Environment Variables and Configuration

Challenge

Your application needs different configurations for development, staging, and production. You need to securely manage sensitive data like API keys and database credentials. How do you organize this?

Explanation

Environment variables are the standard way to configure Node.js applications. Using .env files during development and environment variables in production is a best practice.

Solution: Environment Management

// .env file
DATABASE_URL=postgresql://localhost/mydb
API_KEY=your-secret-key-here
NODE_ENV=development
LOG_LEVEL=debug

// Load .env file (using dotenv package)
require('dotenv').config();

// Access environment variables
const dbUrl = process.env.DATABASE_URL;
const apiKey = process.env.API_KEY;
const env = process.env.NODE_ENV || 'development';

// Validate required variables
const required = ['DATABASE_URL', 'API_KEY'];
const missing = required.filter(key => !process.env[key]);

if (missing.length > 0) {
  throw new Error(`Missing required env vars: ${missing.join(', ')}`);
}

Configuration Management

config/index.js

module.exports = {
  development: {
    database: 'sqlite::memory:',
    cacheEnabled: false,
    logLevel: 'debug'
  },
  staging: {
    database: process.env.DATABASE_URL,
    cacheEnabled: true,
    logLevel: 'info'
  },
  production: {
    database: process.env.DATABASE_URL,
    cacheEnabled: true,
    logLevel: 'warn',
    ssl: true
  }
};

// app.js
const config = require('./config')[process.env.NODE_ENV || 'development'];
console.log('Database:', config.database);
console.log('Cache enabled:', config.cacheEnabled);

Secrets Management

.gitignore

.env
.env.local
.env.*.local

// Use different .env files per environment
.env                    # Shared defaults
.env.development        # Dev overrides
.env.production          # Prod overrides (NOT in git)
.env.example            # Template for required vars

// Accessing secrets safely
const apiKey = process.env.API_KEY;
if (!apiKey) {
  throw new Error('API_KEY not configured');
}

// Never log secrets
console.log({ apiKey: '***' }); // Good
console.log({ apiKey }); // Bad