# 06-Feb-2026 — Migrations, Deploy and 2 more areas: 2 features and 2 fixes [#146](https://github.com/nbarrett/ngx-ramblers/issues/146)

## [build 468](https://github.com/nbarrett/ngx-ramblers/actions/runs/21735084758) — [commit 2f149c0](https://github.com/nbarrett/ngx-ramblers/commit/2f149c041a93af53b03e6717466b15b6798d6fe8)

_____

- Add fly.toml to Dockerfile so it's available in deployed environments
- Simplify fly deployment to read fly.toml directly instead of requiring fallback
- Fix Environment type usage in env-config and env-core
- Add FLICKR_SCRAPE_DUMP_DIR to Environment enum
(ref: #146)

### **secrets**: add database-first secrets loading for deployed servers ([#146](https://github.com/nbarrett/ngx-ramblers/issues/146))

Add loadSecretsWithFallback and loadSecretsForEnvironmentFromDatabase
to support reading secrets from the database ENVIRONMENTS config when
running on deployed servers. Falls back to file-based secrets for local
development.
Secrets are built from:
- Global aws config and secrets from EnvironmentsConfig
- Per-environment aws, mongo, and secrets from EnvironmentConfig
- MongoDB URI is constructed from mongo config fields

### **migrations**: harden geocode updates and defaults ([#146](https://github.com/nbarrett/ngx-ramblers/issues/146))

Release notes:
- Migrations: backfill notification config defaults for existing data.
- Migrations: avoid geocode failures when start location is missing.
- Migrations: ensure enquiries system role exists in committee config.
- Setup: extend default committee config and mail model fields.
- Secrets: auto-pull missing secrets from Fly.io machines via flyctl machine exec.
- Secrets: three-tier fallback — database, local file, then live Fly.io instance.
- Secrets: extract shared env parsing to env-parser.ts to avoid circular imports.
- Secrets: cache pulled secrets to local file for subsequent runs.
- Config: distinguish expired tokens from missing tokens on admin-only endpoints.
- Config: return 401 for expired tokens vs 403 for unauthenticated access.

### **paths**: use resolveClientPath for non-vcs file access ([#146](https://github.com/nbarrett/ngx-ramblers/issues/146))

Fix path resolution for secrets and configs.json files when running
in production mode where code executes from ts-gen directory.