Auto-indexing service and GraphQL API for AT Protocol Records
docs: remove deprecated env vars from deployment guide
+2
-24
+2
-24
docs/deployment.md
+2
-24
docs/deployment.md
···
10
10
| `HOST` | No | `127.0.0.1` | Server bind address. Set to `0.0.0.0` for containers |
11
11
| `PORT` | No | `8080` | Server port |
12
12
| `SECRET_KEY_BASE` | Recommended | Auto-generated | Session encryption key (64+ chars). **Must persist across restarts** |
13
-
| `ADMIN_DIDS` | Optional | - | Comma-separated DIDs for admin access (e.g., `did:plc:abc,did:plc:xyz`) |
14
13
| `EXTERNAL_BASE_URL` | Optional | `http://localhost:8080` | Base URL of your application (used for OAuth redirect URIs and client metadata). Use `http://127.0.0.1:8080` for loopback mode |
15
14
| `OAUTH_LOOPBACK_MODE` | Optional | `false` | Set to `true` for local development without ngrok. Uses loopback client IDs instead of client metadata URLs |
16
-
| `OAUTH_SUPPORTED_SCOPES` | Optional | `atproto transition:generic` | Space-separated OAuth scopes to request (used in loopback client IDs and client metadata) |
17
-
| `JETSTREAM_URL` | No | `wss://jetstream2.us-west.bsky.network/subscribe` | Jetstream WebSocket endpoint |
18
-
| `RELAY_URL` | No | `https://relay1.us-west.bsky.network` | AT Protocol relay URL |
19
-
| `PLC_DIRECTORY_URL` | No | `https://plc.directory` | PLC directory URL |
15
+
| `PLC_DIRECTORY_URL` | Optional | `https://plc.directory` | PLC directory URL override (useful for self-hosted PLC directories) |
20
16
21
17
### Critical Environment Variables
22
18
23
19
- **DATABASE_URL**: Must point to a persistent volume location
24
20
- **SECRET_KEY_BASE**: Generate with `openssl rand -base64 48`. Store as a secret and keep persistent
25
21
- **HOST**: Set to `0.0.0.0` in container environments
26
-
- **ADMIN_DIDS**: Required for backfill and settings page access
27
22
28
23
## SQLite Volume Setup
29
24
···
79
74
80
75
```bash
81
76
fly secrets set SECRET_KEY_BASE=$(openssl rand -base64 48)
82
-
83
-
# Optional: Admin access
84
-
fly secrets set ADMIN_DIDS=did:plc:your_did
85
77
```
86
78
87
79
### 4. Deploy
···
114
106
SECRET_KEY_BASE=<generate-with-openssl-rand>
115
107
```
116
108
117
-
Optional variables:
118
-
```
119
-
ADMIN_DIDS=did:plc:your_did
120
-
```
121
-
122
109
### 3. Add a volume
123
110
124
111
In the Railway dashboard:
···
176
163
- PORT=8080
177
164
- DATABASE_URL=/data/quickslice.db
178
165
- SECRET_KEY_BASE=${SECRET_KEY_BASE}
179
-
- ADMIN_DIDS=${ADMIN_DIDS}
180
166
restart: unless-stopped
181
167
healthcheck:
182
168
test: ["CMD", "wget", "--spider", "-q", "http://localhost:8080/health"]
···
192
178
193
179
```bash
194
180
SECRET_KEY_BASE=<generate-with-openssl-rand>
195
-
ADMIN_DIDS=did:plc:your_did
196
181
```
197
182
198
183
Start the service:
···
218
203
219
204
### Access GraphiQL
220
205
221
-
Navigate to `/graphiql` (requires `ADMIN_DIDS` configuration).
206
+
Navigate to `/graphiql` (requires authentication).
222
207
223
208
### Database access
224
209
···
296
281
- Scale memory for high-traffic deployments
297
282
- Use SSD-backed volumes for SQLite performance
298
283
- Monitor database size and scale volume as needed
299
-
300
-
## Security
301
-
302
-
1. **Always set SECRET_KEY_BASE** - Generate a strong random key and keep it persistent
303
-
2. **Use HTTPS in production** - Both Fly.io and Railway handle this automatically
304
-
3. **Restrict admin access** - Set `ADMIN_DIDS` to limit who can access GraphiQL and backfill endpoints
305
-
4. **Store secrets securely** - Use platform secret management, never commit secrets to git