class support for secrets whatever you're bulding. I do hope fnox copies that too!

	▲	kstrauser a day ago \| parent [-]
		You keep saying that but I disagree strongly. Having looked at both fnox and secretspec, there are some obvious similarities because they're both in the same space, interacting with many of the same tools, and there are only so many ways to declaratively state "set the FOO variable with the 'my_secret_key' value out of the Bar provider". Those inherent similarities aside, I don't see it. They don't seem to have a lot in common as far as design or implementation or configuration.

▲

theozero a day ago | parent | prev | next [-]

Over at varlock (https://varlock.dev -- also free, open source), we agree that .env as we know it is full of problems. But instead of abandoning it, we evolved it. We replace your .env.example with a .env.schema - using decorator style comments to add schema info, and functions to load and compose values.

A big difference between our tool and many other similar tools is that we combine the schema and value setting into one surface, with a way of merging many definitions together, much like cuelang - but in a way that feels more intuitive. It's extremely flexible, and can even do credential brokering for untrusted workloads.

I've been enjoying the secretspec content lately, and watching it evolve :)

	▲	cyanregiment a day ago \| parent [-]
		It's too bad they call background services "agents" now instead of daemons like they used to, because your slogan could be Secrets for daemons Varlock is clever. Sub string types for .envs pretty cool, why not

▲

eigencoder a day ago | parent | prev | next [-]

Hm, I haven't seen these issues personally. We only have one `.env` file and it's just for local secrets. Configuration emphatically does not go in `.env` and ideally is in docker compose and defined in code (we use Pydantic Settings).

▲

qntty a day ago | parent | prev | next [-]

I use Pydantic Settings for this, would be nice to see a comparison to that. I do like the idea of keeping this in a configuration file.

▲

domenkozar a day ago | parent | next [-]

Two things:

- Secrets don't belong in config https://secretspec.dev/blog/secrets-dont-belong-in-config/

- You want to have flexibility of choosing between any secrets provider: https://secretspec.dev/blog/but-i-use-sops/

	▲	eigencoder a day ago \| parent \| next [-]
		But secrets are a kind of configuration, right? I agree they should be kept separate from non-secret config; ideally non-secret configuration can be committed to your codebase somewhere depending on the environment it's running in.
	▲	tomjakubowski a day ago \| parent \| prev [-]
		pydantic-settings is not limited to loading from config files. It is easy to populate a settings model from environment variables, for example. With a little bit of glue code it could load from the secretspec sdk.

▲

triyambakam a day ago | parent | prev [-]

Yeah Pydantic Settings is pretty nice

▲

ctippett a day ago | parent | prev | next [-]

I'm sure there are many better alternatives to .env, but its ubiquity and support across various tools makes it super convenient.

I'm using 1Password's .env integration[1] and although the UX is a bit clunky, I really like it. My API keys are secure, tools that ordinarily support .env just work and there's a team-sharing feature too (although I'm yet to use it). It's pretty neat.

[1] https://www.1password.dev/environments

▲

jonny_eh a day ago | parent | prev | next [-]

Also: https://varlock.dev/

▲

Natfan a day ago | parent | prev | next [-]

Claude, find a key underpinning of most development workflows, then make a product to disrupt (and eventually SaaSify/enshitify) it. Finally, write a convincing ad disguised blog post, and purchase a fancy domain. Here's my credit card.

▲

theozero a day ago | parent | next [-]

While there are absolutely a million of these env tools popping up which are total vibe-coded slop, secretspec is not one of them. It's from the creator of https://devenv.sh and has been around for a while.

	▲	domenkozar a day ago \| parent [-]
		<3

▲

domenkozar a day ago | parent | prev [-]

Don't take the black pill <3

▲

tosti a day ago | parent | prev [-]

One could also... Not jump on the bandwagon?

(Am I getting thrown out the window now? :)

	▲	hagbard_c 20 hours ago \| parent [-]
		The Doppler effect on your last words seems to confirm you just did.