wrangler deployment overwrites env vars in the worker

[QingjiaTsang]

I'll take the DEEPSEEK_API_KEY env var as the example.

I ran the wrangler secret put command to set all vars and then ran the deploy command. Finally, I went to the Cloudflare worker settings page to check the environment variables, and I found that all the variables and secrets were overwritten by the placeholder values from wrangler.toml.

I also tried setting the vars directly in the dashboard, but when I connected my github project to the worker and deployed again for further features, I found that placeholder values from wrangler.toml still would overwrite my environment variables.

I found that the docs say we should consider the wrangler.toml as the single source of truth, so I think maybe we should not directly set the env vars in the dashboard, but no matter how we set the env vars, it would finally get overwritten when a new deployment goes.

I started to think maybe I should gitignore the wrangler.toml file, but I saw some comments online saying that it is not necessary.

I'm so frustrated and confused about this. What exactly is the best practice about this? Could someone share your thoughts and practice? Thx in advance!

[QingjiaTsang]

Practice 1 :

• use .dev.vars for development environment vars
• make wrangler.toml.example file to record vars and secrets with placeholder values to indicate others
• set up all the vars and secrets in wrangler.toml which is git ignored

But I found that doing in this way won't trigger cicd properly when I connect my github repo to the worker because the wrangler.toml file is git ignored, so I have to manually run the deploy cli command everytime.

(This is the practice I go with.)

Practice 2:

• use .dev.vars for development environment vars
• make comments for those secrets to indicate others and hardcode the insensitive vars (you can also make comments for those insensitive vars, up to you)
• allow wrangler.toml file by git commit and push to the repo
• set sectets once when needed by using "wrangler wrangler secret put YOUR_SECRET" command before deployment

By contrast, I think this way could do the cicd properly when we connect the github repo to the worker.

whatever you go with, don't directly modify the env vars in the cloudflare dashboard, because this is not a good practice referenced from the docs.

I think both are good to follow, because they basically make the wrangler.toml the single source of truth. Personally, I perfer the first one.