Consider removing dotenv

[frankieroberto]

Should we remove dotenv from the kit as a dependency? Or make it a devDependency?

Currently it's included with the kit, including in production mode, but most hosts like Heroku or Railway have their own way to configure environment variables.

Whilst .env files are useful, we also have other ways to configure things:

app/config.js - eg sevice name and port can be set here
app/locals.js - for anything you want to be able to access in Nunjucks views

If dotenv were removed, people could still use it by either installing the command line tool (dotenv-cli globally and using dotenv npm run watch, or just adding it back in to their package.json manually.

Alternatively, we could keep it in but move it to devDependencies?

Either way, we can continue to keep .env in the .gitignore to prevent the files from being accidentally committed to GitHub.

[frankieroberto]

To add to the confusion, there’s also now dotenvx.

[frankieroberto]

@colinrotherham @edwardhorsford @paulrobertlloyd any thoughts on this? Are there any good reasons for having dotenv (or dotenvx) either included or not included by default?

[colinrotherham]

For comparison:

• Add .env file to support storing private data alphagov/govuk-prototype-kit#383

[edwardhorsford]

I think we should retain a way that users can store secrets. Neither locals.js or config.js is suitable for that. I use .env for putting things like api keys for local use.

Is there a problem having it included? It seems sensible for supporting local development?

[frankieroberto]

We can keep it, it's just another thing to keep up-to-date (and maybe consider moving to dotenvx). If we do, it should probably move to devDependencies though?