| name | deploy |
| description | Elixir/Phoenix deployment patterns — Dockerfile, fly.toml; Use when configuring Fly.io, Docker, CI/CD, health checks… |
Elixir/Phoenix Deployment Reference
Quick reference for deploying Elixir/Phoenix applications.
Iron Laws — Never Violate These
- Config at runtime, not compile time — Secrets in
config.exs get baked into the release binary. Use runtime.exs with env vars so secrets are resolved at boot
- Graceful shutdown ≥ 60 seconds — Shorter timeouts kill in-flight requests and WebSocket connections mid-operation, causing data loss for users
- Health checks required — Without startup/liveness/readiness endpoints, orchestrators can't distinguish a booting node from a dead one, leading to cascading restarts
- SSL verification for database — Skipping
verify: :verify_peer allows MITM attacks between your app and database; production data traverses the connection
- No CPU limits — The BEAM scheduler assumes it owns all cores; cgroups CPU limits cause scheduler collapse where the VM thinks it has more cores than it can use, leading to latency spikes
- Guard optional service credentials —
runtime.exs runs whenever a
release boots, including eval-based migration commands. Only require S3,
Redis, and similar credentials when that integration is enabled
Quick Configuration
runtime.exs (Essential)
if config_env() == :prod do
database_url = System.get_env("DATABASE_URL") || raise "DATABASE_URL is required"
secret_key_base = System.get_env("SECRET_KEY_BASE") || raise "SECRET_KEY_BASE is required"
host = System.get_env("PHX_HOST") || raise "PHX_HOST is required"
config :my_app, MyApp.Repo,
url: database_url,
pool_size: String.to_integer(System.get_env("POOL_SIZE") || "10"),
ssl: true,
ssl_opts: [verify: :verify_peer]
config :my_app, MyAppWeb.Endpoint,
url: [host: host, port: 443, scheme: "https"],
http: [ip: {0, 0, 0, 0}, port: String.to_integer(System.get_env("PORT") || "4000")],
secret_key_base: secret_key_base,
server: true
end
