Storing password securely nodemailer

Question

I have an app that sends mail using nodemailer.

transporter = nodemailer.createTransport({
  service: 'Gmail',
  auth: {
    user: "email",
    pass: "what here?"
  }
});

I want to keep the app open source, just for the heck of it (along with not wanting a plain text password to exist basically anywhere).

I know of nodemailler-direct, but is there a better option here? I also thought about prompting the server console for password, but that's clunky as well.

Is there a "correct" or standard way to do such a thing?

Answer 1

Use environment variables:

transporter = nodemailer.createTransport({
  service: process.env.NODEMAILER_SERVICE,
  auth: {
    user: process.env.NODEMAILER_USER,
    pass: process.env.NODEMAILER_PASS
  }
});

You can set these variables on the server and the application will pick them up. For example:

NODEMAILER_SERVICE="Gmail"