TS-48: Environment Variables

This short technical standard covers the use of environment variables in applications.

Environment-specific configuration MUST be stored in environment variables.

Applications SHOULD provide sensible defaults for environment configuration options, except those that store security credentials – these MUST be empty by default. The purpose is to simplify environment configuration.

Configuration defaults SHOULD be set and optimized for the production environment. The purpose of this constraint is to reduce risks associated with missing configuration in the production environment.

Environment configuration MUST be treated as external input to an application, and therefore values MUST be validated and sanitized before use. Tools such as Pkl can be helpful for defining configuration schemas and for validation environment configurations against the schemas.

References

• Wiggins, A (2017). The Twelve-Factor App: III. Config. — States the core principle behind this standard: strict separation of config from code, with config stored in environment variables.