
Security News
Meet Socket at Black Hat and DEF CON 2025 in Las Vegas
Meet Socket at Black Hat & DEF CON 2025 for 1:1s, insider security talks at Allegiant Stadium, and a private dinner with top minds in software supply chain security.
@mcrowe/gotenv
Advanced tools
Environment-variable based config for node.
Gotenv offers a clean, robust, and secure way to configure your node applications. It is based on the following principles:
Gotenv:
.env
file for enviroment variables if presentNODE_ENV=test
then it looks for a .env.test
file instead and defaults to .env
if missingpackage.json
(see below)Dotenv is a great package, and I have borrowed much of its functionality here. I feel that it gets 3 things wrong, though:
It does not allow you to specify a separate .env
file for your test environment. While 12-factor-y, this is very inconvenient. Almost all apps need separate configuration for their dev/test environments, and this should live within the codebase for convenience. Other enviroments like production, staging, qa, etc. should be configured directly via environment variables specified by the enviroment they are running in.
It doesn't allow you to overwrite global environment variables in your .env
files. If you have, say, PORT=5000
in your .bashrc
for some reason, then any value you set in your .env
will be ignored. This bit me when I was setting AWS credentials for my projects.
It doesn't validate required enviroment variables, which I believe should be done for all applications.
Install it:
npm install @mcrowe/gotenv --save
Add the following to your .gitignore
:
.env
.env.test
Create a .env.example
file with example environment variables (its OK to check this in to git).
CONCURRENCY=3
LOG_LEVEL=debug
SERVICE_URL=
Have each developer copy .env.example
to .env
and set their own custom enviroment variables. This file should not be commited to git.
Add an "env" section to your package.json
, specifying your environment variables.
"env": {
"required": {
"SERVICE_URL": "URL for the super service",
"CONCURRENCY": "Number of concurrent workers to run",
},
"optional": {
"LOG_LEVEL": "Log level [debug, info, error] (defaults to 'info')",
}
}
Import or require this module at the top of your program:
// ES6
import '@mcrowe/gotenv'
// ES5
require('@mcrowe/gotenv')
Or, require it when invoking node:
node -r @mcrowe/gotenv src/index.js
Install npm modules:
npm install
Run tests:
npm test
Release a new version:
bin/release.sh
This will publish a new version to npm, as well as push a new tag up to github.
FAQs
Environment-variable based config for node
We found that @mcrowe/gotenv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Meet Socket at Black Hat & DEF CON 2025 for 1:1s, insider security talks at Allegiant Stadium, and a private dinner with top minds in software supply chain security.
Security News
CAI is a new open source AI framework that automates penetration testing tasks like scanning and exploitation up to 3,600× faster than humans.
Security News
Deno 2.4 brings back bundling, improves dependency updates and telemetry, and makes the runtime more practical for real-world JavaScript projects.