Skip to content

Fly.io ​

The fly target sets Fly.io app secrets with fly secrets import, which reads NAME=VALUE lines from stdin.

Config typefly
Requiresfly (flyctl), logged in with fly auth login
Readable afterwardsNo. Fly shows only a digest

Quick start ​

toml
[targets.fly]
type = "fly"
app = "acme-api"

[secrets]
DATABASE_URL = { provider = "op", value = "Postgres/url", push = ["fly"] }

Configuration ​

FieldDefaultDescription
appapp in fly.tomlApp to set the secret on.
stagefalseSet the secret without redeploying; it applies on the next deploy.

Notes ​

  • Without stage, each push redeploys the app's Machines.
  • flyctl's import format strips comments and quotes, so fnox wraps each value in """, which flyctl keeps verbatim. fnox refuses the few values that would still change: a carriage return, a line ending in """ before the last line, a # in the first line after an odd number of ", or a line over 60 KiB.
MIT LicenseCopyright © 2026jdx.dev