
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@lcdev/app-config
Advanced tools
Simple configuration loader for node. Comes with strong typing, schema validation, many supported file formats, secrets, environment variables, and more.
Why yet-another-config-package? We want strong typing and strict validation of our configurations, for confidence in development and production. We also want the flexibility of using different file formats, using environment variables, and keeping secrets safe. It should be abundantly easy and straightforward to change configuration with confidence.
What is it not useful for (as of today):
Benefits:
Add the module to your project, using your preferred NPM client. Then run the init command.
yarn add @lcdev/app-config
npx app-config init
The CLI init command simply creates .app-config.*
files. You can then run
npx app-config variables
at any time to see your populated configuration.
You might start with a simple configuration, like:
.app-config.yml
webServer:
port: 3000
database:
host: "localhost"
port: 5432
name: "master"
.app-config.schema.yml
type: object
required:
- webServer
- database
properties:
webServer:
type: object
required: [port]
properties:
port:
type: number
database:
type: object
required: [host, port, name]
properties:
host:
type: string
port:
type: number
name:
type: string
Check out the JSON Schema documentation for details.
This module supports YAML, TOML, JSON, and JSON5 out of the box, for any of the files. Your schema could be YAML, and config be TOML, or any other way around. By default the CLI produces YAML for all files.
.app-config.{ext}
or app-config.{ext}
.app-config.schema.{ext}
or app-config.schema.{ext}
.app-config.meta.{ext}
or app-config.meta.{ext}
app-config
keyAPP_CONFIG
environment variable always takes precedent over files, and can be in any supported formatAPP_CONFIG_CI
or APP_CONFIG_EXTEND
environment variable is parsed and deeply merged with your main configuration, if loading from a fileThis module comes with a CLI tool for common usage. Running npx app-config --help
will give you a list of commands and options.
Common options are:
app-config -- {cmd-that-consumes-env-variables}
# for example:
app-config -- docker-compose up -d
# spits out all config to stdout
app-config vars
# spits out all config as a different format
app-config create --format json
# runs code-generation from your schema types
app-config generate
Of course, you can and should use app-config
in your package.json
scripts.
Note that running commands this way (--
) also get a APP_CONFIG
variable (in YAML by default).
This module uses JSON Schema to define constraints on your configuration. As shown above,
the schema is loaded from the .app-config.schema.{ext}
file. This cannot be specified
by an environment variable, so be certain that it is included in your production environment.
Schemas have support for loading $ref
properties, to reduce duplication of properties.
That means that if you define a type as $ref: '../another-file.yml#/definitions/CommonItem'
that resolution will be completed automatically.
Secrets are defined in your schema.
super-secret-property:
type: string
format: uri
secret: true
Inserting that non-standard key will automatically prevent you from putting that property
in your main .app-config.{ext}
file, requiring you to put it in .app-config.secrets.{ext}
.
You should gitignore the secrets file to prevent ever accidentally adding secrets to VCS.
This module supports automatic type generation thanks to quicktype. You write the schema, and a typed representation can be generated for you so that your code is correct.
In your meta file, you can define:
generate:
- { type: 'ts', file: 'src/config.d.ts' }
You can also do so in a top-level property of your config or schema file.
After this, you can simply run app-config gen
. This will write the file(s) you specified in
meta configuration. It's recommended to add a call to this in your dev
script, so that your
code is always in sync with your schema.
Right now, we only officially support typescript, but quicktype is extensible to other languages. You might have luck simply generating a different file type.
More options are available for generation:
type: string
changes the file type, which is inferred by the filenamename: string
changes the default config interface's nameaugmentModule: boolean
turns on or off the automatic module augmentation of app-config's default exportleadingComments: string[]
changes the top-of-file comment block that's generatedrendererOptions: { [key: string]: string }
adds any quicktype supported renderer option (like just-types
)We use the same infrastructure as described above for "config generation". That means that when running
generation, you can just specify an output file like my-other-config.yaml
. And instead of static types
like above, the full configuration is spit out into that file.
This is extensible (and mostly only useful for) "selection", like in the creation CLI.
generate:
- { file: 'rustw.toml', select: '#/build/cargo-src' }
There is also the includeSecrets
boolean option, which is disabled by default.
This module supports a special 'extending' syntax for deduplicating configuration.
In your main config:
app-config:
extends:
- other-file.yml
This will do a deep merge of other-file.yml
into your main configuration.
This module supports environment specific config and will attempt to load the config based on your
NODE_ENV|ENV|APP_CONFIG_ENV
environment variable and fallback to the default config file if
nothing matching is found.
Environment specific configuration files are named [.]app-config.{NODE_ENV|ENV|APP_CONFIG_ENV}.{ext}
.
If you prefer, you can alias the development and production config filenames with the short naming convention: [.]app-config.dev.{ext}
and [.]app-config.prod.{ext}
.
Secret files follow the same pattern and are loaded based on your NODE_ENV|ENV|APP_CONFIG_ENV
.
You can also use a special $env
property within any objects. This also supports aliasing.
my-server-config:
logging: false
$env:
default:
port: 3000
dev:
port: 8080
production:
port: 80
The config above would result in:
{ my-server-config: { logging: false, port: 3000 } }
{ my-service-config: { logging: false, port: 8080 } }
{ my-server-config: { logging: false, port: 80 } }
Using $env alongside extends, you can load different files for each environment.
app-config:
extends:
$env:
development:
- 'test-database-config.yml'
- 'database-config.yml'
production:
- 'database-config.yml'
This way, only 'database-config.yml' will be included in 'production' config; Where as 'test-databases-config.yml' and 'database-config.yml' will be included in 'development' config.
If you need to, you can access environment variables with the string syntax $VAR_NAME
or ${VAR_NAME}
.
This will in-place change the value to that environment variable.
You can also use the bash fallback syntax, like ${VAR:-fallback value}
or ${VAR:-${OTHER_VAR}}
.
This module exports a basic stable node API to do what you would expect.
// this is an already validated config object
export default config;
export {
// loads app config from the filesystem
loadConfig(cwd?, { fileNameOverride?, envOverride? }?),
loadConfigSync(cwd?, { fileNameOverride?, envOverride? }?),
// loads app config schema from the filesystem
loadSchema(cwd?),
loadSchemaSync(cwd?),
// validates the config against a schema
validate(LoadedConfig & { schema }, cwd?),
// loads app config and validates the schema
loadValidated(cwd?),
loadValidatedSync(cwd?),
// creates generated files defined in the schema
generateTypeFiles(cwd?),
} from './schema';
Alternatively, if you don't want the config to be loaded on import, you'll need to:
import { loadValidated } from '@lcdev/app-config/dist/exports';
loadValidated(cwd?).then(...);
extends
propertiesFAQs
Alias for @app-config/main
The npm package @lcdev/app-config receives a total of 5 weekly downloads. As such, @lcdev/app-config popularity was classified as not popular.
We found that @lcdev/app-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.