MongoDB

What we use MongoDB for

Use	Plain English
Application data	Documents, orders, knowledge base content, product config—whatever the API owns
Per-environment databases	Separate Atlas access per tier where policy requires isolation
IP-restricted access	Atlas allowlists the Fly app’s egress IPv4 when Network Access rules apply

Not every API uses Atlas—check each repo’s .env.example. Local dev may use a different URI; production paths use Atlas + Fly secrets.

Fly secrets (runtime)

Set with fly secrets set on each tier’s app—never commit real URIs to Git.

Secret	Purpose
MONGODB_URI	Full connection string (user, password, cluster, database) for that tier

Example:

fly secrets set MONGODB_URI='mongodb+srv://...' -a <fly-app-name>

See Fly checklist → Fly environment variables and egress note.

Atlas IP access (when required)

If Atlas uses IP Access List rules, the Fly app needs a dedicated egress IPv4:

fly ips allocate-egress --region iad -a <fly-app-name> --yes
fly ips list -a <fly-app-name>   # type egress — not ingress

In Atlas → Network Access, add that egress IP and name the rule for audits:

<fly-app-name> — Fly egress (iad)

Full naming rules: Naming conventions — MongoDB Atlas IP access.

One egress IP per Fly app per tier

• Staging egress ≠ production egress—separate Fly apps, separate Atlas rules.
• Re-allocating egress requires updating Atlas and is a rotation event.
• Skip egress allocation when the datastore does not use IP allowlists.

Environments

• Staging, UAT, and production should use separate MONGODB_URI values (and often separate Atlas projects or clusters) per policy.
• Database and cluster names should trace to the GitHub repo and tier—see Naming conventions.

Rotation and ownership

MONGODB_URI and Atlas IP rules are high / medium priority on the Rotation inventory—schedules TBD. Rotating credentials requires updating Fly secrets, redeploying the API, and confirming Atlas access still matches egress.

Related

• Fly.io — egress IPv4 when Atlas requires it
• Naming conventions — Fly app and Atlas IP rule labels
• Rotation inventory — MONGODB_URI and Atlas IP rules
• GitHub — deploy does not hold Mongo secrets
• Fly checklist — tier promotion and egress steps