Distilled to the essentials

The file opens with four top-level keys: app = "echo-portal" names the Fly application, primary_region = "fra" places it in Frankfurt, and the kill_signal = "SIGTERM" / kill_timeout = "30s" pair tells Fly to send a graceful SIGTERM on shutdown and wait thirty seconds before a hard stop — long enough for the BEAM to drain in-flight requests. app is the Fly side of the two-name split: the OTP release inside the image is still portal.

Below the top level come the stanzas. [build] sets dockerfile = "Dockerfile" and pins three build args — ELIXIR_VERSION = "1.18.4", OTP_VERSION = "28.5.0.1", and DEBIAN_DATE = "20260518" — a fully reproducible base image, with no NODE_VERSION because there is no Node build. [deploy] sets strategy = "rolling"; note that there is no release_command here, which the migration-on-deploy dive (F7.4.3) takes up. [env] carries the non-secret runtime environment — PHX_HOST, PHX_SERVER, MIX_ENV, PORT, POOL_SIZE, the IPv6 trio (ERL_INETRC, ECTO_IPV6, ERL_AFLAGS), and TZ/LANG — and carries no secret, which F7.4.2 covers. [experimental] sets auto_rollback = true; [[vm]] declares the machine size, and [[services]] with its nested [[services.http_checks]] declares the network surface and how Fly decides a machine is healthy.

Select a stanza below to light it in the outline and read what it declares.

The header comment is explicit that this file was distilled from docs/deploy/fly.toml, the full Codemoji production config, “to the Portal essentials: a single Phoenix release + Postgres.” The drop list is the F6.8.2-D8 decision made concrete. A distilled config is easiest to read when you know what is not there, so each removed family is worth naming once: the [[vm]] went from the template’s 2048 MB down to 1024 precisely because there are no longer four other services sharing the machine.

Gone are all the Fastify worker settings (WORKER_*, FASTIFY_PORT) and the queue env (QUEUE_*, the NODE_* family) — Portal is one BEAM release, not a Node worker fleet. Gone is Redis and BullMQ, because the queue runs in-process, not on a Redis broker. Gone is the SQLitestream replicator and its watch env (DISTR_WATCH_*, VOLUME_WATCH_*), because Postgres is the store of record. Gone are all the Datadog agent variables (DD_*) and the GAME_DB_NAME game database, and the DEV_LIVE/LOG_LEVEL development env, along with the Codemoji header comments themselves. Select a dropped family below to read what it was in the template and why this release omits it.

The last stanza is the one with a dependency outside the file. [[services.http_checks]] declares a GET /health probe on a 30s interval, with the header X-Forwarded-Proto = "https" so the app sees the same scheme it would behind the edge. Its path = "/health" is not free to choose: it must equal the route the application actually serves. The as-built F6.1 route lives in apps/portal_web/lib/portal_web/router.ex as get("/health", PortalWeb.CourseController, :health). The two strings — the check path and the router path — must agree for “healthy” to mean what it says: a machine the proxy can reach and whose app answers.

This is the F7.4-INV2 coupling. If either side drifts — the check is pointed at /healthz while the router still serves /health, or the route is renamed while the check is left behind — the probe fails on a perfectly healthy machine, and Fly marks it unhealthy and will not route traffic to it. Nothing in fly.toml can detect the mismatch, because the route it names lives in a different file in a different app; the agreement is held by convention, so it is worth stating once and keeping. The whole rest of the [[services]] stanza supports this same goal: the 80→443 redirect (force_https = true) and the 443 TLS port with alpn = ["h2", "http/1.1"] put the endpoint on HTTPS, and auto_stop_machines = false with min_machines_running = 1 keep at least one node warm so the cluster and Presence counts stay warm and a node is not reaped mid-session.