Go Academy · Lesson

Environment Config and Secrets

Twelve-factor config, env vars, and Docker secrets

Environment Config and Secrets is a free Go Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Go Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

12-factor app config

The 12-factor app methodology recommends storing configuration in environment variables, not in code or config files. This makes the app portable across dev, staging, and prod without code changes.

os.Getenv

Read environment variables with os.Getenv (returns "" if not set) or os.LookupEnv (returns value and presence bool):

port := os.Getenv("PORT")
if port == "" { port = "8080" }

dsn, ok := os.LookupEnv("DATABASE_URL")
if !ok { log.Fatal("DATABASE_URL not set") }

Loading .env files

Use github.com/joho/godotenv to load .env files in development. In production, inject env vars via the platform (Docker, Kubernetes, cloud).

godotenv.Load() // loads .env if present; ignores error in prod

Structured config with envconfig

github.com/kelseyhightower/envconfig maps env vars to struct fields with type conversion and validation:

type Config struct {
    Port     int    `envconfig:"PORT"    default:"8080"`
    DBUrl    string `envconfig:"DB_URL"  required:"true"`
    LogLevel string `envconfig:"LOG_LEVEL" default:"info"`
}
var cfg Config
envconfig.MustProcess("", &cfg)

Secrets management

Never store secrets (passwords, API keys, TLS certs) in environment variables in production — they appear in process listings and logs. Use a secrets manager: AWS Secrets Manager, HashiCorp Vault, or Kubernetes Secrets mounted as files.

Reading secrets from files

Mount secrets as files and read them at startup:

secret, err := os.ReadFile("/run/secrets/db_password")
if err != nil { log.Fatal(err) }
dsn := fmt.Sprintf("postgres://user:%s@host/db", strings.TrimSpace(string(secret)))

Kubernetes secrets

In Kubernetes, mount Secret values as environment variables or as files in a volume. File mounts are preferred since they can be rotated without restarting the pod.

Feature flags

Store feature flag names in env vars for simple on/off toggles. For complex flag rules (percentage rollouts, targeting), use a dedicated feature flag service.

Config validation at startup

Validate all required config at startup and fail fast if anything is missing or invalid. Better to crash immediately than to fail on the first request.

if cfg.DBUrl == "" { log.Fatal("DB_URL required") }

Immutable config

Treat config as immutable after startup. If you need live config updates, use a feature flag service or config store with a watch mechanism, not hot-reloading env vars.

Config in tests

Use t.Setenv to set env vars for the duration of a test. This is safe for parallel tests in Go 1.17+.

t.Setenv("PORT", "9090")
// test code here...

Quick Check

Why should secrets not be stored in environment variables in production?

Recap: Environment Config and Secrets

Key points:

Store config in env vars; use godotenv for local dev .env files
envconfig for typed struct population with defaults
Mount secrets as files; use Vault/Secrets Manager in production
Validate all config at startup; fail fast if anything is missing

Frequently asked questions

Is the “Environment Config and Secrets” lesson free?

Yes — the full text of “Environment Config and Secrets” is free to read here on the web, and the Go Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Go Academy course, upgrade to CoddyKit PRO.

What will I learn in “Environment Config and Secrets”?

Twelve-factor config, env vars, and Docker secrets You practise Go Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Go Academy?

No prior experience is required. Go Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Environment Config and Secrets” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Go Academy lesson?

Yes. Every Go Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Go Academy