150 lines
3.8 KiB
Markdown
150 lines
3.8 KiB
Markdown
## Managing Environment Variables Securely in Python Projects
|
|
|
|
This guide provides a step-by-step approach to managing environment variables in Python projects on Ubuntu servers using `dotenv` for handling environment variables and GnuPG (GPG) for file encryption.
|
|
|
|
### Prerequisites
|
|
|
|
- Python 3 installed on Ubuntu Server
|
|
- Basic familiarity with terminal commands
|
|
|
|
### Contents
|
|
|
|
1. [Setting Up dotenv with .env Files](#1-setting-up-dotenv-with-env-files)
|
|
2. [Encrypting and Decrypting .env Files with GPG](#2-encrypting-and-decrypting-env-files-with-gpg)
|
|
3. [Automating Decryption in Python Scripts](#3-automating-decryption-in-python-scripts)
|
|
4. [Backing Up GPG Keys](#4-backing-up-gpg-keys)
|
|
5. [Basic GPG Commands](#5-basic-gpg-commands)
|
|
|
|
---
|
|
|
|
### 1. Setting Up `dotenv` with `.env` Files
|
|
|
|
`dotenv` is a module that loads environment variables from a `.env` file into `os.environ`. This section covers creating a `.env` file and integrating `dotenv` into your Python project.
|
|
|
|
#### Steps:
|
|
|
|
1. **Create a `.env` File**:
|
|
|
|
```bash
|
|
# Navigate to your project directory
|
|
cd /path/to/your/project
|
|
|
|
# Create a .env file
|
|
touch .env
|
|
|
|
# Add environment variables
|
|
echo "API_KEY=yourapikey123" >> .env
|
|
echo "DB_PASSWORD=hunter2" >> .env
|
|
```
|
|
|
|
2. **Install `python-dotenv`**:
|
|
|
|
```bash
|
|
pip3 install python-dotenv
|
|
```
|
|
|
|
3. **Modify Your Python Script**:
|
|
|
|
```python
|
|
import os
|
|
from dotenv import load_dotenv
|
|
|
|
load_dotenv() # Loads the .env file
|
|
|
|
api_key = os.getenv('API_KEY')
|
|
db_password = os.getenv('DB_PASSWORD')
|
|
|
|
# Your script continues here...
|
|
```
|
|
|
|
4. **Update `.gitignore`**:
|
|
|
|
```bash
|
|
echo ".env" >> .gitignore
|
|
```
|
|
|
|
### 2. Encrypting and Decrypting .env Files with GPG
|
|
|
|
GnuPG (GPG) is used for encrypting files, ensuring sensitive information like environment variables in `.env` files is secure.
|
|
|
|
#### Steps:
|
|
|
|
1. **Install GnuPG**:
|
|
|
|
```bash
|
|
sudo apt-get update
|
|
sudo apt-get install gnupg
|
|
```
|
|
|
|
2. **Encrypt the `.env` File**:
|
|
|
|
```bash
|
|
gpg --encrypt --recipient your_user_id .env
|
|
```
|
|
|
|
3. **Decrypt the `.env` File When Needed**:
|
|
|
|
```bash
|
|
gpg --output .env --decrypt .env.gpg
|
|
```
|
|
|
|
### 3. Automating Decryption in Python Scripts
|
|
|
|
Automate the decryption of the `.env` file at the start of your Python script for convenience while maintaining security.
|
|
|
|
#### Example Function:
|
|
|
|
```python
|
|
import subprocess
|
|
import os
|
|
from dotenv import load_dotenv
|
|
|
|
def decrypt_env_file():
|
|
subprocess.run(['gpg', '--quiet', '--batch', '--yes', '--decrypt', '--output', '.env', '.env.gpg'])
|
|
|
|
# Decrypt the .env file
|
|
decrypt_env_file()
|
|
|
|
# Load environment variables
|
|
load_dotenv()
|
|
|
|
# Your main script logic
|
|
|
|
# Delete the .env file securely after use
|
|
os.remove('.env')
|
|
```
|
|
|
|
### 4. Backing Up GPG Keys
|
|
|
|
Regular backups of GPG keys are essential to avoid losing access to encrypted data.
|
|
|
|
#### Steps:
|
|
|
|
1. **Export Your Private Key**:
|
|
|
|
```bash
|
|
gpg --export-secret-keys your_user_id > myprivatekey.asc
|
|
```
|
|
|
|
2. **Export Your Public Key**:
|
|
|
|
```bash
|
|
gpg --export your_user_id > mypublickey.asc
|
|
```
|
|
|
|
### 5. Basic GPG Commands
|
|
|
|
Familiarize yourself with basic GPG commands for managing your keys and encrypted files.
|
|
|
|
#### Common Commands:
|
|
|
|
- **List Keys**: `gpg --list-keys`, `gpg --list-secret-keys`
|
|
- **Import Key**: `gpg --import [file]`
|
|
- **Export Key**: `gpg --export -a [email/id] > public.key`
|
|
- **Delete Key**: `gpg --delete-key [email/id]`, `gpg --delete-secret-key [email/id]`
|
|
- **Encrypt File**: `gpg --encrypt --recipient [email/id] [file]`
|
|
- **Decrypt File**: `gpg --decrypt [file.gpg]`
|
|
|
|
---
|
|
|
|
By following this guide, you will be able to securely manage environment variables in your Python projects, leveraging `dotenv` for environment variable management and GnuPG for encryption, ensuring your sensitive data remains protected. |