Skip to content

Conversation

@roschaefer
Copy link
Contributor

@roschaefer roschaefer commented Aug 13, 2018

  • no bash scripts
    • error prone
    • platform dependent)

Copy link
Member

@appinteractive appinteractive left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. We still need a way to include environment variables on the server at runtime without compiling it to the frontend bundle.
    My take on that were the dotenv files that are written by the shell scripts that have access to the environment vars at that point.

  2. All tries to access the process.env at runtime results in static values from buildtime as nuxt replaces them for security resons. Do your approach handles that case?

@@ -0,0 +1,4 @@
{
"SENTRY_DNS_PRIVATE": "SENTRY_DNS_PRIVATE",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@roschaefer how do you prevent this variable to be bundled to the client?

nuxt.config.js Outdated
API_PORT: config.get('API_PORT'),
BUILD_COMMIT: config.get('BUILD_COMMIT'),
DEPLOY_DATE: config.get('DEPLOY_DATE'),
SENTRY_DNS_PRIVATE: config.get('SENTRY_DNS_PRIVATE'),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@roschaefer EMBED_API_TOKEN & SENTRY_DNS_PRIVATE should no be bundled on the client as they are secrets!

@roschaefer roschaefer changed the title Complete rewrite of configuration [WIP] Replace nuxt-dotenv with config Aug 14, 2018
@roschaefer roschaefer force-pushed the improve_configuration branch from c6a9240 to ee4a406 Compare August 14, 2018 23:46
@roschaefer roschaefer changed the title [WIP] Replace nuxt-dotenv with config [WIP] Replace config scripts Aug 16, 2018
nuxt.config.js Outdated
'EMBED_API_URL',
'SENTRY_DNS_PUBLIC',
'MAPBOX_TOKEN',
'MAINTENANCE',
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@appinteractive this will expose only public environment variables to the client.

@roschaefer
Copy link
Contributor Author

@appinteractive when I do console.log(process.env.SENTRY_DNS_PRIVATE) I see the value on the server. So I guess, using process.env.SOME_SECRET will be fine as long as it is run on the server only.

@roschaefer roschaefer force-pushed the improve_configuration branch 2 times, most recently from cc2ab5d to 47de0a4 Compare August 19, 2018 11:16
- no bash scripts
  * error prone
  * platform dependent)
@roschaefer
Copy link
Contributor Author

OK, this branch cannot be merged without touching the Dockerfile, so I'll close this in favour of #233

@roschaefer roschaefer closed this Aug 19, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants