Security News
Input Validation Vulnerabilities Dominate MITRE's 2024 CWE Top 25 List
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
environmental
Advanced tools
Provides conventions and code to deal with unix environment vars in a pleasant way
Many people think shipping config json files is an upgrade over environment variables. It's not.
Dont't let your app load it's config.
..Inject it instead.
Unix environment vars are ideal for configration and I have yet to encounter an application that woudn't be better off with them.
DEBUG=*.* node run.js
source envs/production.sh && exec sudo -EHu www-data node run.js
staging.sh
, just source production.sh
, inside kevin.sh
source development.sh
And as with any other type of config:
One downside fo environment variables, is there is little convention and syntactic sugar in the high-level languages. This module attempts to change that.
Environmental Doesn't
Environmental Does
MYAPP_REDIS_HOST
) becomes config.redis.host
Environmental tree:
_default.sh
├── development.sh
│ └── test.sh
└── production.sh
└── staging.sh.sh
On disk:
envs/
├── _default.sh
├── development.sh
├── production.sh
├── staging.sh
└── test.sh
You could make this super-DRY, but I actually recommend using mainly
development.sh
and production.sh
, and duplicate keys between them
so you can easily compare side by side.
Then just use _default.sh
, test.sh
, staging.sh
for tweaks, to keep things
clear.
One common pitfall is re-use of variables:
export MYSQL_HOST="127.0.0.1"
export MYSQL_URL="mysql://user:pass@${MYSQL_HOST}/dbname"
Then when you extend this and only override MYSQL_HOST
, obviously the MYSQL_URL
will remain unaware of your host change. Ergo: duplication of vars might be the lesser evil then going out of your way to DRY things up.
These variables are mandatory and have special meaning:
export NODE_APP_PREFIX="MYAPP" # filter and nest vars starting with MYAPP right into your app
export NODE_ENV="production" # the environment your program thinks it's running
export DEPLOY_ENV="staging" # the machine you are actually running on
export DEBUG=*.* # Used to control debug levels per module
After getting that out of the way, feel free to start hacking, prefixing all
other vars with MYAPP
- or the actual short abbreviation of your app name. Don't use an underscore _
in this name.
In this example, TLS
is our app name:
export NODE_APP_PREFIX="TLS"
export TLS_REDIS_HOST="127.0.0.1"
export TLS_REDIS_USER="jane"
In a new project, type
$ npm install --save environmental
This will install the node module. Next you'll want to set up an example environment as shown in layout, using these templates:
cp -Ra node_modules/environmental/envs ./envs
Add envs/*.sh
to your project's .gitignore
file so they are not accidentally committed into your repository.
Having env files in Git can be convenient as you're still protoyping, but once you go live you'll want to change all credentails and sync your env files separate from your code.
Start your app in any of these ways:
source envs/development.sh && node myapp.js
Inside your source you can obviously just access process.env.TLS_REDIS_HOST
, but Environmental also provides some syntactic sugar so you could type config.redis.host
instead. Here's how:
var Environmental = require ('environmental');
var environmental = new Environmental();
var config = environmental.nested(process.env, process.env.NODE_APP_PREFIX);
console.log(config);
// This will return
//
// { redis: { host: '127.0.0.1' } }
As you see
_
in env var names signifies a new nesting level of configurationNodejitsu als works with environment variables. But since they are hard to ship, they want you to bundle them in a json file.
Environmental can create such a temporary json file for you. In this example it figures out all vars from envs/production.sh
(even if it inherits from other files:
$ ./node_modules/.bin/environmental envs/production.sh
{"MYAPP_REDIS_PORT":"6379","NODE_APP_PREFIX":"MYAPP","MYAPP_REDIS_PASS":"","DEPLOY_ENV":"production","SUBDOMAIN":"mycompany-myapp","NODE_ENV":"production","MYAPP_REDIS_HOST":"127.0.0.1","DEBUG":""}
$ ./node_modules/.bin/environmental envs/production.sh > /tmp/jitsu-env.json
$ jitsu --confirm env load /tmp/jitsu-env.json
$ jitsu --confirm deploy
$ rm /tmp/jitsu-env.json
FAQs
Provides conventions and code to deal with unix environment vars in a pleasant way
The npm package environmental receives a total of 3 weekly downloads. As such, environmental popularity was classified as not popular.
We found that environmental demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.