TUTORIAL 09 · INTERMEDIATE

Environment Variables and Secrets

Keep development, staging and production configuration explicit without putting secret values into RAIQL source.

RAIQL 1.020 minProject: ServiceDesk

By the end of this tutorial

Declare environment profiles
Declare secret names only
Initialize/check local profiles
Run commands with an explicit environment

Declare names, never values

The ServiceDesk source declares which profiles exist and which environment variables are required. Values remain outside the language source.

app.raiql

CREATE APPLICATION "RAIQL ServiceDesk";
TYPE WEB;

USE STACK
  FRONTEND NEXTJS,
  BACKEND NEXTJS,
  DATABASE POSTGRESQL;

CREATE TENANT ENTITY Tenant;
CREATE USER ENTITY User;

CREATE ENTITY Ticket (
  id UUID PRIMARY,
  title STRING REQUIRED,
  description STRING,
  status STRING REQUIRED,
  priority STRING REQUIRED,
  ownerId UUID REQUIRED,
  tenantId UUID REQUIRED
);

CREATE CRUD Tenant;
CREATE API Tenant;
CREATE CRUD Ticket;
CREATE API Ticket;

ADD AUTHENTICATION EMAIL_PASSWORD, JWT;
ADD ROLE ADMIN, AGENT, USER;
DEFAULT ROLE USER;

RELATE Ticket.ownerId TO User.id;
RELATE Ticket.tenantId TO Tenant.id;
OWN Ticket BY ownerId;
TENANT Ticket BY tenantId;

ALLOW ADMIN CREATE Ticket, READ Ticket, UPDATE Ticket, DELETE Ticket, CREATE Tenant, READ Tenant, UPDATE Tenant, DELETE Tenant;
ALLOW AGENT READ Ticket, UPDATE Ticket;
ALLOW USER CREATE OWN Ticket, READ OWN Ticket, UPDATE OWN Ticket;

ENVIRONMENT development, staging, production;
SECRET DATABASE_URL;
SECRET RAIQL_JWT_SECRET;

EVENT TicketCreated FROM Ticket;
JOB ProcessTicket ON TicketCreated;

GENERATE OPENAPI;
GENERATE SDK TYPESCRIPT;
GENERATE TESTS;

BUILD;
DEPLOY DOCKER;

Create local profiles

terminal

raiql env list
raiql env init development
raiql env init staging
raiql env check development

Where local values live

Local profile values are stored under .raiql/env and ignored by Git. Do not paste production secret values into documentation, commits or app.raiql.

project

.raiql/
└── env/
    ├── development.env
    ├── staging.env
    └── production.env

Run an explicit profile

terminal

raiql dev --env development
raiql test --env staging
raiql build --env production

Production rule

RAIQL ruleFor production, map declared secret names to your deployment platform's secret manager. RAIQL's cloud adapters generate mappings/placeholders, not secret values.

Previous← Testing a RAIQL Application NextDeploy a RAIQL Application →