Why I hate Dotenv ?
Published: 2023-09-23 23:04:21

I have built FREE tool to deal with this problem. [link](https://www.envvaults.com/)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2kxmfjxoy7pa5l4oix8q.jpg)

Hi developers 👋🏼 I have been using NodeJS for couple of years but still I feel managing environment variables, especially in production, is a daunting task.

What should I do ? Should I add env variables to docker build command ? Should I add env variables in GitHub Secrets ? OR Should I ssh into ec2 and create `.env` file 😓

So lets address this problem…

**1. The Problem with Dotenv**
Dotenv is a moat popular package used by 30M+ developers to load environment variables from a `.env` file into the process environment. While it simplifies the process, it has its limitations:

- _Lack of Security_: Dotenv relies on plaintext .env files, which can expose sensitive information if not handled carefully. (like committing it to GitHub 🤯)

- _Limited Functionality_: It doesn’t provide an solution for production environment.

- _Inflexible Configuration_: Dotenv lacks flexibility when it comes to managing different configurations for different environments (development, staging, production).

**What I dont want ?**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ivv77ja56aay51mmlfxk.jpg)

**But there will be some solution created by Big Cloud Giants ? Right ?** 
Yes. but…

Azure — costs `1$ per key per month` with additional per api call charges

GCP — almost `0.5$ per key per month` (gcp has most complicated pricing tier I have ever seen)

AWS — costs `0.8$ per key per month` with additional api call charges

i.e. I need to pay at least a **dollar/month to just store NODE_ENV=production 🤔**

**then why cant I use GitHub Secrets ? Its FREE.. is it ?**
This is the best solution for managing env variables is out there. but still its free tier lacks environment specific secrets manager. (Yeah Im indie hacker and cant afford to buy $20/month Plan)

& I dont want to manage this sh*t..

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oebdhzugbs3yf34vpobs.png)

**Then What To Do ?**

> If there is no solution, then best solution is to build the solution.

What if there is npm package which —

- does everything dotenv does &
- in development loads from .env file
- in production checks for .env files or else loads it from cloud without any major configuration
- there is easy and secure way to access, modify, delete environments.
- & is cheap.

**So Finally what I built ?**

1. simple nodeJS implementation. (_envvaults npm package — wrapper around dotenv_)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m01kuvo7mz38q6v36nls.png)

2. Web Dashboard to manage .envs
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6o8fd62nvv7kph182nuk.png)

3. VS Code extension to manage .envs from VS Code (WHY NOT?)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uerqoxwv6etv0g65blvv.png)

4. What about security ? Okay.. Lets implement what Github Secrets is using 😘. [Libsodium sealed boxes](https://libsodium.gitbook.io/doc/bindings_for_other_languages) added

**But how will it load .env in production ?**
envvaults npm package requires 2 predefined env variables- **EV_AID** & **EV_KEY**. with these 2 env variables _it will fetch all remaing variables defined inside “VAULT”_.

> EV_AID is account ID and EV_KEY is secret key for specific vault.

**How can you use this ?**
step 1. install npm package => **npm i envvaults**

step 2. create account on [this link](https://app.envvaults.com/)

step 3. access inside VS Code using [this link](https://marketplace.visualstudio.com/items?itemName=omkarbhede.envvaults)

Done!! Now lets get back to writing code 😤