Configuration & Secrets in Prod

Rust services follow twelve-factor config: store settings in the environment, load once at startup, and never commit secrets to git or bake them into images.

Recipe

[dependencies]
config = "0.14"
serde = { version = "1.0", features = ["derive"] }

use serde::Deserialize;
 
#[derive(Debug, Deserialize)]
struct Settings {
    database_url: String,
    port: u16,
}
 
impl Settings {
    fn from_env() -> Result<Self, config::ConfigError> {
        config::Config::builder()
            .add_source(config::Environment::default().separator("__"))
            .build()?
            .try_deserialize()
    }
}

When to reach for this:

• Every deployable binary or Axum service
• Rotating API keys without rebuilds
• Multi-environment promotion (dev, staging, prod)

Working Example

# Kubernetes secret -> env
# env:
#   - name: DATABASE_URL
#     valueFrom:
#       secretKeyRef:
#         name: db-credentials
#         key: url
 
export PORT=8080
export DATABASE_URL=postgres://user:pass@host/db
./my-service

// Never log secrets
tracing::info!(port = settings.port, "listening");
// BAD: tracing::info!(?settings.database_url);

What this demonstrates:

• Nested env keys via APP__DATABASE__URL style separators
• Secrets only in orchestrator secret stores
• Logs redact sensitive fields

Deep Dive

Layering

1. Defaults in code (non-secret only)
2. Config files for non-secret toggles (mounted ConfigMap)
3. Environment overrides for prod
4. Secrets from Vault / AWS SM / K8s Secrets at runtime

Rust Crates

Gotchas

• .env in production - file leakage risk. Fix: dotenvy for dev; orchestrator env in prod.
• Secrets in RUST_LOG debug dumps - accidental exposure. Fix: structured logging with allowlists.
• Printing config at startup - passwords in journald. Fix: log keys only, mask values.
• Immutable config mid-flight - race on reload. Fix: restart pods or explicit watch API.
• Same secret all environments - blast radius. Fix: per-env credentials and rotation.

Alternatives

FAQs

Related

• Secrets management
• Deployment basics
• Observability
• Configuration & feature design

Stack versions: This page was written for Rust 1.97.0 (edition 2024), Tokio 1.x, Axum 0.8, serde 1.0, sqlx 0.8, clap 4, and Polars 0.46+.