title: Where should I store secret strings on Node server?
body: <p>Well, I've come with a problem. How can I store passwords, db url and important strings that should not go to my public version control?</p>
  
  <p>I've come up with 3 solutions. The <strong>first</strong> works only on dev:</p>
  
  <pre><code>var config = require('./config');
  var port = config.serverPort;
  </code></pre>
  
  <p>config.js</p>
  
  <pre><code>module.exports = {
    'serverPort' : '8182'
  }
  </code></pre>
  
  <p>The <strong>second</strong> one should work both on dev and prod. But the config.js file was added on the <em>.gitignore</em> file, so it won't be upload to the server. When the server tries to require <em>config.js</em> and can't find it, it will throw an error. </p>
  
  <pre><code>var config = require('./config');
  var port = process.env.PORT || config.serverPort;
  </code></pre>
  
  <p>The <strong>third</strong> is to use only process.env variables, but this only works on production. And, if I'm testing on local machine, I may need to paste my secret strings and remember to remove it before sending to the public version control.</p>
  
  <p>So, what should I do?</p>