fly.toml

app = "agentsync"
primary_region = "ewr"

[build]

# Startup-time configuration. AGENTSYNC_VAULT_NAME is the human-readable
# vault name written into config.toml on first launch (used by clients as
# the default local dir when running `agentsync clone <url>`).
# AGENTSYNC_AUTHORIZED_KEYS is read directly by `agentsync watch` and merged
# into the synced authorized_keys file on every start — store actual keys
# as a Fly secret rather than here, e.g.:
#   fly secrets set AGENTSYNC_AUTHORIZED_KEYS="$(cat ~/.agentsync/id_ed25519.pub)"
[env]
  AGENTSYNC_VAULT_NAME = "vault"
  AGENTSYNC_CWD = "/mnt/workspace"
  # Fly's [http_service] terminates TLS at the edge and forwards plain
  # HTTP/WS to internal_port — so the in-container hub binds plain WS and
  # lets the edge handle TLS. Clients still connect via wss://.
  AGENTSYNC_NO_TLS = "1"

[http_service]
  internal_port = 8080
  force_https = true
  auto_stop_machines = "off"
  auto_start_machines = true
  min_machines_running = 1

[[mounts]]
  source = "agentsync_data"
  destination = "/mnt/workspace"

[[vm]]
  cpu_kind = "shared"
  cpus = 1
  memory_mb = 512