Better config/secrets managements with DEV/PROD

Any application will use configuration and secrets.

I don’t want to store the config in the database because it is slow.
I though I’d use secrets for the config and secrets. Gives me a central location and a UI for these. But this has limitations:

  • within an application one cannot switch between different config values for the dev and published version.
  • when using separate DEV and PROD applications the encryption key is different. The docs say that Anvil can manually set the same key for both. A bigger obstacle is that when one syncs the PROD app with the DEV app all secrets are overwritten with the DEV’s secrets because they are stored in code.

So I have gone back to storing the settings in the database.

2 Likes

Yeah, I had to move the couple of items I had in secrets to the data tables for that reason, too. That part of the dev/prod split definitely needs some work.

Suggestion: Create two secrets, one called mysecret_dev and mysecret_prod. Set the _dev secret in the dev app, and the _prod secret in the prod app (using git to sync) – now you have one secret that can only be read in the dev app, and one secret that can only be read in the prod app. Then you can check anvil.app.id and use it to work out which you’re in, and use that one!

(Meanwhile, the feature request is duly noted :slight_smile: )

2 Likes

That would work I guess, but would need an access layer in code which kind of defeats the usefulness of some global config system.