DevOps & CloudSoftware Engineering

Environment Variables and Configuration Management

Manage application configuration properly across development, staging, and production with validation, type safety, and security.

Prince Mbeah Essilfie

May 4, 2026 at 06:04 AM

7 min read 1656 views

Environment Variables and Configuration Management

The Config Hierarchy

Configuration should flow from least to most specific:

Defaults (in code) → lowest priority
Config files (.env.local, config.yaml)
Environment variables → highest priority

Validated Configuration with Zod

Never trust raw process.env:

// config/env.ts
import { z } from 'zod'

const EnvSchema = z.object({
  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
  DATABASE_URL: z.string().url(),
  REDIS_URL: z.string().url().optional(),
  AUTH_SECRET: z.string().min(32),
  PORT: z.coerce.number().default(3000),
  SMTP_HOST: z.string().optional(),
  SMTP_PORT: z.coerce.number().optional(),
  LOG_LEVEL: z.enum(['debug', 'info', 'warn', 'error']).default('info'),
})

export type Env = z.infer<typeof EnvSchema>

function validateEnv(): Env {
  const result = EnvSchema.safeParse(process.env)

  if (!result.success) {
    console.error('❌ Invalid environment variables:')
    console.error(result.error.format())
    process.exit(1)
  }

  return result.data
}

export const env = validateEnv()

Validate at startup. Fail fast with a clear error message listing exactly which variables are missing or invalid. Don't discover config issues at 3am under load.

Nuxt Runtime Config

// nuxt.config.ts
export default defineNuxtConfig({
  runtimeConfig: {
    // Server-only (never exposed to client)
    databaseUrl: '',
    authSecret: '',

    // Public (available in client)
    public: {
      siteUrl: 'http://localhost:3000',
      apiBase: '/api',
    },
  },
})

Environment variables automatically override with NUXT_ prefix:

NUXT_DATABASE_URL → runtimeConfig.databaseUrl
NUXT_PUBLIC_SITE_URL → runtimeConfig.public.siteUrl

.env File Management

# .env.example (committed to git — documentation)
DATABASE_URL=postgres://user:pass@localhost:5432/mydb
AUTH_SECRET=change-me-to-at-least-32-characters
REDIS_URL=redis://localhost:6379

# .env (NOT committed — local overrides)
DATABASE_URL=postgres://real:creds@prod-host:5432/prod

# .env.test (committed — test configuration)
DATABASE_URL=postgres://test:test@localhost:5432/test_db

The .env.example Pattern

#!/bin/bash
# scripts/check-env.sh — Run in CI to verify env is complete

required_vars=(
  "DATABASE_URL"
  "AUTH_SECRET"
  "REDIS_URL"
)

missing=()
for var in "${required_vars[@]}"; do
  if [ -z "${!var}" ]; then
    missing+=("$var")
  fi
done

if [ ${#missing[@]} -ne 0 ]; then
  echo "❌ Missing environment variables:"
  printf '  - %s\n' "${missing[@]}"
  exit 1
fi