title: Passing app secrets in Yesod and Keter
body: <p>I'm building a web app with Yesod and am currently passing in secrets such as API keys via environment variables (as per <a href="http://12factor.net/config" rel="noreferrer">The Twelve-Factor App</a>) to avoid storing these values in version-controlled configuration files. For example, I run my app in dev mode as follows:</p>
  
  <pre><code>SOME_API_KEY=value yesod devel
  </code></pre>
  
  <p>I have a value in my <code>config/settings.yml</code> file that is defined in terms of this environment variable with an empty value as follows:</p>
  
  <pre><code>meetup-api-key: "_env:SOME_API_KEY:"
  </code></pre>
  
  <p>To deploy using Keter, I'm building the Keter package using the <code>yesod keter</code> command and dropping the resulting file into Keter 's<code>incoming</code> directory. Since I'm using environment variable configuration, my app's <code>.keter</code> file does not contain the <code>SOME_API_KEY</code> value (which is intentional).</p>
  
  <p>How should I pass <code>SOME_API_KEY</code> into the instance of my app running inside Keter?</p>
  
  <p>I would like to avoid baking the value into my <code>keter-config.yaml</code> for at least the following three reasons:</p>
  
  <ol>
  <li>It is less secure than the environment variable approach.</li>
  <li>Being embedded directly into the configuration file for Keter itself, as opposed to the configuration to the app, the secret cannot be changed without stopping and restarting the entire Keter process.</li>
  <li>The environment variables are passed into <em>every</em> app being managed by Keter.</li>
  </ol>
  
  <p>I am hoping that there are some "best practices" out there for this scenario.</p>