fix(infra/fly): node.toml to single machine (min_machines_running=1) (#154)

node was consolidated from 2 machines to 1 on 2026-06-22 to fix a split-brain
(per-machine volumes diverged behind one hostname), but this config still
declared min_machines_running=2 and "2-machine HA". Deploying it as-is spawns a
second machine with a fresh empty volume and reintroduces the exact split-brain
the consolidation fixed — hit during the v0.5.0 rollout, where it was corrected
out-of-band before deploying.

Set min_machines_running=1 and update the header/volume/chown comments to match
the single-machine reality. node2/node3 already correctly declare 1.

Co-authored-by: Claude Opus 4.8 <[email protected]>

infra/fly/node.toml

@@ -0,0 +1,70 @@
+# Fly config for node.gitlawb.com — deploys the public Gitlawb/node source.
+# The primary/busiest bootstrap node: a SINGLE machine in sjc with its own
+# 250GB volume. Deploy from the repo root:
+#   fly deploy -a gitlawb-node -c infra/fly/node.toml --ha=false
+#
+# NOTE: node was consolidated from 2 machines to 1 (2026-06-22) to fix a
+# split-brain (per-machine volumes diverged behind one hostname). Keep this at
+# a single machine — min_machines_running=2 would spawn a second machine with a
+# fresh empty volume and reintroduce the split-brain.
+#
+# Reuses the sjc volume `gitlawb_data` (identity key + repos), the attached
+# Postgres (DATABASE_URL), and Tigris S3 + Pinata + contract secrets — all
+# app-level, preserved across deploys.
+#
+# IMPORTANT: the volume was created by the old root image, so /data is
+# root-owned. If the machine crash-loops on first boot of the public image,
+# chown /data to uid 1000:
+#   fly ssh console -a gitlawb-node --machine <id> -C "chown -R 1000:1000 /data"
+app = "gitlawb-node"
+primary_region = "sjc"
+
+[build]
+  dockerfile = "../../Dockerfile"
+
+[env]
+  GITLAWB_HOST = "0.0.0.0"
+  GITLAWB_PORT = "7545"
+  GITLAWB_P2P_PORT = "7546"
+  GITLAWB_REPOS_DIR = "/data/repos"
+  GITLAWB_KEY = "/data/keys/identity.pem"
+  GITLAWB_PUBLIC_URL = "https://node.gitlawb.com"
+  GITLAWB_BOOTSTRAP_PEERS = "https://node2.gitlawb.com,https://node3.gitlawb.com"
+  GITLAWB_AUTO_SYNC = "true"
+  GITLAWB_MAX_PACK_BYTES = "524288000"
+
+[http_service]
+  internal_port = 7545
+  force_https = true
+  auto_stop_machines = false
+  auto_start_machines = true
+  # Single-machine node (see header): keep this at 1. Raising it spawns a
+  # second machine with a fresh volume and reintroduces the split-brain.
+  min_machines_running = 1
+
+  [http_service.concurrency]
+    type = "connections"
+    hard_limit = 500
+    soft_limit = 400
+
+  [http_service.http_options]
+    idle_timeout = 120
+
+[[services]]
+  protocol = "udp"
+  internal_port = 7546
+
+  [[services.ports]]
+    port = 7546
+
+[[vm]]
+  size = "shared-cpu-4x"
+  memory = 8192
+
+[[mounts]]
+  source = "gitlawb_data"
+  destination = "/data"
+
+[metrics]
+  port = 9091
+  path = "/metrics"

infra/fly/node2.toml

@@ -1,11 +1,17 @@
-# Fly config for node3.gitlawb.com — deploys the public Gitlawb/node source.
-# Canary for migrating the bootstrap nodes onto the OSS build (node + node2 follow).
-# Deploy from the repo root:  fly deploy -a gitlawb-node-3 -c infra/fly/node3.toml
+# Fly config for node2.gitlawb.com — deploys the public Gitlawb/node source.
+# Migrated after node3 (see node3.toml). Deploy from the repo root:
+#   fly deploy -a gitlawb-node-2 -c infra/fly/node2.toml
 #
-# Reuses the existing nrt volume `gitlawb_data` (identity key + repos) and the
-# attached Postgres `gitlawb-node-3-db` (via the DATABASE_URL app secret).
-app = "gitlawb-node-3"
-primary_region = "nrt"
+# Reuses the existing sjc volume `gitlawb_data` (identity key + repos) and the
+# attached Postgres `gitlawb-node-2-db` (DATABASE_URL secret). Extra app
+# secrets (contract registries, Irys URL) persist across deploys.
+#
+# IMPORTANT: the volume was created by the old root image, so /data is
+# root-owned. chown it to uid 1000 (the public image's `gitlawb` user) BEFORE
+# this deploy or it crash-loops on "failed to read key … Permission denied":
+#   fly ssh console -a gitlawb-node-2 -C "chown -R 1000:1000 /data"
+app = "gitlawb-node-2"
+primary_region = "sjc"
 
 [build]
   dockerfile = "../../Dockerfile"
@@ -16,9 +22,9 @@ primary_region = "nrt"
   GITLAWB_P2P_PORT = "7546"
   GITLAWB_REPOS_DIR = "/data/repos"
   GITLAWB_KEY = "/data/keys/identity.pem"
-  GITLAWB_PUBLIC_URL = "https://node3.gitlawb.com"
+  GITLAWB_PUBLIC_URL = "https://node2.gitlawb.com"
   # Bootstrap to the other two production nodes (not self).
-  GITLAWB_BOOTSTRAP_PEERS = "https://node.gitlawb.com,https://node2.gitlawb.com"
+  GITLAWB_BOOTSTRAP_PEERS = "https://node.gitlawb.com,https://node3.gitlawb.com"
   GITLAWB_AUTO_SYNC = "true"
   GITLAWB_MAX_PACK_BYTES = "524288000"
 
@@ -35,8 +41,6 @@ primary_region = "nrt"
     soft_limit = 400
 
   [http_service.http_options]
-    # 120s, not 600: long idle windows let hung clients pin Fly's connection
-    # slots (hard_limit) — root factor in the 2026-06-12 prod outage
     idle_timeout = 120
 
 [[services]]
@@ -48,8 +52,7 @@ primary_region = "nrt"
 
 [[vm]]
   size = "shared-cpu-1x"
-  # 1024MB: node3 mirrors the whole network (2400+ repos). Its prior 256MB was
-  # far too small for v0.3.9; matches the gitlawb-node-test sizing.
+  # 1024MB: node2 mirrors the whole network. Prior 256MB was too small for v0.3.9.
   memory = 1024
 
 [[mounts]]