feat: Allow deploying the app itself

Author: tomasol

Justfile

@@ -1,6 +1,3 @@
-gen-obelisk-ext:
-	scripts/obelisk-generate-extensions.sh
-
 clean:
 	cargo clean
 
@@ -17,14 +14,5 @@ verify:
 serve:
 	obelisk server run --config ${CONFIG:-obelisk-local.toml}
 
-app-init:
-	obelisk client execution submit -f .../workflow.app-init "$(./scripts/json-app-init-stargazers.sh)"
-
-app-init-no-cleanup:
-	SKIP_CLEANUP=true obelisk client execution submit -f .../workflow.app-init "$(./scripts/json-app-init-stargazers.sh)"
-
-secrets:
-	./scripts/secrets-send.sh ../stargazers/.envrc
-
-secrets-y:
-	SEND_ALL=true ./scripts/secrets-send.sh ../stargazers/.envrc
+app-init params:
+	obelisk client execution submit -f .../workflow.app-init '{{params}}'

README.md

@@ -1,31 +1,49 @@
-# Obelisk deployment tool - fly.io
+# Obelisk deployment app for fly.io
 
 An [Obelisk](https://obeli.sk) [workflow](workflow/deployer-workflow/impl-flyio/src/lib.rs)
-that deploys the [Stargazers Demo app](https://github.com/obeli-sk/demo-stargazers) on fly.io.
+that deploys an Obelisk app on fly.io.
 
-## Usage
+## Setting up
 Set up environment variables based on [.envrc-example](.envrc-example).
 
+Set up dependencies based on [dev-deps.txt](dev-deps.txt).
+
+If `direnv` is available:
+```sh
+cp .envrc-example .envrc
+$EDITOR .envrc # change FLY_APP_NAME and FLY_API_TOKEN
+direnv allow
+```
+
+## Starting the server
+
 Start Obelisk server
 ```sh
 just build serve
 # or just `obelisk server run -c obelisk-oci.toml` without building the WASM components locally.
 ```
 
+## Starting the workflow
+
+### Deploying the deployment app itself
+
 Run the [`app-init`](workflow/deployer-workflow/wit/obelisk-flyio_workflow@1.0.0-beta/workflow.wit) function:
 ```sh
-just app-init
+just app-init "$(./scripts/json-app-init-itself.sh)"
 ```
 
-While the workflow is running, push the [stargazers secrets](https://github.com/obeli-sk/demo-stargazers/blob/main/.envrc-example) to the fly.io app -
+While the workflow is running, push the secrets of your `.envrc` to the fly.io app -
 either using `fly` command, fly.io's dashboard or using following [script](scripts/secrets-send.sh):
 
-Point the script at stargazers' `.envrc` file.
 ```sh
-./scripts/secrets-send.sh ../stargazers/.envrc
+./scripts/secrets-send.sh .envrc
 ```
 
-When all required secrets are present, the `app-init` workflow will continue with creating the final VM and health checks.
+The following secrets are required by the app:
+* FLY_API_TOKEN
+
+When all required secrets are present, the workflow will continue with creating the final VM and health checks.
+
 
 Sample output:
 ```
@@ -59,28 +77,63 @@ After testing delete the app and its resources:
 fly apps delete $FLY_APP_NAME
 ```
 
-## Using Fly.io activities directly
+#### Inception - deploying the app one more time using the deployer on fly.io
 
-Check out the [components-flyio](https://github.com/obeli-sk/components-flyio) repo on how to interact with Fly.io, including:
-* Apps
-* Volumes
-* VMs
-* Secrets
+Pick a name for the inner app, we will use `inception`.
+
+Kill the local Obelisk server.
+
+Proxy the gRPC port 5005 of the `obelisk` VM:
+```sh
+flyctl proxy 5005 $(fly machine list | grep obelisk | awk '{print $6}')
+```
+
+Verify the port tunneling works:
+```sh
+obelisk client component list
+```
 
-Launch a VM:
+Now run `app-init` with a new fly app name:
 ```sh
-export VOLUME_ID=..
-MACHINE_ID=$(obelisk client execution submit -f --json obelisk-flyio:activity-fly-http/machines@1.0.0-beta.create -- \
-\"$FLY_APP_NAME\" \"$FLY_MACHINE_NAME\" "$(./scripts/json-machine-create.sh)" \"$FLY_REGION\" \
-| jq -r '.[-1].ok')
+just app-init "$(FLY_APP_NAME=inception ./scripts/json-app-init-itself.sh)"
 ```
 
-Execute a process:
+Push the secret to the outer webhook:
 ```sh
-obelisk client execution submit -f \
-obelisk-flyio:activity-fly-http/machines@1.0.0-beta.exec \
--- \
-\"$FLY_APP_NAME\" \
-\"$MACHINE_ID\" \
-'["obelisk", "server", "verify", "-c", "/volume/obelisk.toml"]'
+URL="https://${FLY_APP_NAME}.fly.dev" FLY_APP_NAME=inception ./scripts/secrets-send.sh .envrc
 ```
+
+To show the web console, proxy the port 8080 as well.
+
+Don't forget to delete the inner app afterwards:
+```sh
+fly apps delete inception
+```
+
+### Stargazers
+Similar to the process above, but deploying the [Stargazers Demo app](https://github.com/obeli-sk/demo-stargazers) requires setting up, see the project's readme for details.
+
+Run the [`app-init`](workflow/deployer-workflow/wit/obelisk-flyio_workflow@1.0.0-beta/workflow.wit) function:
+```sh
+just app-init "$(./scripts/json-app-init-stargazers.sh)"
+```
+
+Push the secrets using stargazers' `.envrc` file.
+```sh
+./scripts/secrets-send.sh ../stargazers/.envrc
+```
+
+The follwing secrets are required by the app:
+* OPENAI_API_KEY
+* GITHUB_TOKEN
+* TURSO_TOKEN
+* TURSO_LOCATION
+* GITHUB_WEBHOOK_SECRET
+
+# Using Fly.io activities directly
+
+Check out the [components-flyio](https://github.com/obeli-sk/components-flyio) repo on how to interact with Fly.io, including:
+* Apps
+* Volumes
+* VMs
+* Secrets

scripts/json-app-init-itself.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+# Prints JSON containing arguments to `app-init` function.
+
+OBELISK_VERSION=${OBELISK_VERSION:-$(obelisk -v | cut -d ' ' -f 2)}
+SECRETS_DEADLINE_SECS=${SECRETS_DEADLINE_SECS:-120}
+HEALTH_CHECK_DEADLINE_SECS=${HEALTH_CHECK_DEADLINE_SECS:-120}
+SKIP_CLEANUP=${SKIP_CLEANUP:-false}
+MINIO=${MINIO:-true}
+
+cat <<EOF
+[
+"$FLY_ORG_SLUG",
+"$FLY_APP_NAME",
+"$OBELISK_VERSION",
+{
+    "activity-wasm-list":[
+        {
+            "name": "activity_fly_http",
+            "location-oci": "docker.io/getobelisk/components_flyio_activity_fly_http:2025-10-05@sha256:fc19825d246fae8110f0473a505bf1da727086832bb0820653ec36e940822024",
+            "env-vars":["FLY_API_TOKEN"],
+            "lock-expiry-seconds": 15,
+            "max-retries": 6
+        },
+        {
+            "name": "http_activity",
+            "location-oci": "docker.io/getobelisk/test_programs_http_get_activity:2025-09-28@sha256:8131d9cafbdf06dbaf7a3b4e629791c9cf3dc1553df9418b34f25ab900b72929",
+            "lock-expiry-seconds": 5
+        }
+    ],
+    "workflow-list":[
+        {
+            "name": "obelisk_deployer_flyio",
+            "location-oci": "docker.io/getobelisk/components_flyio_obelisk_deployer_flyio:2025-10-05-1@sha256:f2aacd7d90e2b8349d63a6c85f79904e99cfc754210250c24c356cb315089349"
+        }
+    ],
+    "webhook-endpoint-list":[
+        {
+            "name": "webhook_fly_secrets_updater",
+            "location-oci": "docker.io/getobelisk/components_flyio_webhook_fly_secrets_updater:2025-10-05@sha256:3190ff8d059210d29b1a58f0fc509015360bb0e6bf34deba23b9c5a8c816c8cc",
+            "routes": [{ "methods": ["POST"], "path": "/" }],
+            "env-vars": ["FLY_API_TOKEN"]
+        }
+    ]
+},
+$SECRETS_DEADLINE_SECS,
+$HEALTH_CHECK_DEADLINE_SECS,
+$SKIP_CLEANUP,
+$MINIO
+]
+EOF

scripts/secrets-send.sh

@@ -2,6 +2,7 @@
 set -euo pipefail
 
 SEND_ALL=${SEND_ALL:-false}
+URL=${URL:-localhost:9090}
 
 exec 3<&0 # save stdin as FD 3
 
@@ -21,7 +22,7 @@ while IFS= read -r line; do
 
     echo "Found: $key"
     if [ "$SEND_ALL" = "true" ] || { read -u 3 -p "Send to server? (y/n) " confirm && [[ "$confirm" == "y" ]]; }; then
-      curl --write-out "%{url_effective} %{http_code}\n" --fail localhost:9090/ \
+      curl --write-out "%{url_effective} %{http_code}\n" --fail $URL \
         -H "Content-Type: application/json" \
         -d '{"app_name":"'"$FLY_APP_NAME"'","name":"'"$key"'","value":"'"$val"'"}'
     fi