Repository navigation
Expand file tree
/
Copy pathfly.toml
More file actions
124 lines (111 loc) · 4.1 KB
/
Copy pathfly.toml
File metadata and controls
124 lines (111 loc) · 4.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
# Fly.io deployment for the Postil control plane.
#
# Three process groups share one image: `web` serves the Next.js app, `worker`
# runs the job queue, and `monitor` owns private production monitoring. Set
# secrets before the first deploy:
#
# fly secrets set DATABASE_URL=... POSTIL_SESSION_SECRET=... \
# GITHUB_WEBHOOK_SECRET=... GITHUB_OAUTH_CLIENT_ID=... \
# GITHUB_OAUTH_CLIENT_SECRET=... POSTIL_SEALING_KEY=... \
# GITHUB_APP_ID=... GITHUB_APP_PRIVATE_KEY=... MODEL_API_KEY=... \
# POSTIL_API_KEY=... METRICS_TOKEN=... POSTHOG_PROJECT_TOKEN=...
#
# Browser PostHog receives the public project token from a runtime route so
# POSTHOG_CLIENT_CAPTURE can disable initialization without rebuilding.
#
# The release command runs the current release preparation before rolling
# updates. Existing reviews remain available. Schema changes and data retirement
# use separate reviewed maintenance operations.
app = "postil-web"
primary_region = "lhr"
kill_signal = "SIGTERM"
# The worker drains in-flight reviews on SIGTERM (finish-naturally window,
# then abort and requeue); the timeout must cover the drain and settle
# windows below plus the requeue writes.
kill_timeout = "120s"
[build]
[build.args]
# GitHub Actions supplies the required compatible release tag.
NEXT_PUBLIC_POSTHOG_HOST = "https://eu.i.posthog.com"
[deploy]
strategy = "rolling"
release_command = "bun scripts/start-managed-process.ts release"
[processes]
web = "bun scripts/start-managed-process.ts web"
worker = "bun scripts/start-managed-process.ts worker"
monitor = "bun scripts/start-managed-process.ts monitor"
[[restart]]
policy = "on-failure"
retries = 10
processes = ["worker"]
[env]
NODE_ENV = "production"
POSTIL_PUBLIC_URL = "https://postil.dev"
GITHUB_APP_SLUG = "postil-dev"
POSTIL_BIN = "/usr/local/bin/postil"
POSTIL_DB_POOL_MAX = "2"
# The pinned CLI owns the managed roster. This switch permits hosted inference;
# compatibility checks remain part of the deployment path.
POSTIL_HOSTED_INFERENCE_ENABLED = "1"
POSTIL_PROVISIONAL_HOSTED_ROSTER = "1"
POSTIL_WEBHOOK_DRAIN_ENABLED = "1"
POSTIL_QUEUE_DRAIN_MAX_JOBS = "1"
POSTIL_QUEUE_DRAIN_DEADLINE_MS = "720000"
WORKER_CONCURRENCY = "1"
WORKER_PER_ORG_CONCURRENCY = "2"
WORKER_POLL_INTERVAL_MS = "1000"
WORKER_IDLE_POLL_MAX_MS = "900000"
WORKER_WATCHDOG_INTERVAL_MS = "60000"
WORKER_SHUTDOWN_DRAIN_MS = "60000"
WORKER_SHUTDOWN_SETTLE_MS = "30000"
WORKER_HEARTBEAT_INTERVAL_MS = "30000"
POSTIL_MONITOR_INTERVAL_MS = "300000"
POSTIL_MONITOR_ALERT_STATE_PATH = "/var/lib/postil-monitor/alert-state.json"
POSTIL_OPENROUTER_REVIEW_OUTAGE_THRESHOLD_USD = "1"
POSTHOG_SERVER_CAPTURE = "1"
POSTHOG_CLIENT_CAPTURE = "1"
POSTHOG_ERROR_CAPTURE = "1"
POSTHOG_LOG_CAPTURE = "1"
NEXT_PUBLIC_POSTHOG_HOST = "https://eu.i.posthog.com"
POSTIL_OPERATOR_ALERT_EMAIL = "hello@postil.dev"
[[mounts]]
source = "postil_monitor_state"
destination = "/var/lib/postil-monitor"
processes = ["monitor"]
initial_size = "1gb"
snapshot_retention = 1
[http_service]
processes = ["web"]
internal_port = 3000
force_https = true
# The control plane must stay warm to receive GitHub webhooks promptly; a
# stopped machine that the proxy has to cold-start drops/retries deliveries and
# produced lease contention and machine-API rate-limit errors. Keep both web
# machines running (min = 2, no auto-stop): with min = 1 the second machine sat
# stopped and the proxy 5xx'd trying to wake it on demand during deploys, which
# an operational audit caught hitting /api/webhooks/github.
auto_stop_machines = false
auto_start_machines = true
min_machines_running = 2
[[http_service.checks]]
interval = "15s"
timeout = "5s"
grace_period = "20s"
method = "GET"
path = "/api/health"
# 512mb produced recurring OOM kills of the Next.js server (exit 137,
# oom_killed) with intermittent 5xx and fail-closed error pages while the
# machine restarted; observed four kills across both web machines on a single
# day. Web serves SSR plus the API surface and needs the headroom.
[[vm]]
processes = ["web"]
size = "shared-cpu-1x"
memory = "1gb"
[[vm]]
processes = ["worker"]
size = "shared-cpu-1x"
memory = "512mb"
[[vm]]
processes = ["monitor"]
size = "shared-cpu-1x"
memory = "256mb"