nolay.toml

Every field of the project settings file with types and defaults.

nolay.toml lives in the root of the project repository. Every field is optional: without the file the agent detects the builder and port itself. The file in the repository takes priority over the panel form, and the panel never does more than this file.

Secrets are not written in nolay.toml: the file lives in the repository. Set them in the panel on the Secrets page.

Example

builder = "auto"

[run]
port = 3000

[env]
NODE_ENV = "production"

[health]
path = "/healthz"

[proxy]
domains = ["app.example.com"]
redirect_www = true

[[volumes]]
name = "data"
path = "/app/data"

[backup]
schedule = "0 3 * * *"
targets = ["volumes"]

Fields

The table is built from the protocol schema nolay-toml.v1.json. A path with [] is an element of a table list, for example [[cron]]; source(git) and source(archive) are the two variants of the [source] section.

builderstringDefault: "auto"

How the image is built. auto picks on its own: your Dockerfile, then a Nolay template, then Railpack. compose is not supported yet, nixpacks is kept for older projects and is not used by auto.

Values: auto, nixpacks, railpack, dockerfile, compose, static, image, template:node, template:next-standalone, template:python-uvicorn, template:python-gunicorn, template:go, template:bun, template:ruby, template:static

backuptable

Backup schedule to your own S3 storage. No section means no backups. S3 keys are never written here: they are project secrets NOLAY_S3_*.

backup.dbtable

How to dump the database. Required when targets contains db.

backup.db.container_envstring

Name of the variable that holds the database password, for example POSTGRES_PASSWORD. The agent takes the value from project secrets.

backup.db.databasestring

Database name for postgres and mysql.

backup.db.kindstringDefault: "postgres"

Which database runs in the project container.

Values: postgres, mysql, sqlite

backup.db.servicestring

Name of a catalog service from uses to dump. User, database and password are then taken from the service.

backup.db.sqlite_pathstring

Path to the database file inside the container, sqlite only.

backup.db.userstring

Database user for postgres and mysql. Not a secret.

backup.keep_dailyintegerDefault: 7

How many daily copies to keep.

backup.keep_monthlyintegerDefault: 3

How many monthly copies to keep.

backup.keep_weeklyintegerDefault: 4

How many weekly copies to keep.

backup.schedulestringDefault: "0 3 * * *"

Cron schedule, five fields, UTC time.

backup.targetsarray of stringDefault: ["volumes"]

What to back up: project volumes, a database dump, or both.

Values: volumes, db

buildtable

Image build settings.

build.argstable of string

Build arguments (ARG in a Dockerfile). Keys use capital Latin letters, digits and _. Secrets do not belong here: the file lives in the repository.

build.base_dirstring

Reserved. The agent does not read this field yet; set the repository subdirectory in source.subdir.

build.build_cmdstring

Build command for Railpack, nixpacks and templates, for example npm run build.

build.dockerfilestring

Path to the Dockerfile inside the project directory. Defaults to Dockerfile.

build.imagestring

Ready-made image for builder = "image", for example nginx:alpine. Other builders ignore it.

build.install_cmdstring

nixpacks only: replaces its whole install step. Without it nixpacks installs dependencies from package.json and similar files.

build.static_dirstring

Directory with already built static files for builder = "static", dist by default. The agent does not build the frontend.

cronarray of table

Scheduled jobs. Each run starts a one-off container from the project image. Up to 20 jobs per project.

cron[].cmdstring

Command that runs as sh -c <cmd> in the job container.

cron[].namestring

Job name, unique within the project: lowercase Latin letters, digits and hyphens, up to 32 characters.

cron[].schedulestring

Cron schedule, five fields, UTC. A run is skipped while the previous one is still going.

cron[].timeout_secsintegerDefault: 900

How many seconds one run may take, 1 to 21600. After that the container is stopped.

envtable of string

Non-secret environment variables. Secrets are set in the panel; if a key is in both places, the secret wins.

healthtable

Readiness check. No section: the project is ready once the container runs. With path: the agent waits for a 2xx or 3xx answer on that path.

health.interval_secintegerDefault: 10

Pause between check attempts, seconds.

health.pathstring

HTTP check path, for example /healthz. Without it the image HEALTHCHECK is used.

health.timeout_secintegerDefault: 60

How long to wait for readiness in total, seconds. If it runs out, the new version is not switched on and the old one keeps running.

protectiontable

Domain protection on the entry proxy. No section: the defaults from this table apply.

protection.allow_ipsarray of stringDefault: []

Addresses and subnets allowed to reach the domain. Empty: open to everyone. The ACME certificate check is never blocked.

protection.block_bad_botsbooleanDefault: true

Answer 403 to known scanners by User-Agent. Search engine crawlers are not on the list.

protection.frame_optionsstringDefault: "SAMEORIGIN"

Value of the X-Frame-Options header: SAMEORIGIN or DENY. Remove the field and the header is not set.

protection.https_redirectbooleanDefault: true

Redirect HTTP to HTTPS with code 308. Does not apply to *.localhost, *.test and IP addresses.

protection.max_body_mbintegerDefault: 32

Maximum request body size in MiB. Larger requests get 413.

protection.rate_limitstringDefault: "300/1m"

Requests per IP as <count>/<window>, for example 300/1m, or off.

protection.wafstringDefault: "off"

Coraza attack filter with OWASP CRS rules. low has almost no false positives, medium is stricter. Costs about 100 MiB of memory.

Values: off, low, medium

protection.waf_excludearray of stringDefault: []

Paths where the filter is off, by prefix, for example /api/upload.

proxytable

Project domains. No domains: the project is reachable only inside the Docker network on the server.

proxy.domainsarray of stringDefault: []

Lowercase domains, no *. The agent on your server issues the certificate.

proxy.redirect_wwwbooleanDefault: false

Redirect www.<domain> to <domain> with code 308.

resourcestable

Project container limits.

resources.cpufloat

CPU share, for example 0.5 or 2.

resources.mem_mbinteger

Memory limit in MiB for the container and the build. Not set: the build runs with a 512 MiB limit.

runtable

How the project runs.

run.exposearray of stringDefault: []

Reserved, the agent does not read this field yet.

run.portinteger

Port the application listens on. Templates have their own default, so it is optional.

run.post_deploystring

Reserved, the agent does not read this field yet.

run.pre_deploystring

Reserved, the agent does not read this field yet. Run migrations from the application start command.

run.privileged_capsarray of stringDefault: []

Linux capabilities beyond the base set, without the CAP_ prefix, up to eight. Each one is written to the agent log.

run.start_cmdstring

Start command when the builder does not detect it, for example npm start.

sourcetable

Where the agent takes the code from. Usually the panel writes this section, there is no need to keep it in the repository.

source(git).commitstring

Exact commit. Set by the panel, not written in the repository.

source(git).kindstringrequired

git for a repository.

Values: git

source(git).refstringDefault: "main"

Branch, tag or commit hash.

source(git).subdirstring

Repository subdirectory to build from. Not set: the root.

source(git).urlstring

Repository address over HTTPS or SSH. Do not put a login or token in the address: private repositories use the NOLAY_GIT_TOKEN and NOLAY_GIT_SSH_KEY secrets.

source(archive).formatstringDefault: "tar_gz"

Archive format. Set by the panel on upload.

Values: tar_gz, zip, tar, tar_zst, tar_xz, tar_bz2

source(archive).kindstringrequired

archive for an archive uploaded through the panel.

Values: archive

source(archive).sha256string

Archive checksum. The agent verifies it before unpacking.

source(archive).sizeintegerDefault: 0

Archive size in bytes.

source(archive).upload_idstringDefault: "00000000-0000-0000-0000-000000000000"

Upload ID. Set by the panel.

usesarray of stringDefault: []

Server catalog services the project connects to, for example ["db", "cache"]. The connection string arrives as the DATABASE_URL, REDIS_URL or MONGO_URL secret.

volumesarray of table

Docker volumes for persistent data. Without volumes the container contents are lost on the next deploy.

volumes[].namestringrequired

Volume name within the project: lowercase Latin letters, digits and hyphens.

volumes[].pathstringrequired

Absolute path inside the container where the volume is mounted.

workersarray of table

Background processes: containers from the same image without a port or domain. Up to 10 per project.

workers[].cmdstring

Start command as sh -c <cmd>. The key can also be written as start_cmd.

workers[].namestring

Process name, unique within the project.