Keep your deployment secrets out of your PasterDeploy configuration using Environment Variables

pyramid_main.py

import os 
from pyramid.config import Configurator


def main(global_config, **settings):
    settings = {k: os.path.expandvars(v) for k, v in settings.items()}
    config = Configurator(settings=settings)
    config.include(__name__)
    return config.make_wsgi_app()


def includeme(config):
    pass

Thanks to http://stackoverflow.com/questions/16435274/in-the-pyramid-web-framework-how-do-i-source-sensitive-settings-into-developmen/16446566#16446566

C’est beau.