env vs. config.yaml vs. google-credentials.json: A Security & Structure Guide

# .env
DATABASE_URL=postgres://user:pass@host:5432/db
API_KEY=sk_live_abc123
PORT=8080

# config.yaml
server:
  port: 8080
  timeout: 30s
  debug: false

features:
  new_checkout: true
  beta_api: 
    enabled: true
    rollout_percentage: 25

logging:
  level: info
  outputs:
    - stdout
    - file:/var/log/app.log

{
  "type": "service_account",
  "project_id": "my-production-app",
  "private_key_id": "abc123...",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7...\n-----END PRIVATE KEY-----\n",
  "client_email": "svc@my-production-app.iam.gserviceaccount.com",
  "client_id": "123456789",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token"
}

# src/config/loader.py
import os
import yaml
from pathlib import Path
from google.oauth2 import service_account

class Config:
    def __init__(self):
        # 1. Load environment variables (secrets & targets)
        self.db_url = os.environ['DATABASE_URL']
        self.api_key = os.environ['STRIPE_API_KEY']
        
        # 2. Load app behavior from versioned YAML
        with open('/app/config/config.yaml', 'r') as f:
            app_config = yaml.safe_load(f)
        self.debug = app_config['server']['debug']
        self.feature_flags = app_config['features']
        
        # 3. Load Google credentials by PATH (not content)
        cred_path = os.environ.get('GOOGLE_APPLICATION_CREDENTIALS')
        if cred_path and Path(cred_path).exists():
            self.gcp_creds = service_account.Credentials.from_service_account_file(
                cred_path,
                scopes=['https://www.googleapis.com/auth/cloud-platform']
            )

# config/config.yaml (committed to git, no secrets)
server:
  port: 8080
  timeout: 30s
  debug: false  # Never true in production

features:
  new_checkout: true
  beta_api:
    enabled: true
    rollout_percentage: 25  # Gradual rollout

database:
  pool_size: 20
  connection_timeout: 10

# .env.production (NEVER committed, injected via Kubernetes Secret)
DATABASE_URL=postgres://prod-user:REDACTED@prod-db:5432/prod
STRIPE_API_KEY=sk_live_REDACTED
GOOGLE_APPLICATION_CREDENTIALS=/secrets/google-sa-key.json

# k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-service
spec:
  template:
    spec:
      containers:
      - name: app
        image: myregistry/payment-service:v1.2.3
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: db-secrets
              key: url
        - name: STRIPE_API_KEY
          valueFrom:
            secretKeyRef:
              name: stripe-secrets
              key: live-key
        - name: GOOGLE_APPLICATION_CREDENTIALS
          value: /secrets/google-sa-key.json
        volumeMounts:
        - name: google-creds
          mountPath: /secrets
          readOnly: true
      volumes:
      - name: google-creds
        secret:
          secretName: google-sa-key
          items:
          - key: key.json
            path: google-sa-key.json

# ❌ DON'T DO THIS
# .env
GOOGLE_CREDENTIALS={"type":"service_account","project_id":"app","private_key":"-----BEGIN PRIVATE KEY-----\nMIIE..."}

# ❌ config.yaml with secrets (committed to git)
database:
  url: postgres://user:password123@host/db  # ← SECRET IN VERSION CONTROL
  pool_size: 20

# ✅ config.yaml (safe to commit)
database:
  host: ${DB_HOST}  # Reference env var
  port: 5432
  pool_size: 20

# ✅ .env (never committed)
DB_HOST=prod-db.internal
DB_PASSWORD=super-secret-value

# Run before commit
$ evnx scan ./project

[SCAN] Analyzing .env files...
[ERROR] .env:17 - GOOGLE_CREDENTIALS contains JSON-like structure
        → Suggestion: Store file path instead: GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json
[WARN]  .env:23 - API_KEY has high entropy (possible secret)
        → Confidence: 94% | Pattern: ^sk_live_[a-zA-Z0-9]{24,}
[INFO]  .env.example is missing 3 variables present in .env
        → Run: evnx sync --example to update

[RESULT] 1 error, 1 warning. Commit blocked.

# Catch .gitignore misconfigurations
$ evnx doctor

[DOCTOR] Environment health check...
[WARNING] packages/api/.env is tracked by git
[WARNING] Root .gitignore does not cover packages/api/.env
[OK] .env.example is present and synchronized
[OK] No high-entropy values detected in committed files

[FIX] Run: evnx ignore --add packages/api/.env

# .git/hooks/pre-commit
#!/bin/bash
if ! command -v evnx &> /dev/null; then
  echo "⚠️  evnx not installed. Install with: curl -fsSL https://dotenv.space/install.sh | bash"
  exit 0  # Don't block, but warn
fi

if ! evnx scan --quiet; then
  echo "❌ Security scan failed. Fix issues before committing."
  exit 1
fi

# Dockerfile
FROM python:3.11-slim as builder

# Install dependencies
COPY requirements.txt .
RUN pip install --user --no-cache-dir -r requirements.txt

FROM python:3.11-slim

# Create non-root user
RUN useradd -m appuser && mkdir /app && chown appuser:appuser /app
USER appuser
WORKDIR /app

# Copy application code (excluding .env)
COPY --chown=appuser:appuser src/ ./src/
COPY --chown=appuser:appuser config/config.yaml ./config/

# Copy entrypoint that validates config at startup
COPY --chown=appuser:appuser scripts/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]
CMD ["python", "-m", "src.main"]

# scripts/entrypoint.sh
#!/bin/bash
set -e

# Validate environment before starting app
if ! command -v evnx &> /dev/null; then
  echo "⚠️  evnx not available in container. Skipping config validation."
else
  echo "🔒 Validating configuration..."
  evnx scan --env-only --quiet || exit 1
fi

# Start the application
exec "$@"

# .github/workflows/deploy.yml
name: Deploy to Production

on:
  push:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Install evnx
      run: curl -fsSL https://dotenv.space/install.sh | bash
    
    - name: Scan for configuration issues
      run: evnx scan --strict
      # Fails build if secrets detected in .env or config files
    
    - name: Validate .env.example sync
      run: evnx sync --check
      # Ensures example file stays up to date

  deploy:
    needs: security-scan
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Configure kubectl
      uses: azure/k8s-set-context@v1
      with:
        kubeconfig: ${{ secrets.KUBE_CONFIG }}
    
    - name: Deploy with secrets injection
      run: |
        kubectl create secret generic app-secrets \
          --from-literal=DATABASE_URL=${{ secrets.DB_URL }} \
          --from-literal=STRIPE_API_KEY=${{ secrets.STRIPE_KEY }} \
          --from-literal=GOOGLE_APPLICATION_CREDENTIALS=/secrets/google-sa-key.json \
          --dry-run=client -o yaml | kubectl apply -f -

# .env.production (production deployment)
# Instead of the actual secret, reference the secret manager path
DATABASE_URL=aws-secrets-manager://prod/db/url
STRIPE_API_KEY=vault://kv/prod/stripe/live-key
GOOGLE_APPLICATION_CREDENTIALS=/secrets/google-sa-key.json  # Still mounted as file

# Get started in 60 seconds
curl -fsSL https://dotenv.space/install.sh | bash
evnx doctor  # Find issues in your current setup
evnx scan    # Block dangerous patterns before commit