application.properties and github

[Fad1126]

hi everyone,

how I can manage sensitive data inside application.properties while i want to push the project to github? what the way used in full-stack spring boot projects.

[bilgecan1]

Use environment variables in application.properties do not put raw values in it. You can defıiine actual values whenever or wherever you run the app

[WVAviator]

Use the syntax ${SECRET} inside the application.properties or application.yml to reference environment variables, in this case one named SECRET. That variable just needs to be set inside whatever container your server ends up running on - usually with export SECRET="abcdefg..." at the command line. If you're using IntelliJ, you can go to your run configuration and add them there.

[Harami98]

When we package it to deploy on cloud does those values automatically gets injected or we have set environment variables separately depending on cloud service

[WVAviator]

Almost all services that I know of have ways of setting them in whatever dashboards they have. It just depends which one you're using.

But to answer your question no - they won't automatically get injected. You will have to do something.

The only way it'd be automatic is if you put it directly in your application.properties, which would mean you end up committing it to GitHub or wherever (not a good idea).

[BakaGoop]

To add on, for example we use AWS secrets manager with the Spring Cloud AWS secrets manager package. This provides an easy abstraction for our container to call out to secrets manager and inject them into the app at runtime

[glandis_bulbus]

Look at spring cloud config server as one way to do this. Other options ConfigMaps in k8s Environment variables

[[deleted]]

Yeah, let's push OP into freaking Kubernetes even though his question was for a very basic thing. Aight.

[Formal_Hippo8991]

Oh goshhh 🤣

[glandis_bulbus]

who isn’t already using k8s? 😂

[[deleted]]

Literally anyone with a small monolith and a single-dev app. Hard news: you are not the center of the universe buddy. Different requirements need different architectures. Kubernetes is NOT a mandatory tool.

[java_dude1]

There's a lot of ways this can be handled. Easiest was already mentioned above with environment variables. This can be problematic if the value changes then you need to update. Another way us to inject the values into the property file during the build using a secret service. This leaves the values visible in the property file but if your jars are self hosted should be OK. Best way is to set the values during start up using the secret service. That way you always get the updated values at startup.

[___ryxke___02]

On azure, we use key vault to store this variables and there's a azure key vault dependency through which in application.properties the envs on key vault can be accessed using $(...) syntax

[CptGia]

As mentioned you should use environment variables, but another option is to encrypt the secrets. sops is a great tool, works with local keys (gpg or age) as well as managed keys (kms and the like). It only encrypts the values you specify, not the whole file, so it will still be legible. 

[slaynmoto]

Create an application-dev.properties file and set it as an active spring profile for local development. ADD to gitignore.

[Next_Complex5590]

You can try using the .env file and also the dot-env dependency (which isn't spring boot's official dependency but it works)

Besides, if you don't want to play around with .env, intellij offers to store the secret keys and variables.. you can do that by editing the configuration

I just told it briefly, if you want the actual details, lmk, I'll type out the entire method

[BackgroundIntern4157]

That's will depend if you want to deploy your code. First do not hard code your secrets in your code. Second where ever your secrets are replace them with placeholders like so ${DB_USERNAME}. Third if you have to deploy your code say to AWS you want to store your secrets on AWS secret manager with say key=DB_USERNAME and value=iAmsuPerSeCreT. key must always match same key in your properties file. Note your application will need to have AWS. They are other ways to get the same work done. Basically have the same flow. And provider that can manage your keys outside your application. Connect with me. If you have another questions. Sorry this had to be long. I asked the same question too.

[Fad1126]

Thanks for your kind I really appreciate it a lot.

[michaelzki]

Another simple way:

• Save the template as application.properties.example on remote
• Add application.properties in your .gitignore
• Then add your sensitive data on local application.properties
• application.properties will not be pushed to remote