Go Academy · Lesson

Environment Config and Secrets

Twelve-factor config, env vars, and Docker secrets

Lesson 2 of 413 steps

Environment Config and Secrets is a free Go Academy lesson on CoddyKit. This is lesson 2 of 4. Any 3 lessons of this learning path are free to read in full — after that, CoddyKit PRO unlocks every lesson, plus hands-on practice with a built-in code editor and a 24/7 AI tutor. It is part of the Go Academy learning path, and your progress syncs across the web and the CoddyKit app. The Go Academy course includes 4 lessons in total.

12-factor app config

The 12-factor app methodology recommends storing configuration in environment variables, not in code or config files. This makes the app portable across dev, staging, and prod without code changes.

os.Getenv

Read environment variables with os.Getenv (returns "" if not set) or os.LookupEnv (returns value and presence bool):

port := os.Getenv("PORT")
if port == "" { port = "8080" }

dsn, ok := os.LookupEnv("DATABASE_URL")
if !ok { log.Fatal("DATABASE_URL not set") }

Loading .env files

Use github.com/joho/godotenv to load .env files in development. In production, inject env vars via the platform (Docker, Kubernetes, cloud).

godotenv.Load() // loads .env if present; ignores error in prod

Structured config with envconfig

github.com/kelseyhightower/envconfig maps env vars to struct fields with type conversion and validation:

type Config struct {
    Port     int    `envconfig:"PORT"    default:"8080"`
    DBUrl    string `envconfig:"DB_URL"  required:"true"`
    LogLevel string `envconfig:"LOG_LEVEL" default:"info"`
}
var cfg Config
envconfig.MustProcess("", &cfg)

Secrets management

Never store secrets (passwords, API keys, TLS certs) in environment variables in production — they appear in process listings and logs. Use a secrets manager: AWS Secrets Manager, HashiCorp Vault, or Kubernetes Secrets mounted as files.

Reading secrets from files

Mount secrets as files and read them at startup:

secret, err := os.ReadFile("/run/secrets/db_password")
if err != nil { log.Fatal(err) }
dsn := fmt.Sprintf("postgres://user:%s@host/db", strings.TrimSpace(string(secret)))

Kubernetes secrets

In Kubernetes, mount Secret values as environment variables or as files in a volume. File mounts are preferred since they can be rotated without restarting the pod.

Feature flags

Store feature flag names in env vars for simple on/off toggles. For complex flag rules (percentage rollouts, targeting), use a dedicated feature flag service.

Config validation at startup

Validate all required config at startup and fail fast if anything is missing or invalid. Better to crash immediately than to fail on the first request.

if cfg.DBUrl == "" { log.Fatal("DB_URL required") }

Immutable config

Treat config as immutable after startup. If you need live config updates, use a feature flag service or config store with a watch mechanism, not hot-reloading env vars.

Config in tests

Use t.Setenv to set env vars for the duration of a test. This is safe for parallel tests in Go 1.17+.

t.Setenv("PORT", "9090")
// test code here...

Quick Check

Why should secrets not be stored in environment variables in production?

Answer it in the interactive lesson

Recap: Environment Config and Secrets

Key points:

Store config in env vars; use godotenv for local dev .env files
envconfig for typed struct population with defaults
Mount secrets as files; use Vault/Secrets Manager in production
Validate all config at startup; fail fast if anything is missing

Free to start

Learn Go with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 51
Lessons: 203

Start learning free View the full course

Frequently Asked Questions

Is the “Environment Config and Secrets” lesson free?

Yes — any 3 lessons of the Go Academy learning path, including “Environment Config and Secrets”, are free to read in full here on the web. After that, CoddyKit PRO unlocks every lesson, plus interactive practice with a built-in code editor and a 24/7 AI tutor. The Go Academy course includes 4 lessons in total.

What will I learn in “Environment Config and Secrets”?

Twelve-factor config, env vars, and Docker secrets You practise Go Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Go Academy?

No prior experience is required. Go Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 2 of 4.

How long does the “Environment Config and Secrets” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Go Academy lesson?

Yes. Every Go Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Go Academy