Daemon Configuration (microfly.toml)

The MicroFly daemon reads its host-wide settings from /etc/microfly/config.toml.

# /etc/microfly/config.toml

# Directory Paths
data_dir = "/var/lib/microfly/apps"
repo_dir = "/var/lib/microfly/repos"
log_dir = "/var/log/microfly"
master_key_file = "/etc/microfly/master.key"
admin_socket = "/run/microfly/admin.sock"

# Network Listeners (Loopback Only)
ingress_addr = "127.0.0.1:8000"
webhook_addr = "127.0.0.1:8082"
metrics_addr = "127.0.0.1:9090"

# Application Port Allocation Range
port_range_start = 3000
port_range_end = 4000

# Execution Backend
runner = "systemd"
allow_insecure_runner = false

# Ingress & Proxy Timeouts
read_timeout = "30s"
write_timeout = "30s"
idle_timeout = "120s"
max_header_bytes = 1048576

# Trusted Reverse Proxy Subnets (CIDR)
trusted_proxies = ["127.0.0.1/32", "::1/128"]

---

Configuration Reference

Paths

• data_dir (string, default: "/var/lib/microfly/apps"): Root directory storing application releases, persistent volumes, environment files, and encrypted secret stores.
• repo_dir (string, default: "/var/lib/microfly/repos"): Directory storing bare Git repositories initialized with microfly init-git.
• log_dir (string, default: "/var/log/microfly"): Directory storing the daemon's internal event logs and per-application log rings.
• master_key_file (string, default: "/etc/microfly/master.key"): File containing the 256-bit AES master key used to encrypt and decrypt application secrets.
• admin_socket (string, default: "/run/microfly/admin.sock"): Unix domain socket path used for CLI management and local REST API communication. Protected by kernel peer credential checks (SO_PEERCRED).

---

Network Listeners

IMPORTANT

All MicroFly network listeners must remain bound to loopback interfaces (127.0.0.1). Never expose admin_socket, metrics_addr, or webhook_addr directly to the public internet without authenticated reverse proxy termination.

• ingress_addr (string, default: "127.0.0.1:8000"): HTTP loopback port where reverse proxies (Caddy, Nginx, Apache) forward incoming user requests.
• webhook_addr (string, default: "127.0.0.1:8082"): Dedicated loopback listener for external Git push webhook deliveries (e.g. from GitHub or GitLab).
• metrics_addr (string, default: "127.0.0.1:9090"): Prometheus metrics scraping endpoint (/metrics).

---

Workload Execution Backend

• runner (string, default: "systemd"): Workload execution mechanism:
  • "systemd" (Production): Uses systemd-run to execute applications inside ephemeral, hardened transient service units.
  • "direct" (Development): Directly forks subprocesses without systemd isolation. Only permitted when running as a non-root user or when allow_insecure_runner = true.
• allow_insecure_runner (boolean, default: false): When set to true, allows running the un-sandboxed direct runner even when the daemon runs as root. Strongly discouraged in production.

---

Port Allocation

• port_range_start (integer, default: 3000): Lower bound of unprivileged TCP ports assigned to running workloads.
• port_range_end (integer, default: 4000): Upper bound of TCP ports. MicroFly allocates unique, collision-free ports for candidate releases and active workloads.

---

Domains & Ingress

• default_domain (string, optional): Base platform domain used for automatic subdomain generation (e.g. "apps.mycompany.com"). When set, microfly domains generate <app> automatically generates and routes <app>.<default_domain>.