Fly deploy: explicitly create the .fly.dev managed cert#43
Merged
Conversation
Fly's shared-IP edge routes by SNI/Host header. If there's no managed cert on file for the app's .fly.dev hostname, the proxy returns 403 with `x-deny-reason: host_not_allowed` before the request ever reaches the machine — even when the app itself is deployed and healthy. For brand-new accounts the .fly.dev auto-cert flow occasionally stalls. Explicit `fly certs create` reliably triggers Let's Encrypt issuance. Idempotent: skips creation if the cert already exists.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
App is fully healthy on Fly (machine running, internal health checks passing, clean logs), but the public
cotrackpro-talk.fly.devURL keeps returning:This response comes from Fly's edge proxy, not the app. Fly's shared-IP edge routes by SNI/Host header — if there's no managed cert on file for the hostname, the proxy denies traffic before it ever reaches the machine. For brand-new accounts the
.fly.devauto-cert flow occasionally stalls, and the explicitfly certs createis needed to kick Let's Encrypt issuance.Fix
Add a step between Deploy and Resume that ensures the cert exists. The step is idempotent — skips creation if the cert is already there.
Doing this via the workflow rather than the user's CLI because their local
fly auth loginhas been failing to connect.Test plan
curl -i https://cotrackpro-talk.fly.dev/healthreturns 200Generated by Claude Code