Security News
Input Validation Vulnerabilities Dominate MITRE's 2024 CWE Top 25 List
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
environmental
Advanced tools
Provides conventions and code to deal with unix environment vars in a pleasant way
Many people think shipping config json files is an upgrade over environment variables. It's not.
Dont't let your app load it's config.
..Inject it instead.
Unix environment vars are ideal for configration and I have yet to encounter an application that woudn't be better off with them.
DEBUG=*.* node run.js
source envs/production.sh && exec sudo -EHu www-data node run.js
staging.sh
, just source production.sh
, inside kevin.sh
source development.sh
And as with any other type of config:
One downside fo environment variables, is there is little convention and syntactical sugar in the high-level languages. This module attempts to change that.
Environmental Doesn't
Environmental Does
MYAPP_REDIS_HOST
) becomes config.redis.host
Environmental tree:
_default.sh
├── development.sh
│ └── test.sh
└── production.sh
└── staging.sh.sh
On disk:
envs/
├── _default.sh
├── development.sh
├── production.sh
├── staging.sh
└── test.sh
You could make this super-DRY, but I actually recommend using mainly
development.sh
and production.sh
, and duplicate keys between them
so you can easily compare side by side.
Then just use _default.sh, test.sh, staging.sh for tweaks, to keep things
clear.
These variables are mandatory and have special meaning
After getting that out of the way, feel free to start hacking on, prefixing all vars with MYAPP a.k.a an actuall short abbreviation of your app name.
export NODE_APP_PREFIX="TLS"
In a new project, type
$ npm install --save environmental
This will install the node module. Next you'll want to set up an example environment using these templates:
cp -Ra node_modules/environmental/envs ./envs
You'll want to add envs/*.sh
to your project's .gitignore
file so they are not accidentally committed into your repository. Having env files in Git can be convenient for protoyping, but once you go live you'll want to change all credentails and sync your env files separate from your code.
You can also use it inside an app:
source envs/development.sh && node myapp.js
var Environmental = require ('environmental');
var environmental = new Environmental();
var config = environmental.nested(process.env, process.env.NODE_APP_PREFIX);
console.log(config);
// Will return
//
// { redis: { host: '127.0.0.1' } }
As you see, any underscore _
in env var names signifies a new nesting level of configuration, and all keys are lowercased.
$ ./bin/environmental envs/production.sh
{"MYAPP_REDIS_PORT":"6379","NODE_APP_PREFIX":"MYAPP","MYAPP_REDIS_PASS":"","DEPLOY_ENV":"production","SUBDOMAIN":"mycompany-myapp","NODE_ENV":"production","MYAPP_REDIS_HOST":"127.0.0.1","DEBUG":""}
$ ./bin/environmental envs/production.sh > /tmp/jitsu-env.json
$ jitsu --confirm env load /tmp/jitsu-env.json
$ jitsu --confirm deploy
FAQs
Provides conventions and code to deal with unix environment vars in a pleasant way
The npm package environmental receives a total of 3 weekly downloads. As such, environmental popularity was classified as not popular.
We found that environmental demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.