From 6c230d6e0fe86dc0f36a0b694c00c764e1755cea Mon Sep 17 00:00:00 2001 From: Dean Sheather Date: Wed, 3 Jun 2026 21:22:41 +1000 Subject: [PATCH] chore(.github): remove fly.io workspace-proxy deployment (#25126) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Removes the fly.io-based workspace-proxy deployment from CI. The dogfood workspace proxies in Paris (`cdg`), Sydney (`syd`), and Johannesburg (`jnb`) are no longer deployed via fly.io, and the São Paulo proxy session-token secret was already unreferenced in `deploy.yaml`. ## Changes - Deleted `.github/fly-wsproxies/{paris,sydney,jnb}-coder.toml`. - Removed the `deploy-wsproxies` job from `.github/workflows/deploy.yaml`, along with its `workflow_call.secrets` block declaring the five `FLY_*` inputs. - Removed the matching `secrets:` pass-through from the `deploy` job in `.github/workflows/ci.yaml`. The Kubernetes/EKS dogfood deploy job and `should_deploy.sh` logic are unchanged. ## Repository secrets that can now be deleted Once this lands, the following GitHub Actions repository secrets are no longer referenced anywhere in this repo and are safe to remove: - `FLY_API_TOKEN` - `FLY_PARIS_CODER_PROXY_SESSION_TOKEN` - `FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN` - `FLY_JNB_CODER_PROXY_SESSION_TOKEN` - `FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN` (was already passed through but unused inside `deploy.yaml`) Worth double-checking they aren't referenced by any other repos / org workflows before deleting from the org/repo settings. ## Out of scope (intentionally left alone) - `site/static/icon/fly.io.svg` — region icon, used at runtime for any user-deployed workspace proxy that picks the fly.io icon. - `docs/install/other/index.md` — unofficial "Run Coder on Fly.io" community install entry, unrelated to our CI. - `site/src/testHelpers/entities.ts` `*.fly.dev.coder.com` strings — UI test fixtures. ## Validation - `python3 -c "yaml.safe_load(...)"` on both edited workflows. - `make pre-commit` ran via the git hook on commit (actionlint, shellcheck, typos, helm, markdown, etc. all green). - Repo-wide grep confirms no remaining `FLY_`, `flyctl`, `fly.toml`, or `fly-wsproxies` references in `.github/` or `scripts/`. --- .github/fly-wsproxies/jnb-coder.toml | 34 -------------------- .github/fly-wsproxies/paris-coder.toml | 34 -------------------- .github/fly-wsproxies/sydney-coder.toml | 34 -------------------- .github/workflows/ci.yaml | 6 ---- .github/workflows/deploy.yaml | 41 ------------------------- 5 files changed, 149 deletions(-) delete mode 100644 .github/fly-wsproxies/jnb-coder.toml delete mode 100644 .github/fly-wsproxies/paris-coder.toml delete mode 100644 .github/fly-wsproxies/sydney-coder.toml diff --git a/.github/fly-wsproxies/jnb-coder.toml b/.github/fly-wsproxies/jnb-coder.toml deleted file mode 100644 index 665cf5ce2a..0000000000 --- a/.github/fly-wsproxies/jnb-coder.toml +++ /dev/null @@ -1,34 +0,0 @@ -app = "jnb-coder" -primary_region = "jnb" - -[experimental] - entrypoint = ["/bin/sh", "-c", "CODER_DERP_SERVER_RELAY_URL=\"http://[${FLY_PRIVATE_IP}]:3000\" /opt/coder wsproxy server"] - auto_rollback = true - -[build] - image = "ghcr.io/coder/coder-preview:main" - -[env] - CODER_ACCESS_URL = "https://jnb.fly.dev.coder.com" - CODER_HTTP_ADDRESS = "0.0.0.0:3000" - CODER_PRIMARY_ACCESS_URL = "https://dev.coder.com" - CODER_WILDCARD_ACCESS_URL = "*--apps.jnb.fly.dev.coder.com" - CODER_VERBOSE = "true" - -[http_service] - internal_port = 3000 - force_https = true - auto_stop_machines = true - auto_start_machines = true - min_machines_running = 0 - -# Ref: https://fly.io/docs/reference/configuration/#http_service-concurrency -[http_service.concurrency] - type = "requests" - soft_limit = 50 - hard_limit = 100 - -[[vm]] - cpu_kind = "shared" - cpus = 2 - memory_mb = 512 diff --git a/.github/fly-wsproxies/paris-coder.toml b/.github/fly-wsproxies/paris-coder.toml deleted file mode 100644 index c6d515809c..0000000000 --- a/.github/fly-wsproxies/paris-coder.toml +++ /dev/null @@ -1,34 +0,0 @@ -app = "paris-coder" -primary_region = "cdg" - -[experimental] - entrypoint = ["/bin/sh", "-c", "CODER_DERP_SERVER_RELAY_URL=\"http://[${FLY_PRIVATE_IP}]:3000\" /opt/coder wsproxy server"] - auto_rollback = true - -[build] - image = "ghcr.io/coder/coder-preview:main" - -[env] - CODER_ACCESS_URL = "https://paris.fly.dev.coder.com" - CODER_HTTP_ADDRESS = "0.0.0.0:3000" - CODER_PRIMARY_ACCESS_URL = "https://dev.coder.com" - CODER_WILDCARD_ACCESS_URL = "*--apps.paris.fly.dev.coder.com" - CODER_VERBOSE = "true" - -[http_service] - internal_port = 3000 - force_https = true - auto_stop_machines = true - auto_start_machines = true - min_machines_running = 0 - -# Ref: https://fly.io/docs/reference/configuration/#http_service-concurrency -[http_service.concurrency] - type = "requests" - soft_limit = 50 - hard_limit = 100 - -[[vm]] - cpu_kind = "shared" - cpus = 2 - memory_mb = 512 diff --git a/.github/fly-wsproxies/sydney-coder.toml b/.github/fly-wsproxies/sydney-coder.toml deleted file mode 100644 index e3a24b4408..0000000000 --- a/.github/fly-wsproxies/sydney-coder.toml +++ /dev/null @@ -1,34 +0,0 @@ -app = "sydney-coder" -primary_region = "syd" - -[experimental] - entrypoint = ["/bin/sh", "-c", "CODER_DERP_SERVER_RELAY_URL=\"http://[${FLY_PRIVATE_IP}]:3000\" /opt/coder wsproxy server"] - auto_rollback = true - -[build] - image = "ghcr.io/coder/coder-preview:main" - -[env] - CODER_ACCESS_URL = "https://sydney.fly.dev.coder.com" - CODER_HTTP_ADDRESS = "0.0.0.0:3000" - CODER_PRIMARY_ACCESS_URL = "https://dev.coder.com" - CODER_WILDCARD_ACCESS_URL = "*--apps.sydney.fly.dev.coder.com" - CODER_VERBOSE = "true" - -[http_service] - internal_port = 3000 - force_https = true - auto_stop_machines = true - auto_start_machines = true - min_machines_running = 0 - -# Ref: https://fly.io/docs/reference/configuration/#http_service-concurrency -[http_service.concurrency] - type = "requests" - soft_limit = 50 - hard_limit = 100 - -[[vm]] - cpu_kind = "shared" - cpus = 2 - memory_mb = 512 diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 63fd8f4359..857fb845c0 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1555,12 +1555,6 @@ jobs: contents: read id-token: write packages: write # to retag image as dogfood - secrets: - FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }} - FLY_PARIS_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_PARIS_CODER_PROXY_SESSION_TOKEN }} - FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN }} - FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN }} - FLY_JNB_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_JNB_CODER_PROXY_SESSION_TOKEN }} # sqlc-vet runs a postgres docker container, runs Coder migrations, and then # runs sqlc-vet to ensure all queries are valid. This catches any mistakes diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml index bd59dd6726..41f984f963 100644 --- a/.github/workflows/deploy.yaml +++ b/.github/workflows/deploy.yaml @@ -8,17 +8,6 @@ on: description: "Image and tag to potentially deploy. Current branch will be validated against should-deploy check." required: true type: string - secrets: - FLY_API_TOKEN: - required: true - FLY_PARIS_CODER_PROXY_SESSION_TOKEN: - required: true - FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN: - required: true - FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN: - required: true - FLY_JNB_CODER_PROXY_SESSION_TOKEN: - required: true permissions: contents: read @@ -136,33 +125,3 @@ jobs: kubectl --namespace coder rollout status deployment/coder-provisioner-tagged kubectl --namespace coder rollout restart deployment/coder-provisioner-tagged-prebuilds kubectl --namespace coder rollout status deployment/coder-provisioner-tagged-prebuilds - - deploy-wsproxies: - runs-on: ubuntu-latest - needs: deploy - steps: - - name: Harden Runner - uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0 - with: - egress-policy: audit - - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - persist-credentials: false - - - name: Setup flyctl - uses: superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # v1.6 - - - name: Deploy workspace proxies - run: | - flyctl deploy --image "$IMAGE" --app paris-coder --config ./.github/fly-wsproxies/paris-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_PARIS" --yes - flyctl deploy --image "$IMAGE" --app sydney-coder --config ./.github/fly-wsproxies/sydney-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_SYDNEY" --yes - flyctl deploy --image "$IMAGE" --app jnb-coder --config ./.github/fly-wsproxies/jnb-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_JNB" --yes - env: - FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }} - IMAGE: ${{ inputs.image }} - TOKEN_PARIS: ${{ secrets.FLY_PARIS_CODER_PROXY_SESSION_TOKEN }} - TOKEN_SYDNEY: ${{ secrets.FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN }} - TOKEN_JNB: ${{ secrets.FLY_JNB_CODER_PROXY_SESSION_TOKEN }}