Reading secret config file on Heroku without using env vars

Question

I'm using the Google Cloud Pub Sub API with NodeJS, as documented here. I'm using Heroku to run my server.

The sample code on the Node JS + Pub Sub page asks me to specify a path to a file:

pubsub = gcloud.pubsub({
    projectId: 'my-project',
    keyFilename: '/path/to/keyfile.json'
});

I typically use Heroku's config vars to store secrets and API keys, but in this case it seems that the GCloud API requires me to specify the path to a file. So, I would need to check in a file into Heroku, but not my GitHub repo.

I have tried the following: Pushing .gitignore files to specific remote and How can I upload my application to github but remove sensitive authorization information? but the trouble is that once I force add (git add -f keyfile.json) the json file and make a commit out of it and make a new branch, I can't push that commit to Heroku because when I do git push heroku master, it says Everything is up to date. In any case, that seems very messy. There has got to be a cleaner way to make Google Cloud work with Heroku.

What should I do?

Answer 1

Was answered by the lovely folks over at GoogleCloudPlatform: https://github.com/GoogleCloudPlatform/gcloud-node/issues/761

It's not mentioned in the code sample in the documentation, but you can just add a credentials object and pass that to your config. The credentials object can read env vars.

More information here: https://googlecloudplatform.github.io/gcloud-node/#/authorization.
Updated link: https://googleapis.dev/nodejs/pubsub/latest/global.html#ClientConfig