Provide persistent configuration on ASP.NET Core WebApp Hosted on IIS

Question

I want to use the very simple WebDeploy feature to publish a webapp for a client via VPN.

IIS is on a client server, managed by trusted parties. I want to put my configuration parameters on said server, without having to write sensitive data in my code (and therefore source control).

        public void ConfigureServices(IServiceCollection services)
        {
            EGICContext.ConnectionString = Configuration["ConnectionString"];
            EGICContext.InMemory = Configuration["InMemory"] == "true";
            services.AddScoped((s) => new EmailSender(Configuration["EmailSMTP"]));        
        }

I created a folder on client server, and wanted to edit production configuration like I do in Azure. But this modifies the web.config file, which get overriden with each publish...

This is unacceptable behaviour as the app simply breaks without configuration. I feel this should be solvable in a matter of minutes, but I spent hours searching for a solution and nothing comes up.

I can't use appsettings.json, which get overriden also, I can't put an arbitrary secrets.json in the root folder, cause the app wont read it. Environnement variables can collide with each other and seems messy...

What am I missing?

Answer 1

Sleep does wonder, for anyone interested I edited my Program.cs

public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.UseStartup<Startup>();
            })
            .ConfigureAppConfiguration((context, args) =>
                        args.SetBasePath(context.HostingEnvironment.ContentRootPath)
                            .AddJsonFile($"secrets.json", optional: true, reloadOnChange: true));

Providing an additional file, not affected by the Publish, and stored All configuration here. This does not mess with previous configuration done by ConfigureWebHostDefaults.

I'm not sure if it's a security risk, but it does what I expect.