1

I got a .net framework solution that has secret settings (API keys, connectionstrings etc) in a web.config. The solution code lives at github.com. I want to avoid having those secret settings at github at all. I got a teamcity build server, that has those settings and merges them into the web.config at build time for the different enviroments, just before deploy time. This works great. But I need ideas of how to handle those settings for developing locally, where the teamcity server (of course) does not build and merges settings.

Could it maybe be possible to inject some code i global.asax on Application_Start, to fetch the settings from a secure place and set the settings there? Or maybe have a different config file just for development that is only loaded when developing and is not committed in github? Or is there some other smart way that I can't think of?

3
  • I remebered the SlowCheetah nuget project, that i could have used for this.Adding a web.debug.config to the project, and to git.ignore, would have solved the problem. however SlowCheetah dows not transform web projects on build, only on deploy, so that will not work. dang, that could have been the perfect solution.
    – Troels
    Nov 27, 2018 at 9:58
  • I found a way through powershell and the 'file' reference in web.config and made a Blog post about it: codebuildplay.wordpress.com/2018/11/30/…
    – Troels
    Dec 3, 2018 at 7:20
  • I think SlowCheetah still has value here. You can pair the nuget project with the visual studio extension to transform your files when you F5 to debug your app. marketplace.visualstudio.com/… Sep 21, 2020 at 19:21

1 Answer 1

1

I found a way through powershell and the 'file' reference in web.config and made a Blog post about it: https://codebuildplay.wordpress.com/2018/11/30/how-to-store-settings-in-teamcity-and-merging-into-a-net-config/

1
  • If/when you move to the cloud, there are more robust options. In Azure, the settings can live with the environment and override the web.config values. That would keep them out of your repo. For added security, you can use something like Azure Key Vault or AWS Secrets Manager, to store those values. Sep 21, 2020 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.