# .env The Only
Reference
You Need

# Env files — never commit
.env
.env.local
.env.production
.env.staging
.env.*.local

# DO commit this:
# .env.example  ← don't add to .gitignore

pip install python-dotenv

import os
from dotenv import load_dotenv
from pathlib import Path

# Always resolve relative to this file — not the CWD
load_dotenv(dotenv_path=Path(__file__).resolve().parent / ".env")

DATABASE_URL = os.getenv("DATABASE_URL")
SECRET_KEY   = os.environ["SECRET_KEY"]     # raises KeyError if missing
DEBUG        = os.getenv("DEBUG", "False").lower() in ("true", "1")

# Fail fast at startup — not silently at runtime
def validate_env():
    required = ["SECRET_KEY", "DATABASE_URL"]
    missing  = [k for k in required if not os.getenv(k)]
    if missing:
        raise RuntimeError(f"Missing required env vars: {missing}")

validate_env()

import environ
from pathlib import Path

BASE_DIR = Path(__file__).resolve().parent.parent
env = environ.Env(DEBUG=(bool, False), ALLOWED_HOSTS=(list, ["localhost"]))
environ.Env.read_env(BASE_DIR / ".env")

SECRET_KEY     = env("SECRET_KEY")
DEBUG          = env("DEBUG")
ALLOWED_HOSTS  = env("ALLOWED_HOSTS")

DATABASES      = {"default": env.db("DATABASE_URL")}
CACHES         = {"default": env.cache("REDIS_URL")}

AWS_ACCESS_KEY_ID     = env("AWS_ACCESS_KEY_ID", default=None)
AWS_SECRET_ACCESS_KEY = env("AWS_SECRET_ACCESS_KEY", default=None)
STRIPE_SECRET_KEY     = env("STRIPE_SECRET_KEY")
OPENAI_API_KEY        = env("OPENAI_API_KEY", default=None)

from pydantic_settings import BaseSettings, SettingsConfigDict
from pydantic import AnyUrl, SecretStr
from functools import lru_cache

class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_file=".env", case_sensitive=False)

    app_name:     str = "My API"
    debug:        bool = False
    database_url: AnyUrl
    secret_key:   SecretStr  # masked in logs: **********
    openai_key:   SecretStr
    redis_url:    str | None = None

@lru_cache
def get_settings() -> Settings:
    return Settings()

# Usage anywhere: from core.config import get_settings
#                 settings = get_settings()

# App
SECRET_KEY=django-insecure-dev-key-changeme
DEBUG=True
ALLOWED_HOSTS=localhost,127.0.0.1

# Database
DATABASE_URL=postgresql://user:pass@localhost:5432/mydb
REDIS_URL=redis://localhost:6379/0

# Third-party
STRIPE_SECRET_KEY=sk_test_xxxxxxxxxxxxxxxx
OPENAI_API_KEY=sk-proj-xxxxxxxxxxxxxxxx
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

# Server-only — NEVER reaches the browser
DATABASE_URL=postgresql://user:pass@localhost/mydb
STRIPE_SECRET_KEY=sk_test_xxxxxxx
OPENAI_API_KEY=sk-proj-xxxxxxx

# NEXT_PUBLIC_ → inlined into browser bundle at build time
NEXT_PUBLIC_STRIPE_PK=pk_test_xxxxxxx
NEXT_PUBLIC_API_URL=http://localhost:8000
NEXT_PUBLIC_SENTRY_DSN=https://[email protected]/123

"use server"
import Stripe from "stripe"

// Runs on server — process.env.STRIPE_SECRET_KEY never reaches browser
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!)

export async function createCheckout(priceId: string) {
  const session = await stripe.checkout.sessions.create({
    line_items: [{ price: priceId, quantity: 1 }],
    mode: "payment",
    success_url: `${process.env.NEXT_PUBLIC_API_URL}/success`,
  })
  return session.url
}

# VITE_ prefix = exposed to browser
VITE_API_URL=http://localhost:8000
VITE_STRIPE_PK=pk_test_xxxxxxx

# No prefix = build-scripts only (not bundled)
BUILD_TIMESTAMP=2026-01-01

// src/vite-env.d.ts
interface ImportMetaEnv {
  readonly VITE_API_URL: string
  readonly VITE_STRIPE_PK: string
}
interface ImportMeta {
  readonly env: ImportMetaEnv
}

// Usage: import.meta.env.VITE_API_URL

[dependencies]
dotenvy  = "0.15"
config   = "0.14"
serde    = { version = "1", features = ["derive"] }
secrecy  = { version = "0.8", features = ["serde"] }
anyhow   = "1"
tokio    = { version = "1", features = ["full"] }

fn main() -> anyhow::Result<()> {
    dotenvy::dotenv().ok();  // no-op if .env doesn't exist

    let db_url: String = std::env::var("DATABASE_URL")
        .expect("DATABASE_URL must be set");

    let port: u16 = std::env::var("PORT")
        .unwrap_or_else(|_| "8000".to_string())
        .trim().parse()
        .expect("PORT must be a valid u16");

    Ok(())
}

use config::{Config, Environment};
use secrecy::SecretString;
use serde::Deserialize;

#[derive(Debug, Deserialize, Clone)]
pub struct DatabaseConfig {
    pub url:             SecretString,  // zeroized on drop, hidden in Debug
    pub max_connections: u32,
}

#[derive(Debug, Deserialize, Clone)]
pub struct AppConfig {
    pub environment: String,
    pub port:        u16,
    pub database:    DatabaseConfig,
    pub secret_key:  SecretString,
}

pub fn load_config() -> anyhow::Result<AppConfig> {
    dotenvy::dotenv().ok();

    let cfg = Config::builder()
        .add_source(Environment::default().separator("__"))
        .build()?;
        // DATABASE__URL=postgres://... → config.database.url
        // DATABASE__MAX_CONNECTIONS=10

    Ok(cfg.try_deserialize()?)
}

# Install Doppler CLI
brew install dopplerhq/cli/doppler

# Authenticate and link project
doppler login && doppler setup

# Doppler injects secrets — no .env file needed
doppler run -- python manage.py runserver
doppler run -- npm run dev
doppler run -- cargo run

name: Deploy

on:
  push:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    env:
      # Injected from Settings → Secrets and variables → Actions
      DATABASE_URL:       ${{ secrets.TEST_DATABASE_URL }}
      SECRET_KEY:         ${{ secrets.DJANGO_SECRET_KEY }}
      STRIPE_SECRET_KEY:  ${{ secrets.STRIPE_SECRET_KEY }}
    steps:
      - uses: actions/checkout@v4
      - name: Run tests
        run: python manage.py test

  deploy-prod:
    environment: production   # requires manual approval
    needs: test
    steps:
      - name: Deploy
        env:
          API_KEY: ${{ secrets.API_KEY }}   # production value
        run: |
          docker compose up -d --build

services:
  api:
    build: ./backend
    env_file:
      - ./backend/.env        # path relative to compose file
    depends_on:
      db:
        condition: service_healthy

  web:
    build: ./frontend
    env_file:
      - ./frontend/.env.local
    ports: ["3000:3000"]

  db:
    image: postgres:16
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: localpass
      POSTGRES_DB: mydb
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]

FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .

# ✅ Non-secret config as ENV is fine
ENV PYTHONUNBUFFERED=1
ENV PORT=8000

# 🚨 Never bake secrets into image layers
# ENV SECRET_KEY=mykey   ← visible in docker inspect
# ENV DATABASE_URL=...   ← visible in every derived image

EXPOSE $PORT
CMD ["gunicorn", "myapp.wsgi:application"]