Deployment CLI for Standalone Control Planes

[aojea]

Currently, AI developers wanting to experiment with a custom, sovereign control plane (sam-one) are forced into a DevOps persona. The documentation tells them how to run it locally (with Cloudflare tunnels) or requires them to manually configure cloud infrastructure (Cloud Run, Kubernetes, Postgres, Secret Manager, persistent volumes) for a stateful production deployment

. We are missing a seamless, 1-click deployment UX—similar to Vercel, Fly.io, or SkyPilot—that empowers developers to spin up a agent mesh in their own cloud account without writing Terraform or managing Kubernetes.
​
We should provide a developer-first deployment experience that abstracts the cloud infrastructure entirely.

[aojea]

Talked with @kaisoz offline, he had some good ideas I can work on them

[aojea]

Proposal: Zero-Config sam-one + Declarative Cloud Recipes (No Cloud SDK Bloat)

Rather than absorbing cloud provider SDKs (gcloud, aws, flyctl) into sam-one or maintaining a custom provisioning CLI, we can eliminate the DevOps friction by fixing the 3 root causes inside sam-one that currently require multi-step cloud setup, and pairing sam-one with declarative recipes for the tools AI developers already use (SkyPilot, Fly.io, and 1-step Cloud Run).

1. Make sam-one Zero-Config on Any Platform

1. Dynamic External URL inference from HTTP Host / X-Forwarded-Host:
   • When --external-url is not explicitly set and a request arrives over HTTPS (or behind a TLS-terminating proxy with X-Forwarded-Proto: https), /info dynamically synthesizes the router's advertised WebSocket multiaddr (/dns4/<host>/tcp/443/wss/p2p/<peer-id>) from the request Host.
   • Impact: Eliminates the 2-step deploy (deploy -> read URL -> update SAM_EXTERNAL_URL) on Cloud Run, Fly.io, Render, Railway, and App Runner.
2. Deterministic Router Identity (router.key) on Stateless Containers:
   • When /data/router.key does not exist on disk and SAM_ADMIN_TOKEN is provided, derive the Ed25519 router key deterministically via HKDF from SAM_ADMIN_TOKEN.
   • Impact: Container restarts on stateless platforms (like Cloud Run) keep a stable router PeerID without needing a persistent volume.
3. Named Cloudflare Tunnel Token support (--tunnel-token-path / CLOUDFLARE_TUNNEL_TOKEN):
   • Extend --tunnel cloudflare to support named tunnel tokens in addition to anonymous Quick Tunnels (*.trycloudflare.com), allowing any free-tier VM or workstation behind NAT to serve a permanent custom https:// domain for $0/mo.

2. Ready-to-Run Declarative Recipes (deploy/) & Developer-Oriented Docs

• SkyPilot (deploy/skypilot/sam-one.yaml): sky launch -c sam-hub deploy/skypilot/sam-one.yaml provisions the cheapest/free-tier VM in the user's cloud and prints the control plane URL + enrollment token in sky logs.
• Fly.io (deploy/fly/fly.toml): fly launch with persistent /data volume and automatic HTTPS/WSS.
• Cloud Run (1 command): Single gcloud run deploy using pre-built ghcr.io/google/sam-one:latest (no docker build, no Artifact Registry, no second update step).
• Developer-first Getting Started docs: Clearly explain how to obtain a Control Plane URL (1. Public Testnet, 2. Laptop + Tunnel in 10s, 3. 1-command Cloud / SkyPilot) before diving into infrastructure internals.