Run the control plane on Fly

One machine, one volume, SQLite on it. A Fly volume attaches to a single machine
in a single region and nothing here wants a second writer; since the heartbeat
went away the database is read-mostly, a few hundred bytes per account and a
handful of writes per user per lifetime, so this shape has room in it.

The signing key becomes a secret rather than a file. Issuer::from_hex takes it
directly, Config prefers it over the state directory, and an unusable value is
fatal rather than a reason to generate a fresh one — silently minting a new key
would break every daemon in the field while looking healthy from this end. Losing
that key is the only unrecoverable failure in the system, and tying its survival
to one volume on one host was the wrong place to put it. Local development is
unchanged: no secret set, same file as before.

Two SQLite settings that a host which SIGKILLs you deserves:

  - WAL and synchronous=NORMAL. A deploy replaces the machine rather than asking
    the process to stop, so an abrupt exit is the normal ending. WAL replays; the
    trade is that a crash can lose the last transactions, which here means a
    profile edit someone can redo, not a corrupt database.

  - foreign_keys=ON, on every open. It was set inside SCHEMA, which migrations
    skip once user_version has moved, so every process after the one that created
    the database ran with ON DELETE CASCADE quietly doing nothing. A share
    outliving its resource was possible the whole time. There is a test.

The image builds both halves from source. web/pkg/ is gitignored, so a deploy
that copied it in would ship whatever happened to be on the machine running
`fly deploy`; building the bundle and the binary in the same image means they
always match. That needed one portability fix — build-wasm.sh reached for
shasum, which is a perl thing, and Debian has sha256sum.

.dockerignore excludes data/ and *.key. The build context is a place secrets go
to become image layers.

Not included, deliberately: IROH_SERVICES_API_SECRET. iroh_services::Client
needs an iroh Endpoint and devsite-server has no iroh in its dependency tree at
all — the control plane signs capabilities and serves HTML, and never joins the
network. The endpoints worth observing are the daemon, which runs on other
people's machines, and the browser, where a secret would be public. Parked.

fly.toml validates. The image is unbuilt locally — no Docker daemon on this
machine — so the first real build of it will be Fly's remote builder.

commit

d74882ffe18d519d7547d281732f41cda86f2acc

parent

dffe6c6b379889be26aed1ed735804d514222af1

author

Dami <dami.etoile@gmail.com>