eliminate use of .env file

[huss]

Is your feature request related to a problem? Please describe.

OED currently allows the use of a .env file and values set in the docker-compose.yml file. I think the idea may have been to allow easy override of the values via the .env. However, one can get a similar result by using a second docker config file to replace with the desired new values without changing the main docker config file. Also, having two locations of sensitive information seems less desirable and may make it harder when OED transitions to secure storage of these values.

Describe the solution you'd like

The proposal is the eliminate the .env file/usage and only use the docker-compose.yml file.

Describe alternatives you've considered

Leave as is.

Additional context

This is going to require finding and updating every place in OED that uses the .env file. Note this is likely separate from the env values from docker. I quickly looked at where env is done and found these files to consider (probably not a complete list):

• src/scripts/changePostgresPass.js (in PR Fix Insecure Default Configuration #1554 and likely merged soon)
• src/scripts/installOED.sh
• src/server/config.js
• src/server/test/common.js (unclear if using .env)
• .github/workflows/build.yml (seem okay but listed)
• client.js (unclear if using .env)

[fluffylenny]

I am interested in working on this issue!

[huss]

I am interested in working on this issue!

@fluffylenny Okay. Eliminating the .env usage will help with another issue of trying to eliminate all confidential items from OED and provide them in a more secure manner. @Oykunle is just starting to look into those options. I wanted you to know this since once all the value are in place then the hope is to then serve them up in another manner. This was just started so was not yet reflected in this issue. If this impacts your interest in doing this then just let us know. If not, let me know if you need anything while working on this.

[Oykunle]

@huss , thanks for the note and for looping me in. I’ve started looking into secure alternatives for managing confidential configuration outside of .env, so this fits well with what I’m currently researching. I’m happy to coordinate with @fluffylenny as this moves forward. Please let me know if there’s anything specific you’d like me to focus on.

[fluffylenny]

@huss Sounds good, I'll start working on this issue then. @Oykunle Please let me know if there's anything I should keep in mind as you research alternatives!

[Oykunle]

@fluffylenny, just a quick update. I’ve started looking into secure alternatives for managing sensitive configuration and credentials in OED (beyond .env and docker-compose). I’ll share findings here as I make progress. Let me know if there’s anything specific you’d like me to focus on while researching.

[Oykunle]

Hi @fluffylenny,

I wanted to share a quick update from the security research side related to Problem #5 and secret-management architecture.

I’ve completed an initial research document that analyzes:
• current handling of database credentials and secrets in OED
• risks associated with .env usage and plaintext configuration
• phased design directions aligned with OWASP, NIST, and CWE guidance

Since eliminating .env is closely connected to centralizing and securing confidential configuration, this research should help inform the architectural direction as your implementation work progresses.

The research document is available here:
https://github.com/CS495-Fall2025/Team-5/blob/main/Docs/security/problem5_secret_management_research.md

Please feel free to reference it while working on this issue, and let me know if there are specific areas where deeper security analysis would be helpful. I’m happy to coordinate so that the implementation and security design stay aligned.

Thanks!

[fluffylenny]

Hi @Oykunle, could you resend the research document? The current link is invalid.

[huss]

Hi @Oykunle, could you resend the research document? The current link is invalid.

@fluffylenny I was wondering about the status and clicked on the link and it worked for me. I suspect it is due to access rights. If you provide a way for me to send it to you or contact me on Discord then I'll work to get it to you.