• Fly.io-specific tasks ("fly.io", "deploy to fly", "fly.io setup", "flyctl")
• Fly.io configuration ("fly.toml", "fly app", "fly launch")
• Fly.io database operations ("fly postgres", "fly pg")
• Fly.io environment management ("fly secrets", "fly env")
• Fly.io monitoring ("fly logs", "fly status", "fly dashboard")
• Fly.io GitHub Actions ("fly deploy github action", "flyctl in CI/CD")

1. Security First: Always encrypt sensitive data, never commit unencrypted secrets
2. Database Safety: Use proxying for database access, maintain regular backups
3. Environment Isolation: Separate development, staging, and production configurations
4. Cost Awareness: Optimize resource allocation, monitor usage regularly
5. Automation: Leverage CI/CD for consistent, repeatable deployments
6. Monitoring: Implement comprehensive logging and health checks

1. Fly.io Account: Active account with credit card attached (required for PostgreSQL)
2. CLI Installation:

   flyctl

   command-line tool installed and authenticated
3. Environment Variables: Project-specific configuration ready
4. Application Ready: Application configured for production deployment

• Environment variables configured (production values)
• Database created and attached

• fly.toml

  reviewed and customized
• Secrets set via

  flyctl secrets

• Application builds successfully locally
• Dependencies are production-ready

undefined

1. Generate Fly.io API token:
   bash

   flyctl auth token

2. Add GitHub repository secrets:

   • FLY_API_TOKEN

     : Your Fly.io API token

   • ENV_PASS

     : Environment encryption password (if using encrypted .env)
3. Create

   .github/workflows/deploy.yml

   :

name: Deploy to Fly.io

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Fly.io CLI
        uses: superfly/flyctl-actions/setup-flyctl@master

      - name: Decrypt environment variables
        run: |
          openssl enc -aes-256-cbc -pbkdf2 -salt -d \
            -in .env.enc.prod -out .env -k ${{ secrets.ENV_PASS }}

      - name: Deploy to Fly.io
        run: flyctl deploy --remote-only
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

• Use

  --remote-only

  flag to build on Fly.io servers
• Separate staging and production workflows
• Implement smoke tests after deployment
• Configure Slack/Discord notifications for deployment status
• Use GitHub environments for approval gates on production deploys

1. Auto-stop/Auto-start: Enable in fly.toml to scale to zero during idle periods
2. Right-size Resources: Start with smallest VM size, scale up only if needed
3. Database Optimization: Choose appropriate PostgreSQL tier, monitor usage
4. Regional Strategy: Deploy only in regions with active users
5. Monitoring: Set up billing alerts in Fly.io dashboard

undefined

• fly.toml.template: Basic Fly.io configuration template
• deployment-checklist.md: Pre-deployment verification checklist
• github-actions-workflow.yml: Sample CI/CD workflow

.claude/skills/flyio-deployment/templates/

1. Environment Encryption: Always encrypt .env files before committing
2. Database Access: Use database proxying instead of exposing publicly
3. API Tokens: Store Fly.io API tokens in GitHub secrets, never in code
4. SSL Certificates: Always enable force_https in fly.toml
5. Database Backups: Implement automated backup strategy (S3, external storage)
6. Secrets Rotation: Regularly rotate API tokens, database passwords, encryption keys
7. Access Control: Use Fly.io organizations for team access management
8. Network Security: Configure firewall rules, restrict database access

• Application accessible via public URL
• Health check endpoint responding correctly
• Database connection working
• All environment variables set correctly
• SSL certificate issued and active
• Logs showing no errors
• CI/CD pipeline configured and tested
• Database backups configured
• Monitoring and alerting set up
• Documentation updated with deployment URLs and procedures

Your account has been marked as high risk. Please go to https://fly.io/high-risk-unlock

auto_stop_machines = "stop"

min_machines_running = 0

• First request after idle gets a slow response (wake + boot)
• Rapid sequential API calls may hit a stopped machine between calls
• Always hit

  /_health

  and wait for 204 before running batch operations

1. Records must be unproxied (

   proxied=false

   ) — Fly needs direct traffic for TLS termination
2. Check for stale records — old deployments may have left proxied A/AAAA records. Delete them first.
3. ACME CNAME —

   fly certs setup

   gives you a

   _acme-challenge

   CNAME target. Create/update it for Let's Encrypt validation.
4. Cert issuance is fast (~30s) once DNS is correct.

• Store token in a file:

  echo -n "TOKEN" > /tmp/.token && TK=$(cat /tmp/.token)

• Use curl with

  -o file

  instead of piping
• Use Python

  urllib.request

  (most reliable in sandbox environments)

• Fly.io Official Documentation
• Fly.io CLI Reference
• Fly.io Pricing
• Fly.io Community Forum
• GitHub Actions Integration

• Always test deployments in staging environment before production
• Keep flyctl CLI updated:

  flyctl version update

• Monitor Fly.io status page for platform incidents
• Join Fly.io community for support and best practices
• Consider using Fly.io's managed PostgreSQL for production workloads