Configuration Management

from pydantic_settings import BaseSettings, SettingsConfigDict
 
class AppSettings(BaseSettings):
    model_config = SettingsConfigDict(env_file=".env", extra="ignore")
    environment: str = "dev"
    database_url: str
    log_level: str = "info"
 
settings = AppSettings()  # reads env vars and optional .env locally

# app.env.j2
APP_ENV={{ environment }}
DATABASE_URL={{ database_url }}
LOG_LEVEL={{ log_level }}

"""render_config.py - load env config, merge secrets, render template."""
from __future__ import annotations
 
import json
from pathlib import Path
 
import yaml
from jinja2 import Environment, FileSystemLoader, select_autoescape
 
ROOT = Path(__file__).parent
CONFIG_DIR = ROOT / "config"
 
def load_yaml(path: Path) -> dict:
    with path.open() as f:
        return yaml.safe_load(f) or {}
 
def load_config(environment: str) -> dict:
    base = load_yaml(CONFIG_DIR / "base.yaml")
    env = load_yaml(CONFIG_DIR / f"{environment}.yaml")
    merged = {**base, **env, "environment": environment}
    return merged
 
def fetch_secret(name: str) -> str:
    # Production: boto3.client("secretsmanager").get_secret_value(...)
    return f"SECRET::{name}"
 
def render(template_name: str, context: dict) -> str:
    env = Environment(
        loader=FileSystemLoader(ROOT / "templates"),
        autoescape=select_autoescape(),
    )
    template = env.get_template(template_name)
    return template.render(**context)
 
if __name__ == "__main__":
    cfg = load_config("staging")
    cfg["database_password"] = fetch_secret("db/password")
    output = render("service.env.j2", cfg)
    print(output)
    print(json.dumps({"rendered_for": cfg["environment"]}))

# config/base.yaml
log_level: info
service_port: 8080

# config/staging.yaml
database_host: staging.db.internal
feature_new_ui: true

# templates/service.env.j2
APP_ENV={{ environment }}
LOG_LEVEL={{ log_level }}
PORT={{ service_port }}
DATABASE_HOST={{ database_host }}
DATABASE_PASSWORD={{ database_password }}
FEATURE_NEW_UI={{ feature_new_ui }}

from pydantic import Field, SecretStr
from pydantic_settings import BaseSettings
 
class DeploySettings(BaseSettings):
    environment: str
    db_password: SecretStr = Field(alias="DATABASE_PASSWORD")
 
    def redacted(self) -> dict:
        return self.model_dump(mode="json", exclude={"db_password"})