Configuration Manager #

package main

import (
	"fmt"
	"log"
	"os"
	"strconv"
	"strings"
)

// ANTI-PATTERN: configuration in code
type BadConfig struct {
	DatabaseURL string
	RedisURL    string
	SecretKey   string
	Debug       bool
	MaxWorkers  int
}

// CORRECT: configuration from the environment
type Config struct {
	DatabaseURL string
	RedisURL    string
	SecretKey   string
	Debug       bool
	MaxWorkers  int
	LogLevel    string
}

// Load and validate all configuration from the environment
func fromEnv() (*Config, error) {
	var errors []string

	require := func(name string) string {
		value := os.Getenv(name)
		if value == "" {
			errors = append(errors, fmt.Sprintf("Required environment variable '%s' is not set", name))
		}
		return value
	}
	optional := func(name, def string) string {
		value := os.Getenv(name)
		if value == "" {
			return def
		}
		return value
	}

	maxWorkers, _ := strconv.Atoi(optional("MAX_WORKERS", "4"))
	config := &Config{
		DatabaseURL: require("DATABASE_URL"),
		RedisURL:    optional("REDIS_URL", "redis://localhost:6379"),
		SecretKey:   require("SECRET_KEY"),
		Debug:       strings.ToLower(optional("DEBUG", "false")) == "true",
		MaxWorkers:  maxWorkers,
		LogLevel:    strings.ToUpper(optional("LOG_LEVEL", "INFO")),
	}

	// Fail fast: if anything is missing, crash at startup with a clear message
	if len(errors) > 0 {
		return nil, fmt.Errorf("incomplete configuration:\n  - %s", strings.Join(errors, "\n  - "))
	}

	return config, nil
}

// Load once at startup
func main() {
	config, err := fromEnv()
	if err != nil {
		log.Fatal(err)
	}
	_ = config
}

// Go — using godotenv
func loadEnv() {
	// Load the .env file if it exists (for local development)
	// In production, environment variables already come from the system
	_ = godotenv.Load()
}

package main

import (
	"encoding/json"
	"os"
	"strings"
)

// A simple layered config implementation
// Configuration with priorities:
// 1. Environment variables (highest)
// 2. config.{environment}.json
// 3. config.default.json (lowest)
type LayeredConfig struct {
	config map[string]interface{}
}

func NewLayeredConfig() *LayeredConfig {
	env := os.Getenv("APP_ENV")
	if env == "" {
		env = "development"
	}
	c := &LayeredConfig{config: map[string]interface{}{}}
	c.loadFile("config.default.json")
	c.loadFile("config." + env + ".json")
	c.loadEnvVars()
	return c
}

func (c *LayeredConfig) loadFile(filename string) {
	data, err := os.ReadFile(filename)
	if err != nil {
		return
	}
	var parsed map[string]interface{}
	if json.Unmarshal(data, &parsed) == nil {
		mergeMaps(c.config, parsed)
	}
}

func (c *LayeredConfig) loadEnvVars() {
	// Override with relevant environment variables
	mappings := map[string]string{
		"DATABASE_URL": "database.url",
		"REDIS_URL":    "redis.url",
		"LOG_LEVEL":    "logging.level",
		"MAX_WORKERS":  "server.max_workers",
	}
	for envKey, configKey := range mappings {
		if value := os.Getenv(envKey); value != "" {
			setNested(c.config, strings.Split(configKey, "."), value)
		}
	}
}

// Get with dot notation: get("database.url")
func (c *LayeredConfig) get(key string) interface{} {
	keys := strings.Split(key, ".")
	var d interface{} = c.config
	for _, k := range keys {
		m, ok := d.(map[string]interface{})
		if !ok {
			return nil
		}
		d = m[k]
	}
	return d
}

func mergeMaps(dst, src map[string]interface{}) {
	for k, v := range src {
		if vm, ok := v.(map[string]interface{}); ok {
			if dm, ok := dst[k].(map[string]interface{}); ok {
				mergeMaps(dm, vm)
				continue
			}
		}
		dst[k] = v
	}
}

func setNested(m map[string]interface{}, keys []string, value string) {
	for _, k := range keys[:len(keys)-1] {
		if _, ok := m[k].(map[string]interface{}); !ok {
			m[k] = map[string]interface{}{}
		}
		m = m[k].(map[string]interface{})
	}
	m[keys[len(keys)-1]] = value
}

package main

import (
	"os"

	vault "github.com/hashicorp/vault/api"
)

// getVaultClient returns an AppRole-authenticated Vault client
func getVaultClient() (*vault.Client, error) {
	client, err := vault.NewClient(vault.DefaultConfig())
	if err != nil {
		return nil, err
	}
	client.SetAddress(os.Getenv("VAULT_ADDR"))

	// AppRole login
	secret, err := client.Logical().Write("auth/approle/login", map[string]interface{}{
		"role_id":   os.Getenv("VAULT_ROLE_ID"),
		"secret_id": os.Getenv("VAULT_SECRET_ID"),
	})
	if err != nil {
		return nil, err
	}
	client.SetToken(secret.Auth.ClientToken)
	return client, nil
}

// getDatabaseCredentials returns dynamic secrets — new credentials each time, with limited TTLs
func getDatabaseCredentials() (map[string]interface{}, error) {
	client, err := getVaultClient()
	if err != nil {
		return nil, err
	}
	secret, err := client.Logical().Read("database/creds/myapp-role")
	if err != nil {
		return nil, err
	}
	return map[string]interface{}{
		"username": secret.Data["username"],
		"password": secret.Data["password"],
		"lease_id": secret.LeaseID,
	}, nil
}

// getStaticSecret returns static secrets from the Vault KV store (v2)
func getStaticSecret(path string) (map[string]interface{}, error) {
	client, err := getVaultClient()
	if err != nil {
		return nil, err
	}
	secret, err := client.KVv2("secret").Get(nil, path)
	if err != nil {
		return nil, err
	}
	return secret.Data, nil
}

package main

import (
	"context"
	"encoding/json"
	"os"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
)

// getSecret returns a secret from AWS Secrets Manager.
// Cached per process — refresh by creating a new instance or restarting.
func getSecret(secretName string) (map[string]string, error) {
	cfg, err := config.LoadDefaultConfig(context.Background(),
		config.WithRegion(envOr("AWS_DEFAULT_REGION", "ap-southeast-1")))
	if err != nil {
		return nil, err
	}
	client := secretsmanager.NewFromConfig(cfg)

	output, err := client.GetSecretValue(context.Background(), &secretsmanager.GetSecretValueInput{
		SecretId: aws.String(secretName),
	})
	if err != nil {
		return nil, err
	}

	var parsed map[string]string
	if err := json.Unmarshal([]byte(*output.SecretString), &parsed); err != nil {
		return nil, err
	}
	return parsed, nil
}

// Usage
func getDatabaseConfig() (map[string]string, error) {
	env := os.Getenv("APP_ENV")
	return getSecret("myapp/" + env + "/database")
	// Returns: {"host": "...", "port": "5432", "username": "...", "password": "..."}
}

func envOr(key, fallback string) string {
	if v := os.Getenv(key); v != "" {
		return v
	}
	return fallback
}

package main

import (
	"context"
	"encoding/json"
	"time"

	"github.com/redis/go-redis/v9"
)

var redisClient = redis.NewClient(&redis.Options{
	Addr: "localhost:6379",
})

const cacheTTL = 60 * time.Second

// isEnabled checks the flag with rollout percentage and whitelist
func isEnabled(ctx context.Context, flagName string, userID int64) bool {
	flag := getFlag(ctx, flagName)
	if flag == nil || flag["enabled"] != true {
		return false
	}

	// Rollout percentage: enabled for X% of users
	rolloutPct := 100
	if v, ok := flag["rollout_percentage"].(float64); ok {
		rolloutPct = int(v)
	}

	// User whitelists are always enabled
	if userID > 0 && containsID(flag["user_whitelist"], userID) {
		return true
	}

	// Deterministic bucketing: the same user always gets the same result
	if userID > 0 && rolloutPct < 100 {
		return userID%100 < int64(rolloutPct)
	}

	return rolloutPct == 100
}

// getFlag reads from the cache, falling back to the database
func getFlag(ctx context.Context, flagName string) map[string]interface{} {
	cacheKey := "feature_flag:" + flagName
	cached, err := redisClient.Get(ctx, cacheKey).Result()
	if err == nil {
		var flag map[string]interface{}
		if json.Unmarshal([]byte(cached), &flag) == nil {
			return flag
		}
	}

	// Get from the database if not in the cache
	flag := queryFlagFromDB(flagName)
	if flag == nil {
		return nil
	}

	flagData := map[string]interface{}{
		"enabled":            flag.enabled,
		"rollout_percentage": flag.rolloutPercentage,
		"user_whitelist":     flag.userWhitelist,
	}
	encoded, _ := json.Marshal(flagData)
	redisClient.Set(ctx, cacheKey, encoded, cacheTTL)
	return flagData
}

// Middleware-style guard for handlers (equivalent of the Python decorator)
func featureFlag(flagName string, next func(userID int64)) func(userID int64) {
	return func(userID int64) {
		if !isEnabled(context.Background(), flagName, userID) {
			writeJSON(map[string]string{"error": "Feature not available"}, 404)
			return
		}
		next(userID)
	}
}

// Usage
// http.HandleFunc("/api/new-checkout", featureFlag("new_checkout_flow", handleNewCheckout))

// Inside regular functions
func getRecommendations(userID int64) []string {
	if isEnabled(context.Background(), "ml_recommendations", userID) {
		return mlService.GetRecommendations(userID)
	}
	return getPopularProducts() // fallback
}

func containsID(list interface{}, userID int64) bool {
	items, ok := list.([]interface{})
	if !ok {
		return false
	}
	for _, item := range items {
		if id, ok := item.(float64); ok && int64(id) == userID {
			return true
		}
	}
	return false
}

package main

import (
	"fmt"
	"net/url"
	"os"
	"strconv"
)

// Validate all configuration at startup
type ConfigValidator struct {
	errors   []string
	warnings []string
}

func (v *ConfigValidator) require(name string) *ConfigValidator {
	if os.Getenv(name) == "" {
		v.errors = append(v.errors, fmt.Sprintf("MISSING: %s is required", name))
	}
	return v
}

func (v *ConfigValidator) requireURL(name string) *ConfigValidator {
	value := os.Getenv(name)
	if value == "" {
		v.errors = append(v.errors, fmt.Sprintf("MISSING: %s is required", name))
		return v
	}
	parsed, err := url.Parse(value)
	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
		v.errors = append(v.errors, fmt.Sprintf("INVALID_URL: %s = '%s'", name, value))
	}
	return v
}

func (v *ConfigValidator) requireInt(name string, minVal, maxVal *int) *ConfigValidator {
	value := os.Getenv(name)
	if value == "" {
		v.errors = append(v.errors, fmt.Sprintf("MISSING: %s is required", name))
		return v
	}
	intVal, err := strconv.Atoi(value)
	if err != nil {
		v.errors = append(v.errors, fmt.Sprintf("NOT_INTEGER: %s = '%s'", name, value))
		return v
	}
	if minVal != nil && intVal < *minVal {
		v.errors = append(v.errors, fmt.Sprintf("INVALID: %s = %d (min: %d)", name, intVal, *minVal))
	}
	if maxVal != nil && intVal > *maxVal {
		v.errors = append(v.errors, fmt.Sprintf("INVALID: %s = %d (max: %d)", name, intVal, *maxVal))
	}
	return v
}

func (v *ConfigValidator) warnIfDefault(name, dangerousValue string) *ConfigValidator {
	if os.Getenv(name) == dangerousValue {
		v.warnings = append(v.warnings,
			fmt.Sprintf("WARNING: %s is still using an unsafe default value", name))
	}
	return v
}

func (v *ConfigValidator) validate() {
	for _, warning := range v.warnings {
		fmt.Printf("⚠️  %s\n", warning)
	}
	if len(v.errors) > 0 {
		fmt.Printf("\n❌ Invalid configuration:\n\n")
		for _, e := range v.errors {
			fmt.Printf("  ✗ %s\n", e)
		}
		fmt.Printf("\nSee .env.example for guidance.\n")
		os.Exit(1)
	}
	fmt.Println("✓ Configuration valid")
}

func newConfigValidator() *ConfigValidator { return &ConfigValidator{} }
func intPtr(v int) *int                    { return &v }

// Call at the very beginning of the application, before anything else
func validateConfig() {
	newConfigValidator().
		requireURL("DATABASE_URL").
		requireURL("REDIS_URL").
		require("SECRET_KEY").
		requireInt("MAX_WORKERS", intPtr(1), intPtr(64)).
		requireInt("PORT", intPtr(1024), intPtr(65535)).
		warnIfDefault("SECRET_KEY", "changeme").
		warnIfDefault("SECRET_KEY", "your-secret-key-here").
		validate()
}

package main

// ✗ Anti-pattern 1: secrets in source code
const apiKey = "sk-..."
const databasePassword = "supersecretpassword"
// ✓ Solution: environment variables + secret managers

// ✗ Anti-pattern 2: .env committed to git
// .gitignore doesn't contain .env
// ✓ Solution: .env in .gitignore FROM THE START, commit .env.example instead

// ✗ Anti-pattern 3: no configuration validation
// The app starts without a DATABASE_URL → crashes when a request arrives
// ✓ Solution: validate and fail fast at startup with clear messages

// ✗ Anti-pattern 4: .env.example not up-to-date
// Production has 10 env vars not present in .env.example
// New developers debug for 2 hours
// ✓ Solution: .env.example always updated alongside configuration changes

// ✗ Anti-pattern 5: feature flags without cleanup mechanisms
// Flags at 100% rollout for 6 months are never removed
// Old code and unnecessary conditionals keep piling up
// ✓ Solution: feature flags have expiry dates, cleaned up routinely

// ✗ Anti-pattern 6: caching secrets too long
// Secrets fetched at startup, cached forever
// Secret rotation in Vault has no effect
// ✓ Solution: cache secrets with short TTLs (< 1 hour)