I just moved into the Ruby on Rails world and with it I am being introduced to much more liberal use of environment variables than what I have been exposed to in the past. Specifically, it appears like there's an accepted convention to store third party API keys and secret tokens as environment variables.
NOTE: this is not a RoR-specific question. I only mention it to illustrate a point of view.
I certainly see the benefit of this approach; the largest of which is that one codebase can be identically deployed to multiple servers without changing code or fear that the the app will be using the wrong resource. However, I am wary about jumping on the band wagon.
First, the approach doesn't seem scalable on my development work station (laptop), or on servers. If I am working on 10 different websites, and each are using Amazon S3 (for instance), I need 10 different EVs. Management will be difficult:
- naming collisions are a distinct possibility (especially if I am working on legacy projects that I dont have complete control over);
- visibility is murky (which EVs exist on the target machine? which have been or can be decommissioned?);
- no version control (who changed the EV? when? why?)
Second, one of the main selling-points as I understand it, is that using EVs takes the sensitive data out of the repository where prying eyes could see it. This only seems like it should be an issue for public repositories, which I have none. All my repos are private, often because of contractual issues like NDA or ownership rights.
How does all of this play out in real life scenarios? Is this approach better for some situations than others? Are there other pros that outweigh my concerns here?