Where .env Went Wrong

theozero•about 1 hour ago

Over at varlock (https://varlock.dev -- also free, open source), we agree that .env as we know it is full of problems. But instead of abandoning it, we evolved it. We replace your .env.example with a .env.schema - using decorator style comments to add schema info, and functions to load and compose values.

A big difference between our tool and many other similar tools is that we combine the schema and value setting into one surface, with a way of merging many definitions together, much like cuelang - but in a way that feels more intuitive. It's extremely flexible, and can even do credential brokering for untrusted workloads.

I've been enjoying the secretspec content lately, and watching it evolve :)

cyanregiment•44 minutes ago

It's too bad they call background services "agents" now instead of daemons like they used to, because your slogan could be Secrets for daemons

Varlock is clever. Sub string types for .envs pretty cool, why not

c-hendricks•about 1 hour ago

Also mise: https://mise.jdx.dev/environments/

kstrauser•about 1 hour ago

Seconded. I've also had great luck with the same author's fnox secret manager, especially because you can tell it to fetch some secrets from the user's laptop's OS keychain, and some out of 1Password, and some out of AWS KMS, and some out of [probably your own favorite provider (https://fnox.jdx.dev/providers/overview)].

domenkozar•39 minutes ago

fnox is mostly a copy of secretspec (and it's good to have one!), so you'll find the same kind of support in both. I wish instead we'd collaborate with Jeff, but oh well.

The difference is that we're providing an interface for applications to build with, with 8 SDKs available so you can have first-class support for secrets whatever you're bulding. I do hope fnox copies that too!

kstrauser•5 minutes ago

You keep saying that but I disagree strongly. Having looked at both fnox and secretspec, there are some obvious similarities because they're both in the same space, interacting with many of the same tools, and there are only so many ways to declaratively state "set the FOO variable with the 'my_secret_key' value out of the Bar provider".

Those inherent similarities aside, I don't see it. They don't seem to have a lot in common as far as design or implementation or configuration.

qntty•about 1 hour ago

I use Pydantic Settings for this, would be nice to see a comparison to that. I do like the idea of keeping this in a configuration file.

domenkozar•about 1 hour ago

Two things:

- Secrets don't belong in config https://secretspec.dev/blog/secrets-dont-belong-in-config/

- You want to have flexibility of choosing between any secrets provider: https://secretspec.dev/blog/but-i-use-sops/

triyambakam•about 1 hour ago

Yeah Pydantic Settings is pretty nice

Natfan•about 1 hour ago

Claude, find a key underpinning of most development workflows, then make a product to disrupt (and eventually SaaSify/enshitify) it. Finally, write a convincing ad disguised blog post, and purchase a fancy domain. Here's my credit card.

theozero•about 1 hour ago

While there are absolutely a million of these env tools popping up which are total vibe-coded slop, secretspec is not one of them. It's from the creator of https://devenv.sh and has been around for a while.

domenkozar•44 minutes ago

Don't take the black pill <3

jonny_eh•about 1 hour ago

Also: https://varlock.dev/

Where .env Went Wrong

⚡ Community Insights

Discussion (8 Comments)Read Original on HackerNews