问题

I use some sensitive data by passing as environment variables via IntelliJ run config:

spring:
...
  datasource:
    driver-class-name: org.postgresql.Driver
    url: jdbc:postgresql://localhost:5432/${DB_NAME}
    username: ${DB_USERNAME}
    password: ${DB_PASSWORD}

However, I am wondering if it is possible to read from .env file and match these labels without passing them via IntelliJ or command line. In docker-compose it is possible using env_file parameter as far as I remember. Is there a similar thing for application properties to read and match parameters in .env file by giving its location?

spring:
...
  datasource:
    driver-class-name: org.postgresql.Driver
    url: jdbc:postgresql://localhost:5432/${DB_NAME}
    username: ${DB_USERNAME}
    password: ${DB_PASSWORD}

答案1

得分: 0

I'm assuming you put the .env file in the top of the project directory, you can add the following configuration to read variables from the .env file

...
spring:
    config:
        import: optional:file:.env[.properties]
...

...
spring:
    config:
        import: optional:file:.env[.properties]
...

答案2

得分: -1

No, it's not supported. I would say, it's not a job of Spring Boot to read .env files. It's a job of your shell environment (i.e. bash, zsh) or a job of your IDE (there are corresponding plugins for Intellij).

But as I can see you do some unnecessary work by introducing your own env variables and mapping them to Spring Boot properties. It's unnecessary because the value for each Spring Boot property can be passed and recognized with a corresponding uppercased environment variable. This means that if you want to pass a value for spring.datasource.password property to Spring Boot, you can just start the app with a value in SPRING_DATASOURCE_PASSWORD environment variable.

Also, I do not see any reasons to use .env file while developing apps with Spring Boot. In your src/resources/application.yaml, just set spring.profiles.active: secrets and put your sensitive data (which you do not want to commit) into application-secrets.yaml (which is .gitignored to avoid accidental commit).

Please note that ideally you also should not keep secrets in a file when deploying your app. You should inject them as an environment variable on startup of your application's process, so it would only exist in the memory of a working process.