Should instance/config.py be uploaded to the production server when deploying a Flask app? [duplicate] - nginx

Question

This question already has answers here:
Where should I place the secret key in Flask?
(2 answers)
Closed 4 years ago.
I'm preparing to deploy a small Flask app that I've developed for internal use. I have an old laptop with Ubuntu Server 16.04, uWSGI and Nginx which I'll use for deployment.
OPTION 1
My current app setup has an instance/config.py file that I've kept out of version control. This file contains the following:
SECRET_KEY = ...
SQLALCHEMY_DATABASE_URI = ...
# Google 'client_id' and 'client_secret' for social authentication functionality.
The instance/config.py file is loaded as follows in app/__init__.py:
def create_app(config_name):
app = Flask(__name__, instance_relative_config=true)
app.config.from_object(app_config[config_name])
app.config.from_pyfile('config.py')
Is it safe to keep this same setup for production and thus have the instance/config.py file in the production server?
OPTION 2
Alternatively, should I be using environment variables? If this were the case, should I do something like so in wsgi.py:
os.environ['FLASK_CONFIG'] = 'production'
os.environ['SECRET_KEY'] = ...
os.environ['SQL_ALCHEMY_DATABASE_URI'] = ...
and then have the following in app/__init__.py:
def create_app(config_name):
if os.getenv('FLASK_CONFIG') == 'production':
app = Flask(__name__)
app.config.update(
SECRET_KEY=os.getenv('SECRET_KEY')
SQLALCHEMY_DATABASE_URI=os.getenv('SQLALCHEMY_DATABASE_URI')
)
else:
app = Flask(__name__, instance_relative_config=true)
app.config.from_object(app_config[config_name])
app.config.from_pyfile('config.py')

Answer 1

To answer the question, yes it's safe as long as your server is secure. Hopefully access is only allowed using a private key. If you're using a password to login, then that may be a problem.
It's a good idea to keep the actual file used to load configuration out of version control. I actually made a mistake with one of my servers where I did put config.py in version control and now I have to be careful each time I pull not overwrite the file.
One thing that you could do is to have a config file for each environment, say prod.py and dev.py, that are both checked in. Then create a pointer.py that is not checked into version control.
prod.py
SECRET_KEY = ...
SQLALCHEMY_DATABASE_URI = ...
...
pointer.py
from prod import SECRET_KEY, SQLALCHEMY_DATABASE_URI, ...
server.py
app.config.from_pyfile('pointer.py')
In dev, simply change the import statement to point to dev.py. You could also do from prod import *, but that isn't very good practice.