romenigld
I am thinking to put the credentials of the Google Cloud on the Gigalixir Server using config set. Which will put on the secrets.
gigalixir config:set GCP_KEY=="<GOOGLE-CLOUD-CREDENTIALS>"
and use locally on the file .env and insert the values as:
export GCP_BUCKET="<MY-BUCKET-ON-GOOGLE-CLOUD>"
export GCP_KEY="<GOOGLE-CLOUD-CREDENTIALS>"
But putting the GCP_KEY as json string don’t work for use with System.fetch_env!("GCP_KEY") or System.get_env("GCP_KEY").
Like the documentation:
"GOOGLE_APPLICATION_CREDENTIALS_JSON"
|> System.fetch_env!()
|> Jason.decode!()
The only way was reading the json file:
application.ex
@gcp_key File.read!("gcp.json") |> Jason.decode!()
@impl true
def start(_type, _args) do
credentials = @gcp_key
source = {:service_account, credentials}
.
.
.
But the thing is, I don’t want to put my google credentials file on github or in production. I want to on the .gitignore
How is the best approach for this?
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Deploy Phoenix to your own VPS with PaaS ease: push-to-deploy, zero downtime, auto SSL, managed Postgres. 14-day free trial at potions.io
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #hex
- #security
Our Sponsors
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 4- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
al2o3cr
(note: I’m guessing the specific failure mode, the below could be nonsense)
Module attributes like
@gcp_keyare evaluated at compile-time so just replacingFile.read!in your example withSystem.fetch_env!will only work if theGOOGLE_APPLICATION_CREDENTIALS_JSONenvvar is set when compiling the module.romenigld
But if I send the credentials to the public repository it’s possible to anyone could access the Google cloud bucket?
felix-starman
If you have not been able to resolve this, or if anyone else comes across this:
Assuming you’re using waffle_gcs, you can define a TokenFetcher and use the new Goth 1.3+ approach.
Unfortunately, due to how the waffle libs handle config, if you need to sign URLs, such as for a private bucket, you’ll still need pass the “old” json key that just contains the raw file contents.
To avoid having the file lying around in the container, which could result in exposure if there were file traversal bugs in our code, and to avoid building it into the image, we used GCP Secrets Manager and
hush. We also made a custom service account that only had permissions to sign URLs, and then used the metadata source with Goth for everything else to use the VMs configured service account.BradS2S
You can add an extra config file and have git ignore it.