oott/deploy/fly/README.md

Deploying the OOTT test server to Fly.io

A throwaway, pay-as-you-go backend (REST API + bundled web UI) on Fly.io, for Apple to exercise the iOS app during App Store review. Tear it down when review is done so you stop paying.

The image is the reproducible Nix build (same backend + bundled Flutter web as the production image). Config is rendered at startup from the environment, so:

• the API key comes from a Fly secret (never baked into the image or git),
• the SQLite database lives on a Fly volume (survives restarts/redeploys),
• the network scanners are disabled — a cloud host has no LAN to scan; this is purely an API/UI server for the reviewer.

Everything below runs inside the Nix dev shell, which now ships flyctl and skopeo (no Docker daemon required):

nix develop   # or: direnv / your usual dev shell entry

1. One-time setup

# Log in (opens a browser).
fly auth login

# Create the app. Use this name everywhere below (and in fly.toml's `app`).
fly apps create oott-test

# Persistent storage for the SQLite DB. Match the region in fly.toml.
fly volumes create oott_data --region ams --size 1 --app oott-test

# The API key the iOS app will authenticate with (keep it; you'll hand the same
# value to the reviewer / configure it in the build under test).
fly secrets set OOTT_API_KEY="<pick-a-strong-key>" --app oott-test

2. Build the image and push it to the Fly registry

# Build the Fly image (backend + bundled web UI + startup config wrapper).
nix build .#flyImage -o result-fly

# Push the image straight from the Nix store archive to Fly's registry.
# No Docker daemon involved; skopeo authenticates with a short-lived Fly token.
skopeo copy --dest-creds "x:$(fly auth token)" \
  docker-archive:result-fly \
  docker://registry.fly.io/oott-test:latest

3. Deploy

fly deploy --app oott-test \
  --config deploy/fly/fly.toml \
  --image registry.fly.io/oott-test:latest

Your server is now at https://oott-test.fly.dev. Quick check:

curl -H "Authorization: Bearer <your-OOTT_API_KEY>" \
  https://oott-test.fly.dev/api/test
# -> "OOTT_API_OK"

Open https://oott-test.fly.dev/web for the UI, https://oott-test.fly.dev/api/docs for the API explorer.

4. Tear down (stop paying)

fly apps destroy oott-test          # removes the app, machine, and volume

Notes

• Redeploying after a change: repeat steps 2 and 3.
• Cost: one shared-cpu-1x/512MB machine + a 1GB volume is on the order of a few US dollars a month, billed by usage — well under a dollar for a few days. To trim it further between reviewer sessions, flip fly.toml to scale-to-zero (auto_stop_machines = "stop", min_machines_running = 0) and redeploy.
• Empty UI: the reviewer sees a working but device-less app, since there is no LAN to discover. If the review benefits from a populated screen, seed a few sample devices via the API (PUT /api/devices) after deploying.
• Config knobs are env vars in fly.toml (OOTT_LOG_LEVEL, OOTT_NOTIFICATIONS_METHOD, OOTT_PORT, OOTT_DATA_DIR); the API key is the OOTT_API_KEY secret.