How we replaced .env files across 5 microservices without touching the app code

The .env file tax is real. Every time we onboard a new developer, someone has to share credentials over Slack. Every time we add a service, there's another .env.example to maintain. By our fifth microservice, we had a mess. This is the story of how we moved all five services to a central secrets manager — without touching a single line of app code. The Problem We Had Our stack looked something like this: api-gateway — Node.js, reads 12 env vars auth-service — Node.js, reads 8 env vars billing-service — Node.js, reads 6 env vars notification-service — Python, reads 5 env vars analytics-worker — Go, reads 4 env vars Each service had its own .env.example . New developer? "Hey, ask someone for the values." Production values? "Check the secret Notion page." Rotation? "Good luck, touch every service manually." The breaking point came when we rotated a database password and missed one service. Three hours of debugging a production incident traced back to a stale .env file. Why Not Just Vault?