Ops dashboard & production

Monitor graphs, queues, and scheduler health. Lock down exec routes and the /ops page before exposing to the internet.

Environment variables

The production template needs secrets for exec routes and the /ops dashboard. RESUMA_ENV and RESUMA_TRUST_PROXY are already in the scaffold fly.toml — set secrets manually:

Full environment guide →

fly secrets set RESUMA_EXEC_API_KEY=$(openssl rand -hex 32)
fly secrets set RESUMA_OPS_SESSION=$(openssl rand -hex 32)
# Browser cookie: resuma_session=<RESUMA_OPS_SESSION>

# Mount a persistent volume at /data/resuma (rate-limit, queue, durable graphs)
RESUMA_DATA_DIR=/data/resuma
RESUMA_RATE_BACKEND=disk
RESUMA_SCHEDULER_TICK_SECS=30
RESUMA_METRICS_PUBLIC=0

Persistent volume

Production apps should mount a volume at RESUMA_DATA_DIR. Resuma stores rate-limit counters, exec queues, scheduler jobs, and graph checkpoints on disk — no Redis. On Fly: fly volumes create resuma_data --size 1 and mount at /data/resuma in fly.toml. See Docker deploy.

Dashboard

The production template serves /ops with flow_dashboard_poll — polls the exec_status server action (session + CSRF) or falls back to GET /_resuma/status with API key.

Auth model

Prometheus

GET /_resuma/metrics
# HELP resuma_graphs_started_total ...
# Set RESUMA_METRICS_PUBLIC=1 only behind VPC / internal network

Production middleware

The production template validates resuma_session against RESUMA_OPS_SESSION — replace the stub in security.rs with your real auth provider before deploy.

Deploy

See Cookbook → Docker and the templates/production scaffold (resuma new --template production).

← Resuma OS overview