---
name: "Fly.io Machines API integration for multi-tenant huskies SaaS"
---

# Spike 408: Fly.io Machines API integration for multi-tenant huskies SaaS

## Question

Can we build a working Rust integration that creates and manages per-tenant Fly.io Machines, attaches volumes, injects Claude credentials, and proxies JWT-authenticated HTTP/WebSocket traffic to the right machine?

## Hypothesis

A thin Rust service using `reqwest` for the Machines API and `axum` for the reverse proxy is sufficient. No heavyweight orchestration framework needed.

## Prerequisites

- Fly.io account with API token (set `FLY_API_TOKEN` env var)
- Spike 407 findings reviewed

## Timebox

4 hours

## Investigation Plan

- [ ] Create a minimal Rust crate in `spikes/fly_machines/` — do not touch production code
- [ ] Implement machine lifecycle: create, start, stop, destroy via Fly Machines REST API using `reqwest`
- [ ] Test attaching a persistent volume to a machine and verify it persists across stop/start
- [ ] Test secret injection — pass a dummy `credentials.json` as a Fly secret and verify it's readable inside the machine
- [ ] Sketch the auth proxy: JWT validation → machine lookup → reverse proxy to machine's private IP; verify WebSocket proxying works
- [ ] Measure actual cold start time for a minimal huskies container image
- [ ] Document any API quirks, rate limits, or sharp edges discovered during testing

## Findings

- TBD

## Recommendation

- TBD
