I want to set some environment variables on my linux box that can be accessed by a node.js server. These variables will contain sensitive information like database passwords and API keys.
My current setup is that a user with nearly no privileges (it can't even sudo) runs the node.js server. Because I want to limit what this user can do/know to just running the server (misguided?), I don't want to put the env variables in the user's ~/.bash_profile.
So my thought was to put the environment variables needed for the server into /etc/profile; that way, the low privilege user running the server wouldn't have the variables in their config, but could still use them. However, the permissions on /etc/profile are such that everyone has read access which makes logical sense but leaves me back where I started.
What is the best practice for web server environment variables on a linux system? If they can always be read by any user then what makes environmental variables a better practice than just importing a text file with keys and values located at the project root into the web server (like dotenv)? Is it that environment variables aren't a security thing and rather just a best practice of maintenance which is why I can't connect the dots here?