FeathersJS production.json: duplicate full nested objects or switch to a custom deep-merge config setup?

Resolution: Use a Custom Deep-Merge Layer

For production FeathersJS (Dove) deployments, you should switch to a custom deep-merge configuration setup rather than duplicating nested objects. Full duplication in production.json is the default behavior of the config module, but it is not a recommended pattern for maintainable production apps due to the high risk of configuration drift.

The Technical Gap

The config npm module performs a shallow merge. When it encounters a key in production.json that already exists in default.json, it replaces the entire value. If that value is an object (like your authentication block), the entire object is swapped, erasing any nested keys not explicitly redefined in the production file.

Implementation Steps

To enable partial overrides and prevent runtime crashes, implement a merge and validation utility during the application bootstrap process (typically in src/app.ts or a dedicated config loader):

1. Install a deep-merge utility: Use a library like lodash.merge to handle the recursive combination of objects.
2. Wrap the config load: Instead of accessing config directly throughout the app, create a configuration provider that merges the config output with any necessary environment-specific overrides.
3. Implement Startup Validation: Create a validation function that runs before app.listen(). This function should check for the existence of critical keys (e.g., config.get('authentication.jwt.secret')) and throw a hard Error if they are missing.

// Example Validation Pattern
const requiredConfigs = ['authentication.jwt.secret', 'database.url'];
requiredConfigs.forEach(path => {
  if (!config.has(path)) {
    throw new Error(`Missing required configuration: ${path}`);
  }
});

Environment and Path Pitfalls

When NODE_CONFIG_DIR differs between local and container environments, the config module may fail to locate your files entirely. In containerized environments, ensure that your Dockerfile or compose file explicitly maps the config directory or sets the environment variable to an absolute path. If the module cannot find the directory, it may fallback to default.json without warning, which can lead to production apps attempting to connect to local development databases.

Diagnostic Requirement

To refine this recommendation: Are you currently using environment variables (process.env) to inject secrets into production.json, or are the secrets stored as plaintext in the JSON file? If you are using environment variables, a custom wrapper is even more critical to ensure the mapping from ENV_VAR to config object is validated at boot.