Environment Variables Best Practices

# Set a variable
export DATABASE_URL="postgresql://user:pass@localhost:5432/mydb"

# Use in your application
echo $DATABASE_URL

# Set for a single command
DATABASE_URL="postgres://..." node server.js

# .env (never commit this!)
DATABASE_URL=postgresql://user:pass@localhost:5432/mydb
REDIS_URL=redis://localhost:6379
JWT_SECRET=dev-secret-change-in-production
STRIPE_SECRET_KEY=sk_test_xxxxx
PORT=3000
NODE_ENV=development

// Node.js
import 'dotenv/config';
console.log(process.env.DATABASE_URL);

# Python
from dotenv import load_dotenv
load_dotenv()
import os
print(os.environ['DATABASE_URL'])

# .env.example — copy to .env and fill in values
DATABASE_URL=postgresql://user:password@localhost:5432/dbname
REDIS_URL=redis://localhost:6379
JWT_SECRET=
STRIPE_SECRET_KEY=
PORT=3000
NODE_ENV=development

.env
.env.local
.env.production
.env*.local

# docker-compose.yml
services:
  app:
    image: my-app
    environment:
      - NODE_ENV=production
      - PORT=3000
    env_file:
      - .env.production

# Dockerfile — don't bake secrets into images!
# Bad:
ENV DATABASE_URL=postgresql://user:pass@db/mydb

# Good — set at runtime:
# docker run -e DATABASE_URL="..." my-app

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  NODE_ENV: "production"
  PORT: "3000"
  LOG_LEVEL: "info"

apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
type: Opaque
stringData:
  DATABASE_URL: "postgresql://user:pass@db:5432/mydb"
  JWT_SECRET: "your-production-secret"

spec:
  containers:
    - name: app
      envFrom:
        - configMapRef:
            name: app-config
        - secretRef:
            name: app-secrets

// config.ts
import { z } from 'zod';

const envSchema = z.object({
  DATABASE_URL: z.string().url(),
  JWT_SECRET: z.string().min(32),
  PORT: z.coerce.number().default(3000),
  NODE_ENV: z.enum(['development', 'staging', 'production']),
  STRIPE_SECRET_KEY: z.string().startsWith('sk_'),
});

export const env = envSchema.parse(process.env);
// Throws immediately if any variable is missing or invalid

env:
  NODE_ENV: test

jobs:
  test:
    runs-on: ubuntu-latest
    env:
      DATABASE_URL: postgresql://test:test@localhost:5432/testdb
    steps:
      - run: npm test
        env:
          JWT_SECRET: ${{ secrets.JWT_SECRET }}

# Check if .env was ever committed
git log --all -- .env

# Remove from history (if committed)
git filter-branch --force --index-filter \
  'git rm --cached --ignore-unmatch .env' HEAD

# Bad — args are visible in image history
ARG DATABASE_URL
RUN echo $DATABASE_URL > /app/config

# docker history shows the secret!

# Dev
DB_HOST=localhost

# Production
DATABASE_HOST=db.internal  # Different name!

// Bad — crashes silently with wrong behavior
const port = process.env.PORT; // undefined → app binds to nothing

// Good — explicit default
const port = parseInt(process.env.PORT || '3000', 10);