For your engineer

The whole platform, in your company’s own cloud.

A private copy is everything we run, installed in your company’s own Fly organization, on a domain of yours. The Workspace, the agents, the code, the sites, the files and the email all live on your side. Nothing of yours is kept on ours. One command installs it, and one upgrades it with a way back.

Ask us for a copy See the product

Everything runs on your side.

In your Fly organization

The Workspace and its database, on one always-on machine, backed up every day into a bucket of yours.
The code host, with CI that runs in your account.
Every agent machine, site machine and CI machine, made by your Workspace, as on ours.
Previews and sites, on names under your domain.
Email: addresses on your domain, a mail receiver of your own, and mail out through your own provider.
Files and backups, in two buckets of yours.
The images themselves, copied into your own registry. Nothing the copy runs is pulled from us.

With us

Our source code and the releases.
The update service your installer downloads releases from, with your update key.
Support. If your admin chooses to send us a diagnostics bundle, we see that, and only that.

No messages, code, files, mail, keys or logs cross to us. Your agents use your people’s own AI subscriptions, straight from your machines.

Nobody gets in by signing up. The first admin comes in through a one-time link the installer prints; everyone after that through an invite link, and an admin approves each person. Remove someone and they are signed out at once. Company single sign-on is not built yet.

About fifteen minutes, and five things.

A Fly organization with a card on file and its bill paid up, and an organization token for it in FLY_API_TOKEN.
A domain for the copy, such as agents.yourcompany.com, and access to its DNS. Give it a name of its own rather than your main domain: your staff’s mail already lives there, and the sites your agents publish will share the copy’s name.
An update key and a licence from us, both issued for that domain.
A way to send mail: any provider over standard SMTP, or a Resend key. You can add it later.
Node 20 or newer and flyctl on the computer you run the installer from. Nothing else to install.

Our clean test install took 14 minutes from command to ready. Most of that is copying the release, about 1.4 GB, and waiting for your DNS. Fly bills your organization directly for what the copy runs; there is nothing of ours on that bill.

One command installs it.

Download install.mjs from our update service with your update key; we send the address with the key. It is one file of plain JavaScript with no packages, so you can read every line before you run it. Then:

export FLY_API_TOKEN=<org token>

node install.mjs install \
  --org <your Fly organization> \
  --domain agents.yourcompany.com \
  --key-file update.key \
  --licence-file licence.txt \
  --smtp-host smtp.yourmail.com \
  --smtp-port 465 \
  --smtp-user <user> \
  --smtp-password-file smtp.txt

For Resend, use --resend-key-file resend.key in place of the four SMTP flags. Optional: --name for the prefix of everything it makes (your customer id by default), --region (the nearest by default) and --wait for how many minutes it waits for DNS (60 by default).

What it does, in order

Checks your organization’s billing, that the key was issued for this domain, and which release it opens. If anything fails, it stops before making anything.
Creates five apps and copies the release into the first of them, your registry.
Makes two buckets, the keys, and the addresses.
Deploys the Workspace, code host, router and mail receiver from your registry, with configuration it writes itself, and asks for three certificates.
Prints the DNS records to add (8, or 12 with Resend) and checks them on your domain’s own name servers every 15 seconds until they are right and the certificates are issued.
Runs a smoke test: the Workspace, the sign-up page, the code host, a preview name, and mail on port 25 with STARTTLS.
Prints the sign-in address, the first admin’s one-time link and the master key. The master key is shown once: keep it somewhere safe.

Every step is written to a state file as it finishes. Stop it at any point, run the same command again, and it carries on from the first unfinished step, making nothing twice.

What it creates. What it never sends us.

In your organization

Five apps: <name>-images (the registry), -backend, -git, -router and -mx.
Two buckets: <name>-media and <name>-backups.
Three disks, for the database, the code and the mail certificate.
Shared IPv4 and IPv6 addresses, and one dedicated IPv4 address for mail.
Three certificates, for the domain, everything under it, and the code host.
The keys it generates (SSH pair, master key, code host, CI and mail), stored as Fly secrets.

On your computer

<name>-copy.json, readable by you alone. Once the keys are stored, it holds names and addresses only; the upgrade reads it.
<name>-install.log, flyctl’s output, leaving out every command whose output holds a key.

What it talks to

Fly’s API and your own registry, with your token.
Your domain and its name servers.
Your mail provider, if you give it one.
Our update service, to download a release, signed in with your customer id and update key.

That download is the only time it reaches us. Your Fly token, the keys it makes, the master key, your people and your data never leave your side.

The copy checks its licence by itself, offline. It never calls us to ask.

One command upgrades it, with a way back.

Run it in the folder where the installer left its state file:

node install.mjs upgrade --key-file update.key

It takes the latest release your key covers; --release <version> picks one. It copies the release into your registry, snapshots the database and the disks, rolls the four apps one at a time, waiting for each to be healthy, and runs the smoke test again. If anything fails, it puts the old release back on all four and the database back as it was. --drill rehearses exactly that: it upgrades, fails on purpose, and comes back. A clean upgrade on our test copy takes two to six minutes.

Your admins see the copy’s health in the Workspace: the code host, the router, the mail receiver, the last backup and the disk.

If the agreement ends

An update key covers every release dated up to its end date, for good: you keep the versions you have and can reinstall them. Your admins see a notice 30 days before the licence ends, then get 30 days of grace. After that, nobody new can join and no new agents can be made. Nothing that already runs stops.

Read the installer before you run it.

The installer is open source. You hand it full rights over an organization, so you should be able to see exactly what it creates and what it sends. Its code and its tests are public, and every change to it is published there.

Read the installer’s code

Talk to us.

Write to [email protected] with your company’s name and the domain you have in mind. We send the update key and the licence for it. Questions before you decide are just as welcome.

Ask us for a copy