Fly checklist

See Fly · Sentry · Branches · GitHub

Staging UAT Production

Staging checklist

Everything to stand up and run in the staging Fly org (staging branch).

• Single shared Dockerfile; runner stage runs API + cloudflared (scripts/start-with-tunnel.sh)
• fly.staging.toml — staging org, primary_region = "iad", port 8080, no [http_service]
• fly-deploy-staging.yml deploys on push to staging with --config fly.staging.toml
• GitHub environment uses staging org FLY_API_TOKEN (not production)
• Fly auto-deploy disabled on the staging app
• /health and /metrics (Node: prom-client + nstats)
• Logs to stdout / stderr (org log shipper → Grafana Cloud)
• Fly secrets set on staging app (see Fly environment variables below)
• If Mongo/IP-restricted DB: dedicated egress IPv4 on app + allowlisted (optional)
• Staging Cloudflare hostname → http://<app>.internal:8080
• Service healthy in staging; realistic secrets and config

UAT checklist

Full list for UAT (uat branch, UAT Fly org)—including promotion from staging.

• Staging checklist complete and stable
• fly.uat.toml reviewed (app name, UAT org, env, health checks)
• fly-deploy-uat.yml on push to uat with UAT FLY_API_TOKEN
• Fly auto-deploy off on UAT app
• Same Dockerfile image as staging; UAT secrets only in UAT
• No public Fly ingress on UAT — tunnel only
• /health and /metrics verified after UAT deploy
• Fly secrets set on UAT app (see Fly environment variables below)
• If Mongo/IP-restricted DB: dedicated egress IPv4 + allowlisted (optional)
• UAT Cloudflare hostname / tunnel origin correct
• Team sign-off: staging behavior matches what UAT should test

Production checklist

Full list for production (main branch, production Fly org).

• Sentry go-live: DSN, release, source maps, test event in prod project
• UAT validation complete (functional + operational)
• fly.main.toml reviewed — production org, scale, health checks
• fly-deploy-main.yml is the only routine prod deploy path
• No laptop flyctl deploy to production org
• Production FLY_API_TOKEN only in production GitHub environment
• Fly auto-deploy off on production app
• Same Dockerfile; production secrets and config verified
• No public Fly ingress — tunnel only
• /health and /metrics verified in UAT; prod health check in fly.main.toml
• Fly secrets set on production app (see Fly environment variables below)
• If Mongo/IP-restricted DB: dedicated egress IPv4 + allowlisted (optional)
• Production Cloudflare hostname / tunnel / DNS ready
• Platform / tech lead aware of production promotion

GitHub Actions information

These are the minimum repository secrets required for deploy. Add them under Settings → Secrets and variables → Actions in the GitHub repo. The deploy workflow uses them for Sentry (source maps and release tied to the build).

• SENTRY_AUTH_TOKEN
• SENTRY_ORG
• SENTRY_PROJECT

All three must be defined before deploy can ship with production observability. More on go-live: Sentry standards.

Fly environment variables

Minimum Fly secrets on each tier’s app (fly secrets set). Set per app name in that tier’s Fly org.

• MONGODB_URI — when the API uses MongoDB Atlas (MongoDB standards)
• SENTRY_ORG
• SENTRY_PROJECT
• SENTRY_ENVIRONMENT — e.g. staging, uat, production
• CLOUDFLARE_TUNNEL_TOKEN — so cloudflared can register the app with Cloudflare Tunnel

Example (one secret at a time or combined):

fly secrets set CLOUDFLARE_TUNNEL_TOKEN=<token> -a <fly-app-name>

Token from Cloudflare → your org’s tunnel → Install connector. See Fly tunnel standards.

Dedicated egress IPv4 (only if needed)

If the API talks to MongoDB Atlas or another service that uses IP access rules, manually attach a dedicated egress IPv4 to that Fly app and give that IP to the data layer.

fly ips allocate-egress —region iad -a <fly-app-name> —yes — then fly ips list and allowlist the egress address (not ingress).

If nothing external requires IP allowlisting, do not allocate an egress IP.

Atlas rule naming and key rotation: Naming conventions.