Managing Secrets with Doppler in Django
Tags: security, django
Published: 2021-10-02 05:13:11

Using `.env` files to manage application config and secrets is a step forward from hard-coding secrets, but there are also security risks and issues relating to the synchronization and manual management of `.env` files across different environments. This tutorial introduces [Doppler](https://www.doppler.com/), a solution to secret management and synchronization.

## Overview	
In this article, we have a Django application that has its secrets defined in a `.env` file. We will look at how we can move those secrets from the traditional `.env` file to Doppler.

## Doppler — a universal secrets manager
Managing secrets and configs in Doppler keeps them in sync across different environments. You only have to define your secrets once and Doppler acts as a central source of truth for your secrets, saving you the stress of having to re-define them in every environment or share them to team members, probably over unsecured channels.

Doppler has a CLI that provides easy access to secrets in every environment from local development to production and a single dashboard makes it easy for teams to centrally manage app configuration for any application, platform, and cloud provider.

## Why use Doppler?
- Security of App configs and Secrets.
- Boosts Productivity by not having to manually manage `.env` files across different environments and cloud providers.
- Keeps all secrets in sync across devices, environments, and team members.

These are just some of the reasons why we should adopt the use of Doppler in our Projects.

## Using Doppler in a Django app
In this section we will demonstrate how we can use Doppler to manage secrets in Django. Here, we have a blog app that has its secrets defined in a `.env` file, we will be moving those secrets over to Doppler.

### App Structure
Here is the file structure of the root folder of our Django app.
```plaintext
+--blog
+--images
+--proj_blog
+--.env
+--.gitignore
+--manage.py
+--requirements.txt
```

Our main interest here is the `.env` file which contains all the secrets of the app. The `.env` file looks something like this:

```plaintext
SECRET_KEY = ajdflkmdjoiejmoaidjfamlamlddga2353
SENDGRID_KEY = supersecretkey
DATABASE_NAME = postgresdatabase
DATABASE_USER = tammibriggs
DATABASE_PASS = supersecretpassword
```

### Getting started with Doppler
To start using Doppler, the first step is to [create an account](https://dashboard.doppler.com/register). After doing that, we will be prompted to create a workplace. Give the workspace a preferred name and then click on the  **Create Workplace button**.

![name your workplace](https://paper-attachments.dropbox.com/s_2AF5889E38548E08F15A95610CAB46E1BEC5A83ECFBDC383F7690245CC08981B_1632768916650_Screenshot+102.png)

### Creating a project
A project in Doppler is where app configs and secrets are defined. Doppler comes with a default project called  **example-project** but we can create another by clicking on the plus(+) button. 

![projects](https://paper-attachments.dropbox.com/s_2AF5889E38548E08F15A95610CAB46E1BEC5A83ECFBDC383F7690245CC08981B_1632775719855_Screenshot+103.png)

Click on the plus(+) button and create a new project. In my case, I named my project **blog_project** but you can give yours any other name.

![create a project](https://paper-attachments.dropbox.com/s_2AF5889E38548E08F15A95610CAB46E1BEC5A83ECFBDC383F7690245CC08981B_1632778946629_Screenshot+105.png)

Once we have created the project, Doppler will provide us with three environments which are:
- Development
- Staging
- Production

We can use these environments to manage our secrets for the three different stages of our app.

![environments](https://paper-attachments.dropbox.com/s_2AF5889E38548E08F15A95610CAB46E1BEC5A83ECFBDC383F7690245CC08981B_1632779453188_Screenshot+106.png)


### Installing Doppler CLI
There are different commands used to install the CLI based on the operating system. I’m using windows but you can look at [Doppler’s installation guide](https://docs.doppler.com/docs/cli) to help out with installation on other operating systems.

```powershell
# Add Doppler's scoop repo
scoop bucket add doppler https://github.com/DopplerHQ/scoop-doppler.git

# Install latest doppler cli
scoop install doppler
```

If you run into any problems, [this article](https://dpkreativ.hashnode.dev/how-to-set-up-dopplers-cli-on-windows-10) will be of help.
After running the command, we can check if the installation was successful by running:

```powershell
doppler --version
```

Now, we need a way for our local machine to authenticate with Doppler. We can do that with this command:

```powershell
doppler login
```

We will be asked to open a browser window, where we will authenticate with our email, then an auth token to log in will appear in our terminal which we can use to authenticate Doppler.

![command line authentication](https://paper-attachments.dropbox.com/s_2AF5889E38548E08F15A95610CAB46E1BEC5A83ECFBDC383F7690245CC08981B_1632860268320_Screenshot+108.png)

Next, we will be asked to name our token. After doing that if we check our terminal, we can see we have received a welcome message.


## Managing secrets with Doppler
It is time that we moved our secrets defined in the `.env` over to Doppler.
Head over to the **blog_project** we created earlier on Doppler and click on **dev**.

![dev environment](https://paper-attachments.dropbox.com/s_2AF5889E38548E08F15A95610CAB46E1BEC5A83ECFBDC383F7690245CC08981B_1632861596022_Screenshot+113.png)
 
We have been provided with two options on how we can add our secrets. We are going to use the second which is **import Secrets** because when using it all we have to do is to copy and paste our secrets rather than manually writing our secrets if we use **Add First Secret**.
 
![import secrets](https://paper-attachments.dropbox.com/s_2AF5889E38548E08F15A95610CAB46E1BEC5A83ECFBDC383F7690245CC08981B_1632862864865_Screenshot+116.png)
 
After we have copied and pasted our secrets, click on the **Import Secrets** button, to import our secrets.

![dev environement](https://paper-attachments.dropbox.com/s_2AF5889E38548E08F15A95610CAB46E1BEC5A83ECFBDC383F7690245CC08981B_1632864098450_Screenshot+118.png)

Click on the **Save** button at the top right of the page to save the imported keys.
Now, in our terminal let's run the setup command to configure Doppler

```powershell
doppler setup
```

We choose the project we are working on which is **blog_project** and select the environment, in this case, the **dev** environment.
We can now run our Django app, but instead of the regular way which is `python manage.py runserver`, we will use:

```powershell
doppler run -- python manage.py runserver
```

What this command does is it fetches the latest secrets that we stored in Doppler and injects them as environmental variables. Now we can delete the `.env` file from our project and everything will still work perfectly.

## Conclusion
Doppler is a better way of managing secrets than using `.env` files. This article introduced us to the solution Doppler provides to secret synchronization and security. We have also demonstrated how we can start using Doppler in Django.
The solution Doppler provides is amazing, it's high time we say Goodbye to `.env` files.