Environment variables memisahkan konfigurasi dari kode — penting untuk keamanan dan fleksibilitas.

process.env — akses environment variables:

console.log(process.env.NODE_ENV); // "development" atau "production"
console.log(process.env.PORT); // "3000"
console.log(process.env.DATABASE_URL); // "postgresql://..."

dotenv — load dari file .env:

// Install: npm install dotenv
import "dotenv/config";

// File .env:
// PORT=3000
// DB_HOST=localhost
// DB_PASSWORD=rahasia123
// JWT_SECRET=super-secret-key

const port = process.env.PORT || 3000;
app.listen(port);

NODE_ENV — mode aplikasi:

if (process.env.NODE_ENV === "production") {
  // Gunakan HTTPS, minify, caching
  app.use(helmet());
  app.use(compression());
} else {
  // Mode development — log detail
  app.use(morgan("dev"));
}

Pisahkan config per environment:

// config/index.js
const config = {
  development: {
    db: { host: "localhost", port: 5432, name: "app_dev" },
    logLevel: "debug",
    cors: { origin: "http://localhost:5173" },
  },
  staging: {
    db: { host: "staging-db.example.com", port: 5432, name: "app_staging" },
    logLevel: "info",
    cors: { origin: "https://staging.example.com" },
  },
  production: {
    db: { host: process.env.DB_HOST, port: 5432, name: "app_prod" },
    logLevel: "warn",
    cors: { origin: "https://example.com" },
  },
};

export default config[process.env.NODE_ENV || "development"];

Secrets handling — aturan penting:

• JANGAN commit file .env ke git (tambahkan ke .gitignore)
• Gunakan environment variables di hosting (Vercel, Railway, Heroku)
• Untuk secrets sensitif (API key, JWT secret), gunakan vault/secrets manager
• Buat file .env.example sebagai template (tanpa value asli)

Contoh .env.example:

PORT=3000
NODE_ENV=development
DATABASE_URL=
JWT_SECRET=
SMTP_HOST=
SMTP_PASSWORD=

Validasi environment variables saat startup:

const required = ["DATABASE_URL", "JWT_SECRET"];
for (const key of required) {
  if (!process.env[key]) {
    console.error(`Missing env var: ${key}`);
    process.exit(1);
  }
}