⚙️ Junior Python Track 37 • Environment & Secrets Management

37. Environment Configuration & Secrets

Master production environment configuration: manage .env files with python-dotenv, build class-based configuration hierarchies (DevelopmentConfig, TestingConfig, ProductionConfig), parse typed environment variables, redact sensitive credentials, and prevent secret leaks via .gitignore.

← 36. Packaging & Distribution 📚 Overview Matrix ⚙️ Launch Config Studio

🎓 Junior Python Curriculum — Select Module

1️⃣ Fundamentals 2️⃣ Data Types 3️⃣ Operators 4️⃣ Conditionals 5️⃣ Loops 6️⃣ Collections 7️⃣ Comprehensions 8️⃣ Functions 9️⃣ *args & **kwargs 🔟 Scope & Namespaces 1️⃣1️⃣ OOP 1️⃣2️⃣ Exceptions 1️⃣3️⃣ File Handling 1️⃣4️⃣ Modules & Packages 1️⃣5️⃣ Virtual Environments 1️⃣6️⃣ Standard Library 1️⃣7️⃣ Iterators & Iterables 1️⃣8️⃣ Generators 1️⃣9️⃣ Decorators 2️⃣0️⃣ Context Managers 2️⃣1️⃣ Lambda Functions 2️⃣2️⃣ Functional Programming 2️⃣3️⃣ Type Hints 2️⃣4️⃣ Dataclasses 2️⃣5️⃣ Testing 2️⃣6️⃣ Debugging 2️⃣7️⃣ Logging 2️⃣8️⃣ JSON & Data 2️⃣9️⃣ Regular Expressions 3️⃣0️⃣ Databases 3️⃣1️⃣ APIs & HTTP 3️⃣2️⃣ Code Quality 3️⃣3️⃣ Software Architecture 3️⃣4️⃣ Performance & Big-O 3️⃣5️⃣ Concurrency & Async 3️⃣6️⃣ Packaging & Distribution 3️⃣7️⃣ Environment & Secrets

📄

.env & Environment Variables

Store environment-specific configuration values outside your codebase in .env files loaded into os.environ using python-dotenv.

`os.environ.get("KEY", default)`: Read with fallbacks.
`load_dotenv()`: Automatically parse `.env` at startup.
Strict validation: Raise KeyError on missing secrets.

🎛️

Multi-Stage Config Classes

Use OOP inheritance (`BaseConfig` → `DevelopmentConfig`, `TestingConfig`, `ProductionConfig`) to handle environment variations cleanly.

`DevelopmentConfig`: `DEBUG = True`, local database.
`TestingConfig`: In-memory SQLite database (`:memory:`).
`ProductionConfig`: Strict security, encrypted URI strings.

🔒

Secrets Security & Git Protection

Prevent credential leaks by masking passwords in logs, redacting database URIs, and enforcing `.env` exclusion in `.gitignore`.

`.gitignore`: Ignore `.env`, `*.pem`, `secrets.json`.
Secrets Redaction: Mask JWT keys in application logs.
Pydantic BaseSettings: Type-safe settings validation.

⚙️ Environment Configuration & Secrets Studio

.env, Dev/Test/Prod Configs & Secrets Security

python-dotenv | Secrets | BaseSettings

📄 .env & Environment Variables

Keep credentials out of codebase using `.env` files loaded dynamically via `os.environ` and `python-dotenv`.

🎛️ Dev / Test / Prod Configs

Class-based hierarchy cleanly separating local dev settings, testing in-memory DBs, and production strict security.

🔒 Secrets & Git Protection

Mask secret keys in logs, redact passwords in DB connection URIs, and enforce strict `.gitignore` exclusion rules.

⚡ Environment Configuration Presets:

✅ Ready for Environment Execution

🖥️ Terminal Output Execution Result:

=== EXECUTION RESULT ===

--- Parsed .env Configuration ---
APP_ENV = development
API_PORT = 8080
SECRET_KEY = super-secret-production-jwt-key-2026
DATABASE_URL = postgresql://cloud_admin:SecurePass123!@localhost:5432/teachcloud_db
ALLOWED_HOSTS = teachcloud.dev,api.teachcloud.dev
DEBUG = true

# ==============================================================================
# ENVIRONMENT VARIABLE RETRIEVAL WITH FALLBACK & TYPE PARSING
# ==============================================================================
import os

def get_env_var(key: str, default: str = "", required: bool = False) -> str:
    val = os.environ.get(key, default)
    if required and not val:
        raise KeyError(f"Required env var '{key}' is missing!")
    return val

# ==============================================================================
# CLASS-BASED MULTI-STAGE CONFIGURATION HIERARCHY
# ==============================================================================
class BaseConfig:
    APP_NAME: str = "TeachCloud Platform"
    DEBUG: bool = False

class DevelopmentConfig(BaseConfig):
    DEBUG: bool = True
    DATABASE_URI: str = "sqlite:///dev.db"

class ProductionConfig(BaseConfig):
    DEBUG: bool = False
    DATABASE_URI: str = os.environ.get("PROD_DATABASE_URL")

# ==============================================================================
# SECRETS REDACTION & GIT EXCLUSION AUDITING
# ==============================================================================
def redact_password_uri(uri: str) -> str:
    import re
    return re.sub(r":([^@]+)@", ":****@", uri)

import unittest
from cloud_app.tutorials.env_config_basics import ProductionConfig, audit_gitignore_secrets

class TestEnvConfigTutorial(unittest.TestCase):
    def test_config_redaction(self):
        redacted = ProductionConfig.get_redacted_config()
        self.assertEqual(redacted["SECRET_KEY"], "********")

💎 Junior Track 37 Master Reference

37. Environment Configuration Strategy Matrix

📊 Configuration Management Approaches

Approach	Mechanism	Security Level	Best Used For
Hardcoded Values	Direct code constants (`SECRET = "123"`)	❌ UNSAFE (Leaks to Git)	Never in real projects
.env Files	Un-tracked local text file (`python-dotenv`)	✅ HIGH (Local Dev / Staging)	Local development & staging instances
OS Environment Variables	OS process environment (`os.environ`)	✅ HIGH (Docker / Kubernetes)	Containerized cloud deployments
Vault / Secrets Manager	AWS Secrets Manager, HashiCorp Vault	🛡️ ENTERPRISE (Auto-Rotating)	Enterprise microservices & finance APIs

← 36. Packaging & Distribution 🎓 Junior Hub (37 Modules Complete!) ⭐ Practice 100+ Interview Questions →