Skip to content

← Back to standards

Naming conventions

Use the same words everywhere—Git branch, Fly app, Cloudflare hostname, and Atlas labels should trace back to the GitHub repo name without a lookup table.

Pattern list

Section titled “Pattern list”
AreaPatternExamples
Git branch (sacred)staging, uat, mainNever production, prod, or master for deploy
Fly config filefly.<branch>.tomlfly.staging.toml, fly.uat.toml, fly.main.toml
GitHub workflowfly-deploy-<branch>.ymlfly-deploy-staging.yml, fly-deploy-main.yml
Fly app nameRepo name + tier suffix when neededpenn-station-api (prod), penn-station-staging-api, usfs-api-staging
Cloudflare hostnameProduct URL; staging often prefixeds-api-portal… → staging app, api-portal… → production
Tunnel originhttp://<fly-app-name>.internal:8080Must match Fly app = in fly.*.toml
Sentry projectUsually repo namepenn-station-api, usfs-api
MongoDB Atlas IP accessLabel = Fly app + tier + egresspenn-station-staging-api — Fly egress iad

Git repos — staging and main

Section titled “Git repos — staging and main”
  • staging branch → staging Fly org, staging secrets, staging hostnames.
  • main branch → production Fly org (file still named fly.main.toml, not fly.production.toml).
  • uat when the product has a UAT tier—same rules as staging.

See Branches and GitHub for the full sacred-branch table.

Fly — use the repo name

Section titled “Fly — use the repo name”
  • Start from the GitHub repo name (e.g. penn-station-api, creed-api, usfs-api).
  • Production Fly app = is often the repo name or repo + clear prod suffix (creed-api-prod, usfs-api-production)—pick one style per repo and stay consistent.
  • Staging adds a tier suffix: -staging-api, -staging, or -staging-api pattern already in use—must match the Cloudflare .internal origin.

Do not invent unrelated Fly app names that do not map to the repo.

MongoDB Atlas — IP access rule naming

Section titled “MongoDB Atlas — IP access rule naming”

When an API uses a dedicated Fly egress IPv4 (see Fly.io):

  1. Allocate egress once per Fly app: fly ips allocate-egress --region iad -a <fly-app-name> --yes

  2. In Atlas → Network Access → IP Access List, add the egress IP (from fly ips list, type egress).

  3. Name the rule so it is obvious in audits:

    <fly-app-name> — Fly egress (iad)

    Examples: penn-station-staging-api — Fly egress (iad), usfs-api-production — Fly egress (iad).

  4. One rule per Fly app per environment—staging egress ≠ production egress.

Mongo IP access rules rotate when egress is re-allocated or apps move tiers. That rotation is part of the SDLC timeline key-rotation goal—not a one-time setup.

Keys and credentials to manage

Section titled “Keys and credentials to manage”

Rotation inventory with priority, what each key protects, and proposed schedule (mostly TBD today): Rotation inventory.

Section titled “Related”