Allow env vars to override config vars

[lsnape]

Hey James,

In order to tie in with our current work deploy strategy, we need to have environment variables take precedence over any variables with the same key name in the config map (converting SHOUTY_UNDERSCORE_STRING to :kebab-keywords. We set the production variables prior to starting the service, where environ loads them in as soon as the service starts.

I'm not proposing that we change the nomad precedence order; I think you'll agree that would be bad! But would it be possible to add a NOMAD_ENV=ENV special case that does allow this behaviour?

I nominate myself to implement this feature, of course :)

[jarohen]

If I understand you correctly, you'd like to specify the default (dev) configuration value, in the config file, but in production, have the value come from an ENVIRONMENT_VARIABLE?

[jarohen]

If so, would something like:

{:db {:username "db-user"
      :password "password-123"}

 :nomad/environments {"prod"
                      {:db {:username #nomad/env-var "DB_USERNAME"
                            :password #nomad/env-var "DB_PASSWORD"}}}}

work?

[lsnape]

Yes it will work. Although I don't want to explicitly write out :my-var #nomad/env-var "MY_VAR" for every config var that's overridden; I want to introduce a mode whereby environment variables take precedence over edn config vars implicitly, plus make accessible any environment variables that don't appear in the config.

A tradeoff here is that your above example, where the value is a nested map, won't work with my proposed solution (unless you mark it as an edn-config-var, which you can't really do implicitly!).

I appreciate that creating an env mode would change the NOMAD_ENV semantics slightly: rather than resolving to an environment named env in the config map, we would load all environment variables in the shell. But what we get in return is an easy transition from environ over to nomad. Having to write out the env var -> config var mapping for every existing project, and maintain it thereon will be very time consuming.

Interested to here your thoughts :) Perhaps there's a more elegant way of doing this?

[jarohen]

Tbh, if you want config variables in environment variables, environ's probably the way to go :)

I'm personally not a fan of it (hence writing Nomad) - they're a lot harder to keep in sync than config variables stored in the same repository, and versioned with the rest of your application. I can understand nervousness around credentials - Phoenix has support for encrypted credential storage now which we could back-port into Nomad? (see Phoenix README for more details)

[lsnape]

The main issue I have with environ is the fact I have to restart the repl every time I add or change a config var. It's really disruptive to developer workflow. Think of all those poor little lisp kitties :'(

I think encrypted creds is a better alternative to what we have already. Will see if I can trial it on the project I'm working on. Thanks!