Rust Config
Rule
Configuration must be explicit, typed, validated, and testable. Keep loading separate from
business logic and pass typed config into services.
Hard Stops
Ask before:
- Changing precedence, variable names, defaults, file locations, or compatibility contracts.
- Reading global machine files, user home config, real secrets, or production env by default.
- Adding config libraries for simple env/CLI needs.
- Logging config that may contain secrets.
Defaults
- Prefer Clap/env/std parsing for simple apps.
- Use typed structs with
serde when files are needed.
- Use
figment or config only for layered config from files/env/CLI and only when
approved or already present.
- Define precedence explicitly, commonly: defaults < config file < environment < CLI.
- Validate once at startup and fail fast with actionable errors.
- Use
secrecy/redaction wrappers for secret values when they may be logged or debugged.
Workflow
- Define settings, defaults, required values, validation, and precedence.
- Implement loaders that accept explicit sources for tests.
- Avoid reading env/files inside domain logic.
- Add tests for defaults, overrides, precedence, validation errors, and redaction.
- Run tests and
just check.
Antipatterns
- Global mutable config.
- Hidden environment reads deep in libraries.
.env loading in production paths without policy.
- Printing full config structs with secrets.
Completion
Report config contract, precedence, secret handling, dependencies, tests, and validation
results.
Source: nyquistwilder/personal-pi — distributed by TomeVault.
1---2name: rust-config-23description: Greenfield Rust configuration workflow for typed settings, environment variables, config files, CLI overrides, defaults, validation, precedence rules, secret redaction, and test isolation. Use when this capability is needed.4---56# Rust Config78## Rule910Configuration must be explicit, typed, validated, and testable. Keep loading separate from11business logic and pass typed config into services.1213## Hard Stops1415Ask before:1617- Changing precedence, variable names, defaults, file locations, or compatibility contracts.18- Reading global machine files, user home config, real secrets, or production env by default.19- Adding config libraries for simple env/CLI needs.20- Logging config that may contain secrets.2122## Defaults2324- Prefer Clap/env/std parsing for simple apps.25- Use typed structs with `serde` when files are needed.26- Use `figment` or `config` only for layered config from files/env/CLI and only when27 approved or already present.28- Define precedence explicitly, commonly: defaults < config file < environment < CLI.29- Validate once at startup and fail fast with actionable errors.30- Use `secrecy`/redaction wrappers for secret values when they may be logged or debugged.3132## Workflow33341. Define settings, defaults, required values, validation, and precedence.352. Implement loaders that accept explicit sources for tests.363. Avoid reading env/files inside domain logic.374. Add tests for defaults, overrides, precedence, validation errors, and redaction.385. Run tests and `just check`.3940## Antipatterns4142- Global mutable config.43- Hidden environment reads deep in libraries.44- `.env` loading in production paths without policy.45- Printing full config structs with secrets.4647## Completion4849Report config contract, precedence, secret handling, dependencies, tests, and validation50results.5152---53> Source: [nyquistwilder/personal-pi](https://github.com/nyquistwilder/personal-pi) — distributed by [TomeVault](https://tomevault.io).54<!-- tomevault:4.0:skill_md:2026-06-16 -->