fly.toml

# fly.toml — memlawb
#
# Open-source, zero-knowledge agent memory backend.
# The server is CRYPTO-BLIND: it only ever sees ciphertext. Clients encrypt
# entries before upload (see client/crypto.ts), so the data at rest here is
# opaque even to us.
#
# Custom domain: https://memory.gitlawb.com
#
# Secrets (set with `fly secrets set`):
#   MEMLAWB_SUPABASE_URL        — Shared gitlawb Supabase project URL (API-key lookup).
#   MEMLAWB_SUPABASE_SECRET_KEY — Service-role key for the same project.
#   S3_ACCESS_KEY_ID            — Tigris/S3 access key (when STORE=s3).
#   S3_SECRET_ACCESS_KEY        — Tigris/S3 secret key (when STORE=s3).
#
# Storage driver (env, default fs for self-host; set s3 for hosted):
#   STORE=fs   DATA_DIR=/data           (mount a volume)
#   STORE=s3   S3_BUCKET=...  S3_ENDPOINT=...  S3_REGION=auto
#
# Auth kill switch (self-host single-user / emergency):
#   ALLOW_UNAUTHENTICATED=true

app = 'memlawb'
primary_region = 'sin'

[build]
  dockerfile = 'Dockerfile'

[env]
  PORT = '8080'
  STORE = 's3'
  S3_REGION = 'auto'
  MAX_ENTRY_BYTES = '250000'
  MAX_ENTRIES_PER_NAMESPACE = '2000'

[http_service]
  internal_port = 8080
  force_https = true
  auto_stop_machines = 'suspend'
  auto_start_machines = true
  min_machines_running = 1

  [http_service.concurrency]
    type = 'requests'
    hard_limit = 400
    soft_limit = 250

  [[http_service.checks]]
    interval = '15s'
    timeout = '4s'
    grace_period = '8s'
    method = 'GET'
    path = '/health'

[[vm]]
  size = 'shared-cpu-1x'
  memory = '512mb'