{"action":"created","issue":{"url":"https://api.github.com/repos/hanami/hanami/issues/516","repository_url":"https://api.github.com/repos/hanami/hanami","labels_url":"https://api.github.com/repos/hanami/hanami/issues/516/labels{/name}","comments_url":"https://api.github.com/repos/hanami/hanami/issues/516/comments","events_url":"https://api.github.com/repos/hanami/hanami/issues/516/events","html_url":"https://github.com/hanami/hanami/issues/516","id":133778436,"number":516,"title":"Make Dotenv a soft dependency for development","user":{"login":"jodosha","id":5089,"avatar_url":"https://avatars.githubusercontent.com/u/5089?v=3","gravatar_id":"","url":"https://api.github.com/users/jodosha","html_url":"https://github.com/jodosha","followers_url":"https://api.github.com/users/jodosha/followers","following_url":"https://api.github.com/users/jodosha/following{/other_user}","gists_url":"https://api.github.com/users/jodosha/gists{/gist_id}","starred_url":"https://api.github.com/users/jodosha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jodosha/subscriptions","organizations_url":"https://api.github.com/users/jodosha/orgs","repos_url":"https://api.github.com/users/jodosha/repos","events_url":"https://api.github.com/users/jodosha/events{/privacy}","received_events_url":"https://api.github.com/users/jodosha/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hanami/hanami/labels/discussion","name":"discussion","color":"0052cc"},{"url":"https://api.github.com/repos/hanami/hanami/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-02-15T17:54:04Z","updated_at":"2016-02-15T21:14:34Z","closed_at":null,"body":"## Actual\r\n\r\n`dotenv` is a runtime dependency for `hanami`. We have included it, because hosting vendors use to provide configurations via env variables.\r\n\r\nIt happens that devs get confused about the main `.env` and they think it's for production purposes. This assumption is WRONG. Storing informations in that file is not a good security practice because that means to add them inside the Git repository.\r\n\r\nProduction env vars must be setup according to the hosting instructions. Heroku for instance, uses `heroku config:add`.\r\n\r\n## Proposed\r\n\r\n* Remove `dotenv` from runtime dependencies\r\n* Generate new projects with `dotenv` in `:development`, `:test` groups in `Gemfile`\r\n* Don't generate `.env` anymore\r\n* Don't try to load `.env` anymore, but only `.env.development` or `.env.test`\r\n\r\nPlease note that `Hanami::Hanamirc` [uses `Dotenv` internally to parse `.hanamirc`](https://github.com/hanami/hanami/blob/master/lib/hanami/hanamirc.rb#L127). We must replace that code with a parser made by ourselves.\r\n\r\n---\r\n\r\n/cc @hanami/contributors WDYT?"},"comment":{"url":"https://api.github.com/repos/hanami/hanami/issues/comments/184399021","html_url":"https://github.com/hanami/hanami/issues/516#issuecomment-184399021","issue_url":"https://api.github.com/repos/hanami/hanami/issues/516","id":184399021,"user":{"login":"JonathanSerafini","id":736916,"avatar_url":"https://avatars.githubusercontent.com/u/736916?v=3","gravatar_id":"","url":"https://api.github.com/users/JonathanSerafini","html_url":"https://github.com/JonathanSerafini","followers_url":"https://api.github.com/users/JonathanSerafini/followers","following_url":"https://api.github.com/users/JonathanSerafini/following{/other_user}","gists_url":"https://api.github.com/users/JonathanSerafini/gists{/gist_id}","starred_url":"https://api.github.com/users/JonathanSerafini/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JonathanSerafini/subscriptions","organizations_url":"https://api.github.com/users/JonathanSerafini/orgs","repos_url":"https://api.github.com/users/JonathanSerafini/repos","events_url":"https://api.github.com/users/JonathanSerafini/events{/privacy}","received_events_url":"https://api.github.com/users/JonathanSerafini/received_events","type":"User","site_admin":false},"created_at":"2016-02-15T21:14:34Z","updated_at":"2016-02-15T21:14:34Z","body":"I'm just curious as to why you'd want to remove dotenv as a whole ... I for one have been finding it an extremely handy ( and standard ) way of configuration my application stacks. \r\n\r\nSpecifically, I've been deploying Laravel apps with a /.env file ( single .env without environment namespace ) and Lotus apps with a /.env.production file ... both of these are templates that are generated by my configuration management system. \r\n\r\nIs the issue at hand that passwords should not be committed into Git ? Which is correct .. but the individual that would commit a password in .env would likely commit a password in config/passwords.rb or some such as well. Or perhaps the issue is something else entirely ?  "}}