Configuration: appsettings, переменные среды, IOptions<T>, secrets?

{
  "ConnectionStrings": { "Default": "Host=localhost;Database=shop;Username=app" },
  "Smtp": { "Host": "localhost", "Port": 25, "From": "noreply@example.uz", "EnableSsl": false },
  "Features": { "NewCheckout": false },
  "Logging": { "LogLevel": { "Default": "Information" } }
}

export ConnectionStrings__Default="Host=db;Database=shop;Username=app;Password=***"
export Smtp__Host="smtp.sendgrid.net"
export Smtp__Port=587
export ASPNETCORE_ENVIRONMENT=Production

string? conn = builder.Configuration.GetConnectionString("Default");
int port = builder.Configuration.GetValue<int>("Smtp:Port", defaultValue: 25);
IConfigurationSection smtp = builder.Configuration.GetSection("Smtp");

public sealed class SmtpOptions
{
    public const string Section = "Smtp";

    [Required] public string Host { get; init; } = "";
    [Range(1, 65535)] public int Port { get; init; } = 25;
    [Required, EmailAddress] public string From { get; init; } = "";
    public bool EnableSsl { get; init; }
}

builder.Services.AddOptions<SmtpOptions>()
    .BindConfiguration(SmtpOptions.Section)
    .ValidateDataAnnotations()
    .Validate(o => !o.EnableSsl || o.Port != 25, "SSL на порту 25 не поддерживается")
    .ValidateOnStart();                                  // ошибка конфигурации = приложение не стартует

public sealed class EmailSender(IOptions<SmtpOptions> options)
{
    private readonly SmtpOptions _smtp = options.Value;
}

public sealed class FeatureFlags(IOptionsMonitor<FeaturesOptions> monitor) : IDisposable
{
    private readonly IDisposable? _sub = monitor.OnChange(o => Console.WriteLine($"NewCheckout = {o.NewCheckout}"));
    public bool NewCheckout => monitor.CurrentValue.NewCheckout;
    public void Dispose() => _sub?.Dispose();            // отписаться, иначе утечка
}

builder.Services.Configure<StorageOptions>("images", builder.Configuration.GetSection("Storage:Images"));
builder.Services.Configure<StorageOptions>("documents", builder.Configuration.GetSection("Storage:Documents"));

public class FileService(IOptionsMonitor<StorageOptions> opts)
{
    private readonly StorageOptions _images = opts.Get("images");
}

dotnet user-secrets init
dotnet user-secrets set "Smtp:Password" "local-dev-password"
# хранится в профиле пользователя (%APPDATA%\Microsoft\UserSecrets\<id>\secrets.json), не в репозитории

builder.Configuration.AddAzureKeyVault(
    new Uri("https://shop-kv.vault.azure.net/"),
    new DefaultAzureCredential());       // Managed Identity — без паролей в коде
// Секрет с именем "Smtp--Password" станет ключом "Smtp:Password"