I Ditched dotenv for Varlock (Here's Why)

Highlights

• Varlock is an open-source tool that replaces traditional .env files with a type-safe schema called mspec.

• It prevents plain-text secrets from being stored on disk, making it safe to commit configuration files to public repositories.

• The tool supports seamless integration with password managers like 1Password, Bitwarden, and AWS for secret resolution.

• Varlock provides a CLI and various plugins for popular frameworks including Vite, Next.js, and Cloudflare Workers.

• Security features include automatic redaction of sensitive data from logs and outgoing HTTP responses.

• While powerful, current limitations include a lack of offline support and slight latency when fetching remote secrets.

• An MCP server is available to help AI coding agents automatically set up environment schemas for users.

Timeline

1. 00:00 - 01:02

   Introduction to Varlock and the .env Problem

   The speaker introduces Varlock as an open-source solution designed to eliminate the practice of storing plain-text secrets on local disks. Traditional .env files often cause friction during onboarding when new developers lack necessary local configurations or updated secrets. Varlock solves this by resolving variables through password managers like Bitwarden or AWS using a type-safe schema. This approach makes configuration files safe for AI agents and public GitHub commits because the actual secrets are injected at runtime. The section emphasizes that Varlock addresses both developer workflow inefficiencies and the risk of prompt-injected AI agents accessing unauthorized data.

2. 01:02 - 02:49

   Implementing the mspec Schema and Basic Decorators

   The demonstration begins with a project using OpenAI's Whisper and Claude, where the speaker sets up an empty .env.mspec file. This file uses a Domain Specific Language (DSL) called mspec, which serves as the single source of truth for the application's environment. The speaker illustrates how to use root decorators, such as setting the default sensitivity of variables to false using a hashtag syntax. Item decorators are also introduced to enforce data types like strings or numbers, providing immediate validation errors if the schema is violated. This section highlights how the 'required' decorator ensures that necessary variables are never missing before the application starts.

3. 02:49 - 03:53

   Injecting Variables and Cross-Language Support

   This segment explains the process of injecting resolved environment variables into a running application using the 'varlock run' command. The speaker demonstrates this by changing a port number to 3002 and running a Vite frontend, which successfully picks up the injected value. Crucially, Varlock is not limited to JavaScript; it is compatible with any language including Python, Go, and Rust. For those who prefer not to use npm, a standalone Varlock CLI is available to manage these processes. The speaker notes that the tool effectively wraps the application's execution command to provide a seamless configuration layer.

4. 03:53 - 06:24

   Integrating 1Password and Remote Secret Management

   The speaker explores advanced usage by fetching API keys directly from a 1Password vault instead of using local shell variables. To achieve this, a specific 1Password plugin is installed, which introduces new root and item decorators like 'init-1password'. The process involves creating a service account token and using a specific protocol syntax to point to the vault, item name, and field. Although there is no current Neovim plugin for syntax highlighting, a VS Code extension exists to assist with schema writing. The demonstration proves that Varlock can successfully pull live data from external managers, keeping the local schema file completely free of sensitive values.

5. 06:24 - 08:30

   Advanced Features and Current Limitations

   The final section covers a wide array of secondary features, including TypeScript type generation, GitHub Actions integration, and automatic log redaction. Despite the benefits, the speaker identifies several drawbacks such as the inability to work offline and the slight delay caused by network requests to secret providers. Some minor bugs were noted, specifically regarding naming collisions between local shell variables and schema definitions. There is also a mention of an MCP server that allows AI agents to assist in setting up environment schemas automatically. Ultimately, the speaker concludes that Varlock is a superior alternative to traditional methods and plans to use it for all future side projects.