From a66a96eae7c5f037e6cd5e6814b59ecd2066a50a Mon Sep 17 00:00:00 2001 From: Dimitri Yatsenko Date: Fri, 14 Aug 2026 16:45:09 -0500 Subject: [PATCH] docs(settings): correct the config-precedence docstring MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The module docstring listed the configuration sources in the wrong order — secrets directories above datajoint.json — contradicting the loader, where _load_secrets only assigns when a value is still unset, so datajoint.json (and env) win over .secrets/. Fix the order to: runtime > env > datajoint.json > .secrets/ > defaults, and state explicitly that the file outranks the secrets directory. Also correct the .secrets/ example: the loader reads database.* and stores.. files, not aws.secret_access_key. This is the upstream origin of the inverted-precedence docs corrected in datajoint-docs (#258). --- src/datajoint/settings.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/datajoint/settings.py b/src/datajoint/settings.py index 960fe3c65..7a4d99c1c 100644 --- a/src/datajoint/settings.py +++ b/src/datajoint/settings.py @@ -4,11 +4,17 @@ This module provides strongly-typed configuration with automatic loading from environment variables, secrets directories, and JSON config files. -Configuration sources (in priority order): +Configuration sources (highest precedence first): -1. Environment variables (``DJ_*``) -2. Secrets directories (``.secrets/`` in project, ``/run/secrets/datajoint/``) +1. Runtime assignment (``dj.config[...] = ...``) +2. Environment variables (``DJ_*``) 3. Project config file (``datajoint.json``, searched recursively up to ``.git/.hg``) +4. Secrets directories (``.secrets/`` in project, ``/run/secrets/datajoint/``) +5. Built-in defaults + +A value set by a higher source is not overridden by a lower one. In particular +``datajoint.json`` takes precedence over ``.secrets/``: the secrets directory +only supplies values the config file and environment leave unset. Examples -------- @@ -30,7 +36,7 @@ ├── datajoint.json # Project config (commit this) ├── .secrets/ # Local secrets (gitignore this) │ ├── database.password - │ └── aws.secret_access_key + │ └── stores.main.secret_key # one file per setting: database.* or stores.. └── src/ └── analysis.py # Config found via parent search """