> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qredence.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy the fleet-rlm backend

> Run fleet-rlm in production as a single FastAPI SSE process against Postgres and Daytona, with policy-driven profiles and no built-in caller authentication.

fleet-rlm ships as a single FastAPI process that exposes the `/api/*` SSE surface described in the [HTTP API reference](/fleet-rlm/reference/http-api). There is no bundled web UI; the maintained client is pi-tui.

## Architecture in production

A production deploy needs:

* **fleet-rlm process** — `uv run fleet-rlm serve-api` (equivalent to `uv run fleet web`).
* **Daytona** — Sandbox provider (`FLEET_DAYTONA_API_KEY`).
* **Postgres** at the canonical Alembic head — `FLEET_DATABASE_URL`.
* **LLM provider** — OpenCode Go (interactive profiles) or Databricks AI Gateway (managed profile).
* **MLflow** (optional) — tracing backend. The `daytona-managed` profile requires managed Unity Catalog inputs.

Fleet has no caller authentication. Backend launchers default to binding `127.0.0.1` and reject non-loopback hosts unless `--allow-non-loopback-bind` is passed. In production, terminate TLS and enforce access control at a reverse proxy in front of Fleet on a private interface.

## Environment configuration

Select the runtime policy in `config/fleet.toml`:

```toml theme={null}
[config]
default_profile = "daytona-managed"
```

Then set only the variables named by that profile:

```bash .env.production theme={null}
FLEET_DAYTONA_API_KEY=...
FLEET_DATABASE_URL=postgresql+asyncpg://USER:PASS@HOST/DB?sslmode=require

# daytona-managed / benchmark profiles
DATABRICKS_TOKEN=...
FLEET_DATABRICKS_AI_GATEWAY_BASE_URL=https://<gateway>/serving-endpoints
FLEET_MLFLOW_EXPERIMENT_NAME=...
FLEET_MLFLOW_TRACE_CATALOG=...
FLEET_MLFLOW_TRACE_SCHEMA=...
FLEET_MLFLOW_TRACE_TABLE_PREFIX=...
FLEET_MLFLOW_TRACING_SQL_WAREHOUSE_ID=...
```

See the [configuration reference](/fleet-rlm/reference/configuration) for the complete matrix.

## Initialize the database

Fleet never applies migrations at startup. Bring the database to the canonical Alembic head before starting the backend:

```bash theme={null}
uv run python scripts/db_init.py
uv run alembic check
```

## Run the backend

```bash theme={null}
uv run fleet-rlm serve-api --port 8000
```

To bind a non-loopback interface behind a proxy, pass the deliberate opt-in:

```bash theme={null}
uv run fleet-rlm serve-api --host 0.0.0.0 --port 8000 --allow-non-loopback-bind
```

The `/api/settings` endpoint still rejects non-loopback clients when the main API is exposed. Route settings edits through pi-tui `/settings` on a loopback client.

## Health probes

Two unauthenticated endpoints are designed for orchestrators and load balancers:

| Endpoint      | Purpose                                                                                                                                                                 |
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `GET /health` | Liveness.                                                                                                                                                               |
| `GET /ready`  | Readiness including planner, database, and sandbox provider status. Returns `503` with the same `ReadyResponse` body when a critical dependency is missing or degraded. |

## Reverse proxy notes

* Terminate TLS at the proxy and forward to Fleet on a private interface.
* Disable response buffering. The Turn stream is Server-Sent Events; buffered proxies will delay `data-status` heartbeats and Runtime Events.
* The Turn stream emits a transient `data-status` chunk every `runtime.heartbeat_seconds` while preparation resolves. Set the proxy read timeout above that heartbeat.

## Verify the deploy

Run the Daytona doctor before load-testing a real Turn:

```bash theme={null}
uv run fleet doctor daytona
```

Then hit the readiness endpoint:

```bash theme={null}
curl https://your-deploy.example.com/ready
```

## See also

* [Configuration reference](/fleet-rlm/reference/configuration)
* [HTTP API reference](/fleet-rlm/reference/http-api)
* [CLI reference](/fleet-rlm/reference/cli)