Where do you store secrets in Phoenix/Elixir and where is it recommended?

Question

Do you use environmental variables or prod.secret.exs for storing passwords, api keys, etc? What's a rule of thumb for this? I feel like they're more or less the same, hence confusion of which one to use.

Note that I don't want to make it complicated by incorporating a third-party library in my code. I want a solution out of the box, preferably.

Answer 1

So quick and simple - for small mix / Phoenix projects I'm usually using dev/test/prod.secret.exs files and then just fetching the stuff I need with Application.get_env(:key, :value), for example - my {env}.secret.exs file could look like this:

config :my_app, api_key: "1234567890"

and then somewhere in the code:

def do_stuff do
  api_key = Application.get_env(:my_app, :api_key)
end

and of course main config file should contain an import:

import_config "#{Mix.env}.secret.exs"

What is really important - don't forget to add your secret files to .gitignore

For bigger projects where I need more security - I would go with env variables. Please check this guide.

Answer 2

Environment Variables.

Whether it is Phoenix/Elixir or not doesn't matter.

According to a set of best practices called The Twelve-Factor App,

The twelve-factor app stores config in environment variables (often shortened to env vars or env). Env vars are easy to change between deploys without changing any code; unlike config files, there is little chance of them being checked into the code repo accidentally; and unlike custom config files, or other config mechanisms such as Java System Properties, they are a language- and OS-agnostic standard.

Reference: https://12factor.net/config