{"id":19889553,"url":"https://github.com/tsmx/secure-config-cloud-function","last_synced_at":"2026-05-15T21:38:04.141Z","repository":{"id":187081541,"uuid":"676283589","full_name":"tsmx/secure-config-cloud-function","owner":"tsmx","description":"Tutorial on how to create a GCP cloud function with a secure configuration management using Node.js (ESM) and secure-config and Secret Manager.","archived":false,"fork":false,"pushed_at":"2023-08-30T20:31:29.000Z","size":17,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-07-18T05:37:00.872Z","etag":null,"topics":["cloud-functions","configuration","configuration-management","esm","gcloud","gcp","nodejs","secret-manager","secure-config"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tsmx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-08T21:15:49.000Z","updated_at":"2023-08-25T20:57:43.000Z","dependencies_parsed_at":null,"dependency_job_id":"2e46b2da-6877-4e70-95d6-f8be3e7adf77","html_url":"https://github.com/tsmx/secure-config-cloud-function","commit_stats":null,"previous_names":["tsmx/nodejs-cloud-function-tutorial"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tsmx/secure-config-cloud-function","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tsmx%2Fsecure-config-cloud-function","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tsmx%2Fsecure-config-cloud-function/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tsmx%2Fsecure-config-cloud-function/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tsmx%2Fsecure-config-cloud-function/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tsmx","download_url":"https://codeload.github.com/tsmx/secure-config-cloud-function/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tsmx%2Fsecure-config-cloud-function/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33080778,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-15T20:25:35.270Z","status":"ssl_error","status_checked_at":"2026-05-15T20:25:34.732Z","response_time":103,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloud-functions","configuration","configuration-management","esm","gcloud","gcp","nodejs","secret-manager","secure-config"],"created_at":"2024-11-12T18:10:43.487Z","updated_at":"2026-05-15T21:38:04.124Z","avatar_url":"https://github.com/tsmx.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Secure configuration management for a GCP cloud function in Node.js\n\n\u003e Tutorial on how to create a [GCP cloud function](https://cloud.google.com/functions/docs/concepts/overview) with a secure configuration management using Node.js (ESM) and [secure-config](https://www.npmjs.com/package/@tsmx/secure-config) and [Secret Manager](https://cloud.google.com/secret-manager).\n\n## Secure configuration setup for a cloud function\n\nLike in a traditional app, it's very common that you'll need sensitive configuration data in a GCP cloud function, e.g. a DB username and password. This tutorial shows a proper way of doing so by leveraging managed cloud services and an additional Node.js package. The goals of this setup are\n\n- Encryption an non-exposing of any needed configuration value\n- Use of managed GCP services without loosing the capability to run on other platforms (e.g. on a traditional server, Docker, Kubernetes or else) - no vendor lock-in\n\nTo achieve this, we'll be using two components for the cloud functions configuration setup:\n\n1. The [secure-config]() package to securely store the complete configuration as an encrypted JSON file. Uses strong encryption and standard JSON, works with nearly any runtime environment.\n2. [GCP Secret Manager](https://cloud.google.com/secret-manager) for secure storage and passing of the secure-config master key to the cloud function by using an environment variable.\n\n## Steps to implement the configuration management in your cloud function\n\n### Install secure-config and create the config files\n\nInstall the [secure-config](https://www.npmjs.com/package/@tsmx/secure-config) packge by running:\n\n```bash\nnpm install @tsmx/secure-config --save\n```\n\nHaving this, create a `conf` subfolder in your project with the configuration files. In the tutorial we'll create two files, one for local testing purposes without any encrpytion and a production version which will be used in GCP with an encrypted secret.\n\nThe unencrypted config file will be `conf/config.json` with the following simple content:\n\n```json\n{\n  \"secret\": \"secret-config-value\"\n}\n```\n\nTo create the encrypted production version I recommend to use the [secure-config-tool](https://www.npmjs.com/package/@tsmx/secure-config-tool). If you don't want to install this tool, refer to the secure-config [documentation](https://tsmx.net/secure-config/#Encrypted_configuration_entries) on how to generate encrypted entries without it.\n\nFor simplicity I assume you have secure-config-tool installed an we will use `00000000000000000000000000000000` (32x `0`) as the encryption key. Having this, create the encrypted configuration for production of the cloud function as following...\n\n```bash\ncd conf/\nexport CONFIG_ENCRYPTION_KEY=00000000000000000000000000000000\nsecure-config-tool create -nh -p \"secret\" ./config.json \u003e ./config-production.json\n```\n\nThis will create `config-prodcution.json` in the `conf` directory with an encrypted secret, like so:\n\n```json\n{\n  \"secret\": \"ENCRYPTED|a2890c023f1eb8c3d66ee816304e4c30|bd8051d2def1721588f469c348ab052269bd1f332809d6e6401abc3c5636299d\"\n}\n```\n\n### Exclude any non-production configuration from upload to GCP\n\nTo prevent `gcloud functions deploy` from uploading any configuration except the encrypted production version, add the following lines to the [.cloudignore](https://cloud.google.com/sdk/gcloud/reference/topic/gcloudignore) file in the top level of your project.\n\n```bash\n# don't upload non-production configurations\nconf/*\n!conf/config-production.json\n```\n\n**Note:** GCP will by default set `NODE_ENV=production`, see [this article](https://tsmx.net/nodejs-env-vars-in-gcp-cloud-functions-and-app-engine/) for more details on the default env vars. \n\nMake also sure not to push any sensible data to your GitHub repo by changing `.gitignore` accordingly. In this tutorial the unencrypted configuration file is only added for demonstration purposes.\n\n### Using GCP Secret Manager to securely serve the encryption key\n\nWhen deploying/starting the cloud function, the `secure-config` package will look for a `CONFIG_ENCRYPTION_KEY` environment variable to decrypt and deliver the configuration values.\n\nTo securely serve this key to the cloud function, GCP Secret Manager can be used:\n\n- In the GCP console, head over to Secret Manager and create a new secret with name `CONFIG_KEY` and value `00000000000000000000000000000000` (the key we previously used for encryption)\n- Make sure that the IAM service-account running your cloud function has the `Secret Manager Secret Accessor` role, add it if necessary.\n- Pass on the created secret as the `CONFIG_ENCRYPTION_KEY` environment variable to the cloud fucntion by adding `--set-secrets=CONFIG_ENCRYPTION_KEY=projects/[PROJECT-ID]/secrets/CONFIG_KEY:latest` to `gcloud functions deploy` (see package.json for a complete example call)\n\nThat's it. The cloud function will now receive the key and the configuration values can be decrypted.\n\nToo see it in action, simply call the provided [secure-config cloud function](https://europe-west3-tsmx-gcp.cloudfunctions.net/secure-config-function).\n\n## Summary\n\nFollowing this tutorial we now have a convenient configuration managament for a GCP cloud function. \n- No secret is exposed in the code\n- Minimum dependency on the cloud provider with only one environment variable supplied\n- Full feature-set of JSON available in the configuration design (structuring, array, etc.)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftsmx%2Fsecure-config-cloud-function","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftsmx%2Fsecure-config-cloud-function","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftsmx%2Fsecure-config-cloud-function/lists"}