diff options
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | README | 47 | ||||
| -rw-r--r-- | main.py | 4 | ||||
| -rwxr-xr-x | run.sh | 3 | ||||
| -rw-r--r-- | secrets.sh.example | 1 |
5 files changed, 56 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..b654e1f --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +secrets.sh @@ -0,0 +1,47 @@ +Bootstrap secrets management in a project. + +Problem: Secrets (e.g., passowrds, API keys) get accidentaly commited and are +leaked when a repository becomes public. + +Solution: + +secrets.sh.example defines variable names +secrets.sh defines secret values +run.sh sources secrets +.gitignore exclude secrets.sh + +Rationale +========= + +People are lazy. The less steps the better. So, `run.sh` should create +`secrets.sh` out of `secrets.sh.example`, and nd tell the user to modify it. + +This flow is simple and portable. No unreliable dependencies like: + +https://pypi.org/project/python-dotenv/ for the people that cannot use os.environ +https://www.npmjs.com/package/dotenv + +People often use these tools because they don't know shell scripting. Here's a +quick reminder + +```sh +foo=somevalue +./run # does not receive foo +foo=anothervalue ./run # passes foo only for ./run +export foo # mark variable for automatic export +export -n foo # remove export mark +unset foo # delete variable, alongside any marks + +set | grep foo # check local variables +env | grep foo # check variables marked for automatic export to the environment of subsequently executed commands + + +# shell built-ins +help export +help unset + +# external programs +man env + +# Shell built-ins take precedence over any external program with the same name. +``` @@ -0,0 +1,4 @@ +import os + +for k in os.environ: + print(f"{k}={os.environ[k]}") @@ -0,0 +1,3 @@ +[ -f secrets.sh ] || cp secrets.sh.example secrets.sh +source secrets.sh +python main.py | grep MYSECRET diff --git a/secrets.sh.example b/secrets.sh.example new file mode 100644 index 0000000..6f3b387 --- /dev/null +++ b/secrets.sh.example @@ -0,0 +1 @@ +export MYSECRET=yoursecret |