feat(deploy): add PaaS templates and config

docs/plans/2026-02-16-deployment-targets.md

@@ -0,0 +1,41 @@
+# Milestone 6 (P3): Deployment Targets (Nix + Fly/Railway/Render)
+
+Date: 2026-02-16
+
+## Goals
+
+- Provide a Nix flake/package that builds `dist/` and preserves `dist/gateway/ui` adjacency.
+- Provide an optional NixOS module for running Flynn as a systemd service.
+- Add first-class docs and templates for Fly.io / Railway / Render.
+- Ensure PaaS network binding works (`server.localhost: false`) and port binding works (`PORT` env override).
+
+## Implementation
+
+### Nix
+
+- Added `flake.nix` with:
+  - `packages.flynn` / `packages.default`
+  - `apps.default` (`nix run`)
+  - `devShells.default` (`nix develop`)
+  - `overlays.default` (exposes `pkgs.flynn`)
+  - `nixosModules.flynn`
+- Added Nix package definition: `nix/package.nix` (builds via `pnpm build`).
+- Added NixOS module: `nix/module.nix` (`services.flynn.*`).
+- Added docs: `docs/deployment/NIX.md`.
+
+### PaaS
+
+- Added a PaaS-friendly config template: `config/paas.yaml` (`server.localhost: false`).
+- Updated `Dockerfile` to ship a default config at `/config/config.yaml` so the image is runnable without a bind-mount.
+- Added templates:
+  - Fly.io: `deploy/flyio/fly.toml`
+  - Railway: `deploy/railway/railway.toml`
+  - Render: `deploy/render/render.yaml`
+- Added docs: `docs/deployment/PAAS.md`.
+
+## Acceptance Notes
+
+- `pnpm build` still copies gateway UI to `dist/gateway/ui` (required adjacency).
+- `PORT` env override is implemented in `src/config/loader.ts` (completed earlier on 2026-02-16).
+- For PaaS/container routing, use `server.localhost: false` (baked into `config/paas.yaml`).
+

docs/plans/state.json

@@ -72,6 +72,28 @@
       "test_status": "Not run (Nix build requires pnpmDepsHash update); pnpm test suite unaffected"
     },
 
+    "deployment-targets-paas": {
+      "file": "2026-02-16-deployment-targets.md",
+      "status": "completed",
+      "date": "2026-02-16",
+      "updated": "2026-02-16",
+      "summary": "Added PaaS deployment templates and docs for Fly.io / Railway / Render, plus a PaaS-friendly config template (server.localhost: false) and a Docker image default /config/config.yaml for easier platform deployment.",
+      "files_created": [
+        "docs/plans/2026-02-16-deployment-targets.md",
+        "docs/deployment/PAAS.md",
+        "config/paas.yaml",
+        "deploy/flyio/fly.toml",
+        "deploy/railway/railway.toml",
+        "deploy/render/render.yaml"
+      ],
+      "files_modified": [
+        "Dockerfile",
+        "README.md",
+        "docs/deployment/PRODUCTION.md"
+      ],
+      "test_status": "pnpm test suite unaffected (deployment/docs changes)"
+    },
+
     "openclaw-gap-roadmap": {
       "file": "2026-02-15-openclaw-gap-roadmap.md",
       "status": "planned",
@@ -2176,7 +2198,7 @@
     "tier2_completion": "4/4 (100%) — inbound webhooks, vector memory search, Dockerfile, heartbeat monitor",
     "tier3_completion": "5/5 (100%) — lane queue, credential redaction, web UI token dashboard, xAI (Grok) provider, Voyage AI embeddings",
     "tier4_completion": "4/4 (100%) — gateway lock, shell completion, Tailscale Serve/Funnel, DM pairing codes",
-    "feature_gap_scorecard": "103/128 match (80%), 0 partial (0%), 25 missing (20%)",
+    "feature_gap_scorecard": "104/128 match (81%), 0 partial (0%), 24 missing (19%)",
     "operator_dx_milestone": "Phase 3 (Live Ops Dashboard): 2/2 plans complete — milestone done",
     "gmail_auth_cli": "flynn gmail-auth command implemented with OAuth2 flow, doctor check, config routed to Telegram",
     "native_audio_support": "completed — smart routing for native audio (Gemini/OpenAI/GitHub) vs Whisper transcription fallback",