adcp/fly.toml at main · adcontextprotocol/adcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
# fly.toml app configuration file generated for adcp-docs on 2025-09-10T17:46:00Z
# See https://fly.io/docs/reference/configuration/ for information about how to use this file.

app = 'adcp-docs'
primary_region = 'iad'

[build]
  dockerfile = "Dockerfile"

# Run migrations ONCE before deployment, not on every machine startup
# If this fails, the deployment is rolled back automatically
[deploy]
  # The external matched-v4 evaluator bootstrap is run from a protected
  # deployment control plane. App machines receive no operator credential;
  # this migrator records that schema only on an evaluator-enabled release.
  # Ordinary releases skip evaluator-only migrations.
  release_command = "node dist/db/migrate.js"
  release_command_timeout = "15m"
  strategy = "rolling"
  wait_timeout = "10m"
  # CI deploys web with bluegreen, then worker with rolling using the same
  # image. Keep the default rolling for singleton worker/operator deployments.

[processes]
  # Leave room for native buffers and the OS within the 4 GB web allocation.
  web = "node --max-old-space-size=2048 dist/index.js"
  worker = "node dist/index.js"

[env]
  PORT = "8080"
  BASE_URL = "https://agenticadvertising.org"
  # Disabled - migrations now run via release_command
  RUN_MIGRATIONS = "false"
  # Let the first connection finish after cold documentation indexing.
  # The startup probe adds five seconds of query headroom to this timeout.
  DATABASE_CONNECTION_TIMEOUT_MS = "10000"
  # Enable only after the private GCS canary gates in the reporting runbook pass.
  TRAINING_REPORTING_GCS_ENABLED = "false"
  TRAINING_REPORTING_GCS_CREDENTIALS_FILE = "/run/training-reporting-gcp.json"
  # The dedicated external_account configuration obtains short-lived Fly OIDC.
  GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES = "1"
  # Enable after WorkOS Connect setup and real buyer sign-in qualification.
  TRAINING_BUYER_OAUTH_ENABLED = "false"
  # Global response policy, including existing threads and every delivery channel.
  # Roll back with ADDIE_RESPONSE_PROVIDER=sonnet; fallback is a separate opt-in.
  ADDIE_RESPONSE_PROVIDER = "gemini"
  ADDIE_RESPONSE_AUTOMATIC_FALLBACK = "true"
  # Historical experiment enrollment settings do not override the global policy.
  ADDIE_GEMINI_DIRECT_MODE = "eligible"
  ADDIE_GEMINI_DIRECT_PERCENT = "100"
  ADDIE_GEMINI_DIRECT_ANONYMOUS_WEB_ENABLED = "true"
  ADDIE_GEMINI_DIRECT_ANONYMOUS_WEB_PERCENT = "100"
  PUBLISHER_CRAWL_QUEUE_ENABLED = "true"
  # Bounded, evaluation-only Luna router shadow. The runtime additionally
  # fails closed unless the channel is public and non-shared and the HMAC and
  # OpenAI provider secrets are present. No shadow output reaches users.
  ADDIE_ROUTER_LUNA_SHADOW_ENABLED = "true"
  ADDIE_ROUTER_LUNA_SHADOW_PRODUCTION_DATA_APPROVED = "true"
  # Governance, campaign lifecycle, creative, and the general community channel.
  ADDIE_ROUTER_LUNA_SHADOW_CHANNEL_IDS = "C09NUQS93DF,C09BK148CLU,C09C7PLE5B8,C09B9S23KAP"
  ADDIE_ROUTER_LUNA_SHADOW_SAMPLE_BPS = "10000"
  ADDIE_ROUTER_LUNA_SHADOW_DAILY_LIMIT = "10"
  ADDIE_ROUTER_LUNA_SHADOW_DAILY_BUDGET_MICROS = "140000"
  ADDIE_ROUTER_LUNA_SHADOW_HMAC_KEY_VERSION = "governance-pilot-v1"
  # AdCP 3.2 beta is public; expose the deterministic proposal-negotiation labs.
  ENABLE_ADCP_3_2_PROPOSAL_PROFILES = "true"
  # Experimental AdCP 3.3 identity lab on the training agent: Web Bot Auth,
  # open sandbox onboarding, and demand-side trust.json grants at
  # /sales/identity/mcp. Only its fictional fixture identities resolve.
  ENABLE_ADCP_3_3_IDENTITY_ROUTE = "true"
  # Isolated, synchronous creative buyer lab on the frozen 3.3 beta contract.
  ENABLE_ADCP_3_3_CREATIVE_ROUTE = "true"
  # Deployment-time ceiling for the issue #6827 read-only authorization canary.
  # The database runtime gate remains independently disabled until explicitly armed.
  ORG_AUTHORIZATION_ENFORCEMENT_ENABLED = "true"
  ORG_AUTHORIZATION_ENFORCEMENT_BOUNDARIES = "organization_roles_read,organization_domains_read,organization_pending_join_request_count_read,organization_pending_join_requests_read,organization_referral_codes_read,organization_certification_stalled_count_read,organization_domain_users_read"
  # Use pre-cloned repos from Docker build, skip runtime git fetch.
  # Production image has no git binary — unsetting this degrades gracefully
  # (repos skip indexing) but does not crash.
  SKIP_REPO_SYNC = "true"

[http_service]
  internal_port = 8080
  force_https = true
  auto_stop_machines = "off"
  auto_start_machines = true
  min_machines_running = 2
  processes = ["web"]

  [[http_service.checks]]
    interval = "15s"
    timeout = "20s"
    grace_period = "60s"
    method = "GET"
    path = "/ready"
    protocol = "http"
    tls_skip_verify = false

    [http_service.checks.headers]
      User-Agent = "Fly Health Check"

# Worker process group config.
#
# The `[[services]]` block here exists only to attach an http_check to the
# worker process group. `auto_start_machines` and `min_machines_running`
# are SET but INERT — Fly only enforces them via fly-proxy, and without a
# `[[services.ports]]` block fly-proxy doesn't route to this service. The
# watchdog at server/src/services/worker-watchdog.ts polls the worker
# directly over 6PN, so its traffic also bypasses fly-proxy and cannot
# trigger autostart.
#
# Rolling deploys can leave the worker `stopped` (flyctl does not always
# issue MachineStart after MachineUpdate). Active recovery now lives in
# the watchdog: when a probe fails, it calls the Fly Machines API to
# start any stopped worker machines. Requires `FLY_API_TOKEN` secret.
[[services]]
  internal_port = 8080
  protocol = "tcp"
  processes = ["worker"]
  auto_start_machines = true
  auto_stop_machines = "off"
  min_machines_running = 1

  [[services.http_checks]]
    interval = "15s"
    timeout = "20s"
    grace_period = "60s"
    method = "GET"
    path = "/health"
    protocol = "http"
    tls_skip_verify = false

[[vm]]
  processes = ["web"]
  memory = "4gb"
  cpu_kind = "performance"
  cpus = 2

[[vm]]
  processes = ["worker"]
  # Persist the production incident remediation from PR #7282; keeping the
  # worker resize in config prevents the next deploy from undoing it.
  memory = "8gb"
  cpu_kind = "performance"
  cpus = 2

# Provisioned external_account configuration; no service-account private key.
# Stage this secret before deploying the credential-file materialization.
[[files]]
  guest_path = "/run/training-reporting-gcp.json"
  secret_name = "TRAINING_REPORTING_GCS_CREDENTIALS_BASE64"