Manage configuration and secrets

Classify every value as a constant, a deployment parameter, or a secret; load configuration through the standard precedence chain, parsed once and fail-closed; and keep secrets out of git by referencing them at runtime and committing only encrypted-at-rest .env files.

Units5

Duration26 min

Levelintermediate

Start module

By the end of this module, you'll be able to:

Classify any value as a domain invariant (a code constant), a deployment parameter (typed config), or a secret (a runtime reference), using the 12-Factor litmus test.
Load configuration through the Cogitave precedence chain, parsed once at the boundary into one typed, immutable value that fails closed on invalid or missing input.
Select an environment by which overlay file loads, not by branching on dev/prod in code.
Keep secrets out of git: hold a SecretRef in config, resolve it at runtime, and commit only encrypted-at-rest .env files with the private key held in the secret store.

Prerequisites

Basic familiarity with environment variables and a service's startup configuration.
Helpful but not required: the AGENTS floor (least privilege, docs-as-code).