fly.toml

# authGD — one image, two process groups + release-time migrations.
app = "authgd"
primary_region = "iad"

[build]

[deploy]
  release_command = "npm run db:migrate"

[processes]
  web = "node web/server.js"
  worker = "npx tsx src/worker/index.ts"

[http_service]
  internal_port = 3000
  force_https = true
  auto_stop_machines = false
  auto_start_machines = true
  min_machines_running = 1
  processes = ["web"]

# Restart policy, stated explicitly rather than inherited. Governs unexpected
# process *exits* — NOT health check results. A failing check below only stops
# the proxy routing to the machine; it never restarts or replaces it, and
# recovery from that state is manual (`fly machine restart`).
#
# `on-failure` with retries=10 is already the Fly default, but leaving it
# implicit is what made the original incident invisible: the worker burned all
# ten restarts and then stopped, and nothing in this file recorded that a limit
# even existed. Writing it down makes the ceiling reviewable — and makes clear
# that exceeding it leaves the machine stopped, with the boot-failure webhook
# in src/worker/index.ts the only thing that will tell you.
[[restart]]
  policy = "on-failure"
  retries = 10
  processes = ["web", "worker"]

[env]
  HOSTNAME = "0.0.0.0"
  PORT = "3000"

# web only. /api/health/sync is deliberately absent: a failing check pulls the
# machine out of the load balancer and gates deploys, so wiring worker freshness
# here would take the site down over a fault unrelated to serving pages.
#
# /api/health itself depends on Postgres, and this check has no
# consecutive-failure threshold, so a single blip — including a
# planned Postgres patching window — takes every web machine out of rotation
# simultaneously; they all share one database. Accepted: without Postgres the
# app cannot serve anything useful, so pulling machines that can't reach it is
# the right call. Consequence: once the proxy stops routing, Fly cannot tell
# you the app is down. The external monitor (docs/ops.md) is the party that
# still can.
[[http_service.checks]]
  interval = "30s"
  # Above the 5s pool connection timeout in src/db/index.ts, so a database that
  # is up but slow returns the app's own 503 with `db: "error"` — a usable
  # diagnosis — instead of an opaque proxy timeout at the same instant.
  timeout = "10s"
  grace_period = "10s"
  method = "GET"
  path = "/api/health"

# Sizing declared here rather than left in `fly scale` state, so it is reviewable
# and cannot drift silently. The worker runs tsx and transpiles at runtime, which
# is why 256mb was the riskier setting for it than for the compiled web server.
[[vm]]
  memory = "512mb"
  cpu_kind = "shared"
  cpus = 1
  processes = ["web"]

[[vm]]
  memory = "512mb"
  cpu_kind = "shared"
  cpus = 1
  processes = ["worker"]