# Configuration, Environments and Secrets

# Configuration

A way to easily find and change the behavior of a program based on different intentions by changing the values of appropriate variables.

For example:

• Finding and changing the number of threads used by a program.
• Finding and changing the database URL used by a program.

So, configuration should be:

• Composed of variables and their values.
• Easy to find.
• Easy to change.

# Environments

A collection of values for different configuration variables defining a particular intention.

For example:

• A development environment containing a set of values for database URL, number of threads etc. that are tuned for serving the developer.
• A production environment containing a set of values for database URL, number of threads etc. that are tuned for serving the users.

So, environments should be:

• Composed of values for different configuration variables, including secrets.
• Properly isolated and protected.
• Easy to provision, but not very easy to change, as changing one value means changing the entire environment i.e. changing the intention.

# Secrets

Values that are not meant to be shared with the world.

For example:

• Database URL.

So, secrets should be:

• Encrypted.

# Combining All 3

• Configuration variables should be public and easy to find i.e. defined in the codebase of the program as a single source of truth, i.e. one single file.
• Values for configuration variables should either be public (defined in the codebase), or should come from the environment.
• Values that are defined in the codebase should not contain plain text secrets, but may contain encrypted secrets.
• Values that are defined in the environment should preferebly serve as switches, and may contain secrets.
• Environments should be encrypted, isolated and protected as they may contain secrets and access to critical services.

# Proof of Concept

• For each program, create a file containing all the configuration variables related to that particular program.
• The value of each variable should be either defined directly, or defined conditionally based on the environment. Example:

  number_of_threads = 10
  database_url = match env:
    case "dev": "dev_url"
    case "prod": environment.decrypt("prod_url")
    else: "default_url"
  copy success
  copy

  See https://github.com/sayanarijit/enva
• Secret values or master password should come from the environment.
• If there is a common configuration defined separately in a common repo, only import the values, and define the variables explicitly for each program. So that it's easy to find.
• Define the environment specific values in the environment variables (/etc/environment). They are easy to provision, but requires reboot to change.
• Define secrets in git synced vault, with the master password defined as environment variable, or as a restricted file in user's home directory.
• Harden security of each environment.

# Python implementation

# settings.py

import os
from pathlib import Path
from typing import Callable, TypeVar

T = TypeVar("T")

def env(**kwargs: T | Callable[[], T]) -> T:
    val = kwargs[ENVIRONMENT]
    return val() if callable(val) else val

def readfile(path: str | Path, type_: Callable[[str], T] = str) -> Callable[[], T]:
    return lambda: type_(Path(path).read_text().strip())


ENVIRONMENT = os.environ.get("ENVIRONMENT", "dev")

DATABASE_URL = env(
    dev="dev_url",
    prod=readfile("/home/user/secrets/database_url"),
)
copy success
copy