Improve .env.* usage

[blainekasten]

Summary

Our current setup with .env.development and .env.production has some limitations.

• First it is confusing that command line variables must be prefixed with GATSBY_ to end up in the client bundle while the .env files do not have this rule.
• Secondly we have had security issues with hacky patches to fix the fact that .env files are used for both server and client development.
• Third loading .env files for server development requires the users to load them in user code.

Basic example

From a conversation with @pieh here (sorry its a slack conversation), we think it would be good to make the following changes.

1. Deprecate and remove the basic .env.(dev|prod) files
2. Replace with .env.node.(dev|prod) that would hold node only variables that would get loaded for node runtime
3. Replace with .env.browser.(dev|prod) that would hold only variables that should be exposed to the browser. In addition this file would require all variables be prefixed by GATSBY_ to remain consistent.

Motivation

The motivation is to allow our APIs to remain clear and prevent security holes.

[muescha]

there was also a confusion between .dev and .prod:

#19388 Gatsby automatically loading dotenv in an undocumented way

i think the arguments there can also goes into consideration ...

[github-actions[bot]]

Hiya!

This issue has gone quiet. Spooky quiet. 👻

We get a lot of issues, so we currently close issues after 30 days of inactivity. It’s been at least 20 days since the last update here.
If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. Check out gatsby.dev/contribute for more information about opening PRs, triaging issues, and contributing!

Thanks for being a part of the Gatsby community! 💪💜