Environment Variables & Config

// npm install dotenv

// .env file (in project root)
// PORT=3000
// NODE_ENV=development
// DATABASE_URL=mongodb://localhost:27017/myapp
// JWT_SECRET=my-super-secret-key-change-this
// API_KEY=abc123def456

// The FIRST line of the entry file, before any module that reads process.env.
// dotenv only affects variables read AFTER it has run.
require('dotenv').config();

// Access variables
const PORT = process.env.PORT || 3000;
const DB_URL = process.env.DATABASE_URL;
const JWT_SECRET = process.env.JWT_SECRET;

console.log('Environment:', process.env.NODE_ENV);
console.log('Port:', PORT);

// Use in your app
const mongoose = require('mongoose');
mongoose.connect(DB_URL);

const app = require('express')();
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});

// config/index.js
require('dotenv').config();

function requireEnv(name) {
  const value = process.env[name];
  if (!value) {
    throw new Error(`Missing required environment variable: ${name}`);
  }
  return value;
}

// 'false' is a truthy STRING — booleans must be coerced explicitly
function bool(name, fallback = false) {
  const v = process.env[name];
  if (v === undefined) return fallback;
  return v === 'true' || v === '1';
}

const config = {
  port: parseInt(process.env.PORT, 10) || 3000,
  nodeEnv: process.env.NODE_ENV || 'development',
  isDev: process.env.NODE_ENV !== 'production',
  verboseLogs: bool('VERBOSE_LOGS', false),

  db: {
    url: requireEnv('DATABASE_URL'),
  },

  jwt: {
    secret: requireEnv('JWT_SECRET'),
    expiresIn: process.env.JWT_EXPIRES_IN || '24h',
  },

  cors: {
    origin: process.env.CORS_ORIGIN || 'http://localhost:3000',
  },
};

module.exports = config;

// Usage in other files
const config = require('./config');

mongoose.connect(config.db.url);
app.listen(config.port);

const token = jwt.sign(payload, config.jwt.secret, {
  expiresIn: config.jwt.expiresIn,
});

# .gitignore — written before the first commit
node_modules/
.env
.env.local
*.log

# .env — real values, never committed
PORT=3000
DATABASE_URL=mongodb+srv://appuser:realpassword@cluster.example/shop
JWT_SECRET=8f3c1d5e9a...        # long and random: generated, not invented
PAYMENT_KEY_SECRET=...

# .env.example — committed; names only, no values
PORT=3000
DATABASE_URL=
JWT_SECRET=
PAYMENT_KEY_SECRET=


// Generate a real secret rather than thinking one up:
//   node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"

// If a secret has been pushed, ROTATE it. Deleting the file is not enough.
//   1. create a new key at the provider
//   2. set it in the deployment environment
//   3. revoke the old one
//   4. only then clean the git history

// Anything the browser receives is public, whatever you name it:
const paymentSecret = process.env.PAYMENT_KEY_SECRET;   // fine on the server
// const key = "sk_live_...";   // in frontend code: visible to every visitor

// NODE_ENV is a convention that libraries genuinely act on
const isProd = process.env.NODE_ENV === 'production';

// GOOD — behaviour varies
app.set('view cache', isProd);
app.use(morgan(isProd ? 'combined' : 'dev'));

app.use((err, req, res, next) => {
  res.status(err.statusCode || 500).json({
    error: err.message,
    stack: isProd ? undefined : err.stack   // detail locally, nothing publicly
  });
});

// BAD — identity varies, and a real connection string hides inside a branch
// const dbUrl = isProd ? process.env.DATABASE_URL : 'mongodb://localhost/dev';

// GOOD — every environment supplies its own value
const dbUrl = requireEnv('DATABASE_URL');

// Set it where the application RUNS, not in the code that reads it:
//   NODE_ENV=production node server.js
//   (on Windows use cross-env, or set it in the platform's dashboard)

// 1. Never a hardcoded host or port
const PORT = process.env.PORT || 3000;   // platform first, local fallback
// app.listen(3000)                      // works only on your own laptop

// 2. Every new variable must be added to the platform's settings too.
//    Fail loudly at startup rather than at two in the morning:
function requireEnv(name) {
  const v = process.env[name];
  if (!v) throw new Error(`Missing required environment variable: ${name}`);
  return v;
}

// 3. "Set but wrong" — print the LENGTH, never the value
console.log('JWT_SECRET length:', (process.env.JWT_SECRET || '').length);
// 34 where you expected 32?  Quotation marks, or a trailing space.

// 4. Coerce, always
const enablePayments = process.env.ENABLE_PAYMENTS === 'true';   // not truthiness
const maxUploadMb = Number(process.env.MAX_UPLOAD_MB) || 5;

// 5. Order still matters after a refactor
// server.js
require('dotenv').config();        // FIRST
const config = require('./config');
const app = require('./src/app');  // anything reading env now sees real values