Deploy Centrifugo securely on Fly.io

[fkesheh]

Summary

• add a digest-pinned, single-Machine Fly deployment for Centrifugo in gru
• disable the Centrifugo admin and HTTP API, restrict origins, and keep health private
• add validation-only CI plus an explicitly approved manual Fly deployment
• close production registration by default for the current single-user deployment
• harden the legacy AWS rollback workflow and document rollout, rollback, and security findings

Validation

• Centrifugo checkconfig
• Fly config validation
• container build and WebSocket origin smoke tests
• public admin/API/health route checks
• GitHub Actions actionlint
• 118 Vitest tests
• TypeScript check
• production Next.js build
• secret-pattern scan

Rollout note

This PR prepares the deployment but does not create the Fly app, import its HMAC secret, provision certificates, or change DNS. Follow docs/centrifugo-fly-rollout.md after merge.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ftown	Ready	Preview	Aug 3, 2026 9:12pm