Router API

The router is the only public service (:443). It validates a Supabase JWT, ensures the user's environment is awake (Fly Machine or Railway service), and reverse-proxies the request to their daemon.

Public surface

All non-health traffic flows through the JWT middleware: the token identifies the user, the proxy looks up the user's environment, wakes it if needed (with a configurable WakeTimeout, default 30s), waits for daemon readiness (polling /healthz on the environment), then forwards the request.

Cody routing

Requests to /cody/* are routed to the co-located Cody engine (codyd) on its own port (default :8090). The /cody prefix is stripped before forwarding.

Environment lifecycle states

Internal surface

The internal mux is bound to a private address (ROUTER_INTERNAL_ADDR, not public):

Create a user (admin)

POST /admin/users creates or touches a user and ensures an attached environment. The request blocks while the provider API provisions the volume and instance (synchronous in v1).

curl -X POST http://router.internal/admin/users \
  -H "Authorization: Bearer $ROUTER_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"supabase_user_id": "uuid-here", "email": "user@example.com"}'

Auto-provisioning (first request)

When an authenticated user has no row in the database, the router can auto-provision their environment on the first request. This path is gated by an invite check: the user must have a redeemed invite. Concurrent first requests for the same user are deduplicated so only one environment is provisioned.

Provider support

The router supports two environment providers, selected by ROUTER_PROVIDER:

Configuration