# Self-hosted Tap deploy

Tap is a separate, always-on service that subscribes to the AT Protocol relay,
verifies + backfills repos, and streams `quest.atmo.connection` record events to
atmoquest over a private WebSocket. atmoquest's consumer
([features/tap/consumer.go](../../features/tap/consumer.go)) writes the
reciprocal connection in real time (or queues it for the target's next login).

It runs as its **own Fly app** (`atmoquest-tap`), not part of the main
`atmoquest` deploy. atmoquest works fine without it — the consumer is a no-op
unless `TAP_WS_ENDPOINT` is set, and reciprocity falls back to the login-drain
queue.

## One-time setup (done out-of-band)

Run these once, locally, with your Fly org slug:

```bash
flyctl apps create atmoquest-tap --org <org-slug>
flyctl volumes create atmoquest_tap_data --app atmoquest-tap --region lax --size 1 --yes
flyctl secrets set TAP_WS_ENDPOINT="ws://atmoquest-tap.internal:2480/channel" --app atmoquest
```

Tap runs in collection-signal mode, so it auto-discovers every repo that writes
a `quest.atmo.connection` record — no `/repos/add` calls needed.

## Deploying

Redeploys run on merge/push to `main` via
[deploy-tap.yml](../../.tangled/workflows/deploy-tap.yml), alongside the main
`atmoquest` deploy. It just runs `flyctl deploy` from this directory, so it
needs `FLY_API_TOKEN` in the repo's Tangled settings → secrets. A version bump
takes effect by editing `INDIGO_VERSION` in the Dockerfile and merging to main.

Equivalently, by hand: `( cd deploy/tap && flyctl deploy --remote-only )`.

## Keeping versions in sync

`deploy/tap/Dockerfile`'s `INDIGO_VERSION` **must** match the
`github.com/bluesky-social/indigo` version in [go.mod](../../go.mod) so the Tap
wire format matches what the consumer decodes. Bump both together.

## Notes

- **Networking:** Tap has no public service — it's reachable only at
  `atmoquest-tap.internal:2480` on Fly's 6PN network. Don't expose it publicly;
  `/repos/add` and the event stream are unauthenticated by default.
- **Always-on:** the Fly config defines no services, so the machine never
  scale-to-zeroes. Tap keeps consuming the firehose and buffers undelivered
  events in its outbox (at-least-once + acks), so reciprocals survive atmoquest
  restarts / idle windows.
- **Auth (optional):** if you front Tap with an auth proxy, set a bearer token
  on atmoquest with `flyctl secrets set TAP_AUTH_TOKEN=… --app atmoquest`.
- **Relay:** defaults to Bluesky's relay (`relay1.us-east.bsky.network`).
  Override with `TAP_RELAY_URL` in `fly.toml` to use a different relay.