pds-infra #
deploy config for pds.zzstoatzz.io — the personal data server hosting my main atproto account.
stock bluesky-social/pds image, run on fly.io (app pds-zzstoatzz-io, region ord). config lives in fly.toml; secrets live in fly secrets (never committed — see the list in fly.toml).
usage #
just check-upgrade # deployed version vs upstream :latest
just deploy # redeploy the pinned :latest image
image is pinned to :latest, so just deploy always pulls the newest pds. account management UI (sign out devices, revoke apps, change password) lives at /account as of pds 0.4.5006.
⚠️ currently running a locally-built image (2026-07-02) #
the deployed pds (0.4.5014) was built from the stock
bluesky-social/pds Dockerfile with
@atproto/pds bumped to 0.5.14, to pick up
atproto PR #5147
(merged 2026-06-25): the oauth authorize page previously rejected
same-site clients (Sec-Fetch-Site: same-site), which broke oauth
sign-in from phi.zzstoatzz.io/operator because the cockpit and this pds
share zzstoatzz.io. no upstream image release contains the fix yet
(v0.4.5009 was tagged two minutes before the merge).
consequence: upstream :latest is currently older than what's
deployed. just deploy refuses to move the version backwards and will
start passing again on its own once upstream tags a release ≥ 0.4.5014-era.
just check-upgrade reports the ahead/behind state; just deploy-force
overrides the guard if you know why.