03-Feb-2026 — Secrets, Paths and 4 more areas: 6 features and 1 fix #146

build 459 — commit c19b47d

Add loadSecretsWithFallback and loadSecretsForEnvironmentFromDatabase to support reading secrets from the database ENVIRONMENTS config when running on deployed servers. Falls back to file-based secrets for local development. Secrets are built from:

• Global aws config and secrets from EnvironmentsConfig
• Per-environment aws, mongo, and secrets from EnvironmentConfig
• MongoDB URI is constructed from mongo config fields

cli: add GitHub secrets sync command for environment management (#146)

Add ngx-cli github command with reconcile, sync, and push subcommands to manage the CONFIGS_JSON GitHub secret from the database source of truth. This enables regular syncing when environments are created or modified.

backup: global AWS credentials, S3 path improvements, and DRY refactoring (#146)

User Guide

Global Backup Configuration

You can now configure global AWS credentials in the Settings tab under 'Global AWS S3 Configuration'. This allows a single set of credentials to manage backups across all environments, with per-environment settings used as fallback. New Settings Fields:

• Access Key ID
• AWS access key with S3 permissions
• Secret Access Key
• Corresponding secret key

Backup Improvements

• Backups are now organised by environment and timestamp in S3: <environment>/<timestamp>/
• Upload progress is displayed in the History tab logs
• Server-side logging reduced to show only meaningful operations

Environment Configuration

• MongoDB URI can now be pasted directly
• fields auto-populate from the connection string
• All environment configs support AWS, MongoDB, and Fly.io credentials in one place

Technical Changes

S3 Path Construction

• New backup-paths.ts with pure utility functions for S3 key construction
• 22 unit tests covering path building and parsing
• Simplified path structure: <env>/<timestamp> instead of <env>/<db>/<timestamp>

DRY Refactoring

• Consolidated uploadDirectoryToS3 from 3 duplicate implementations into server/lib/aws/s3-utils.ts
• Added factory functions: createEmptyAwsConfig(), createEmptyMongoConfig()
• EnvironmentBackupConfig and BackupConfig now type aliases for EnvironmentConfig and EnvironmentsConfig
• Eliminated inline interface definitions in favour of model imports

Credential Resolution

• preferredCredentials() method prioritises global AWS credentials over per-environment
• preferredBucket() and preferredRegion() follow same pattern
• bucketExists() check prevents AccessDenied errors when credentials lack CreateBucket permission

Code Quality

• Removed verbose debug logging from backup controller and websocket server
• Method naming follows project conventions (no 'get' prefix)
• All config model types centralised in environment-config.model.ts

environment-setup: comprehensive environment management overhaul with API and MongoDB migration (#146)

Introduces new environment configuration API, MongoDB cluster-based config, and enhanced UI with vendor branding and dashboard links. New Environment Configuration API:

• RESTful endpoints for reading and writing environment configurations
• EnvironmentConfigService for centralised config management
• Separation of concerns: environment config extracted from backup/restore
• Config initialisation from files with validation and error handling MongoDB Configuration Migration:
• Migrate from uri field to cluster field in MongoDB configuration
• Cluster field stores cluster name without .mongodb.net suffix
• Database migration script (20260201000000) converts existing records
• Backward compatible: handles both legacy URI and new cluster formats
• Improved regex parsing for cluster extraction from URIs Enhanced Environment Setup UI:
• Vendor logos in all configuration section headings
• Ramblers logo dynamically loaded from System Settings
• AWS, MongoDB, and Fly.io static brand logos
• External link buttons for quick dashboard access:
• AWS S3 Console (global and per-environment bucket views)
• MongoDB Atlas dashboard
• Fly.io app-specific dashboard
• Deployed application URL
• Environment list alphabetically sorted by name
• Improved visual spacing and button styling consistency Backend Architecture Improvements:
• New environments-config.ts module for config operations
• Enhanced config-initializer with cluster field population
• Updated backup/restore service to use new config service
• CLI tools migrated to cluster-based MongoDB configuration
• Fly.toml path resolution fixed for compiled environments Technical Implementation:
• New EnvironmentConfig and EnvironmentsConfig models
• Integration with SystemConfigService for dynamic Ramblers logo
• Custom .btn-outline-flyio styling for brand consistency
• Shared sortBy() utility for environment sorting
• Type-safe API routes with proper error handling

environment-setup: add automated environment creation and CLI enhancements (#146)

New Features for Users: Environment Setup (Web UI) The new Environment Setup page (Admin > Environment Setup) allows administrators to create complete NGX-Ramblers environments for new Ramblers walking groups through a guided wizard:

1. Enter your Ramblers API key and select your walking group
2. Configure external services (MongoDB, AWS, Brevo email, maps)
3. Set up an admin user account
4. Deploy to fly.io with one click The wizard handles all infrastructure provisioning automatically including:

• Cloud database setup and configuration
• File storage (AWS S3) with secure credentials
• Application deployment to fly.io
• Sample content and admin menu setup
• Optional standard assets (logos, icons, backgrounds) copied to S3 Command Line Interface (CLI) A new CLI tool is available for power users and automation. See the full reference guide at: Admin > How-To > Technical Documents > "NGX Ramblers CLI Reference Guide" Quick start: npm run cli -- # Run from project root npm link && ngx-cli # Or install globally (optional) Common commands: ngx-cli l dev my-group # Start local development ngx-cli l list # List available environments ngx-cli db seed my-group --fresh # Fresh database seed with migrations ngx-cli db seed my-group --sync # Seed and sync walks from Ramblers API ngx-cli f deploy my-group # Deploy to fly.io ngx-cli des my-group # Destroy environment completely ngx-cli bak create my-group # Backup an environment ngx-cli bak restore my-group # Restore from backup Interactive mode: Run commands without arguments to get a selection menu. Use arrow keys to navigate, ESC to go back, q to quit.

Technical Changes: CLI Implementation:

• Add command aliases (env, db, val, des, l, f, a, bak)
• Add positional arguments instead of --name options
• Add interactive navigation with inquirer.js
• Add port availability checking for local dev
• Run migrations automatically after database seeding
• Add backup/restore commands (bak create, bak restore, bak list) Database & Migrations:
• Add Duplicate Page Content and Venue Settings to admin menu
• Add showPlaceholderImage to walks action buttons
• Include all 23 production admin menu items in migrations Environment Setup Service:
• Integrate with Ramblers API for group validation
• Automate AWS S3/IAM resource creation
• Automate fly.io deployment with secrets
• Create database config templates for new groups
• Add WebSocket progress feedback for real-time step updates
• Add copyStandardAssets option to seed S3 with logos/icons/backgrounds
• Add OS Maps and reCAPTCHA defaults from environment variables
• Add detailed MongoDB connection error messages with suggestions
• Add ENVIRONMENT_SETUP_ENABLED env var to control UI access

release-notes: add technical article publishing script

• Add publish-technical-article.ts for publishing markdown articles to CMS
• Use shared date utilities and UIDateFormat enum for DRY date formatting
• Add DAY_MONTH_YEAR_DASHED format to UIDateFormat enum
• Disable Manage Venues button when form is disabled
• Remove unused code from venue-lookup.ts

paths: use resolveClientPath for non-vcs file access (#146)

Fix path resolution for secrets and configs.json files when running in production mode where code executes from ts-gen directory.