Where .env Went Wrong

ctippett•12 minutes ago

I'm sure there are many better alternatives to .env, but its ubiquity and support across various tools makes it super convenient.

I'm using 1Password's .env integration[1] and although the UX is a bit clunky, I really like it. My API keys are secure, tools that ordinarily support .env just work and there's a team-sharing feature too (although I'm yet to use it). It's pretty neat.

[1] https://www.1password.dev/environments

theozero•about 1 hour ago

Over at varlock (https://varlock.dev -- also free, open source), we agree that .env as we know it is full of problems. But instead of abandoning it, we evolved it. We replace your .env.example with a .env.schema - using decorator style comments to add schema info, and functions to load and compose values.

A big difference between our tool and many other similar tools is that we combine the schema and value setting into one surface, with a way of merging many definitions together, much like cuelang - but in a way that feels more intuitive. It's extremely flexible, and can even do credential brokering for untrusted workloads.

I've been enjoying the secretspec content lately, and watching it evolve :)

cyanregiment•about 1 hour ago

It's too bad they call background services "agents" now instead of daemons like they used to, because your slogan could be Secrets for daemons

Varlock is clever. Sub string types for .envs pretty cool, why not

c-hendricks•about 1 hour ago

Also mise: https://mise.jdx.dev/environments/

kstrauser•about 1 hour ago

Seconded. I've also had great luck with the same author's fnox secret manager, especially because you can tell it to fetch some secrets from the user's laptop's OS keychain, and some out of 1Password, and some out of AWS KMS, and some out of [probably your own favorite provider (https://fnox.jdx.dev/providers/overview)].

domenkozar•42 minutes ago

fnox is mostly a copy of secretspec (and it's good to have one!), so you'll find the same kind of support in both. I wish instead we'd collaborate with Jeff, but oh well.

The difference is that we're providing an interface for applications to build with, with 8 SDKs available so you can have first-class support for secrets whatever you're bulding. I do hope fnox copies that too!

kstrauser•7 minutes ago

You keep saying that but I disagree strongly. Having looked at both fnox and secretspec, there are some obvious similarities because they're both in the same space, interacting with many of the same tools, and there are only so many ways to declaratively state "set the FOO variable with the 'my_secret_key' value out of the Bar provider".

Those inherent similarities aside, I don't see it. They don't seem to have a lot in common as far as design or implementation or configuration.

qntty•about 1 hour ago

I use Pydantic Settings for this, would be nice to see a comparison to that. I do like the idea of keeping this in a configuration file.

domenkozar•about 1 hour ago

Two things:

- Secrets don't belong in config https://secretspec.dev/blog/secrets-dont-belong-in-config/

- You want to have flexibility of choosing between any secrets provider: https://secretspec.dev/blog/but-i-use-sops/

triyambakam•about 1 hour ago

Yeah Pydantic Settings is pretty nice

jonny_eh•about 1 hour ago

Also: https://varlock.dev/

tosti•about 1 hour ago

One could also... Not jump on the bandwagon?

(Am I getting thrown out the window now? :)

Natfan•about 1 hour ago

Claude, find a key underpinning of most development workflows, then make a product to disrupt (and eventually SaaSify/enshitify) it. Finally, write a convincing ad disguised blog post, and purchase a fancy domain. Here's my credit card.

theozero•about 1 hour ago

While there are absolutely a million of these env tools popping up which are total vibe-coded slop, secretspec is not one of them. It's from the creator of https://devenv.sh and has been around for a while.

domenkozar•about 1 hour ago

Don't take the black pill <3

Where .env Went Wrong

⚡ Community Insights

Discussion (16 Comments)Read Original on HackerNews