Manage configuration and secrets

Classify every value as a constant, a deployment parameter, or a secret; load configuration through the standard precedence chain, parsed once and fail-closed; and keep secrets out of git by referencing them at runtime and committing only encrypted-at-rest .env files.

By the end of this module, you'll be able to:

• Classify any value as a domain invariant (a code constant), a deployment parameter (typed config), or a secret (a runtime reference), using the 12-Factor litmus test.
• Load configuration through the Cogitave precedence chain, parsed once at the boundary into one typed, immutable value that fails closed on invalid or missing input.
• Select an environment by which overlay file loads, not by branching on dev/prod in code.
• Keep secrets out of git: hold a SecretRef in config, resolve it at runtime, and commit only encrypted-at-rest .env files with the private key held in the secret store.

Units

1. 01Introduction4 min
2. 02The configuration model7 min
3. 03Secrets and environments7 min
4. 04Knowledge check5 min
5. 05Summary3 min