How to manage environment variables and secrets

Passwords, API keys and other secrets should never be written in code or pushed to Git. Their place is in environment variables.

The .env file

Most frameworks read configuration from a .env file:

DB_PASSWORD=secret_password
API_KEY=your_key

Do not push .env to Git

Add it to .gitignore and put only a .env.example without real values in the repo.

echo ".env" >> .gitignore

Strict permissions

chmod 600 .env

Only the owner can read the file, see file permissions.

System-level variables

For systemd services, you can put variables in the service unit:

Environment="API_KEY=your_key"

In CI/CD

Secrets go in the CI/CD system's secrets interface, not in the workflow files, see CI/CD pipeline. If a secret accidentally reached Git, change it immediately, Git history keeps it.