Render blueprint

[ojusave]

What changed

Adds a Render Blueprint so OpenMuse can be deployed with 1 click.

render.yaml defines three services:

• openmuse-api: Node web service on Standard, with a 1 GB disk at /var/data (DATA_DIR=/var/data/openmuse). Live mode, because sample mode rejects the non-loopback host Render binds. Render generates OPENMUSE_ACCESS_KEY and TOKEN_ENCRYPTION_KEY. The deploy form asks for OPENAI_API_KEY and CPK_INTELLIGENCE_API_KEY.
• openmuse-web: static site from the Expo web export, with an SPA rewrite to /index.html. EXPO_PUBLIC_API_URL is taken from the API service at build time.
• openmuse-browser: private Docker service from apps/worker/Dockerfile, with a 1 GB disk at /data. The API calls it at http://openmuse-browser:8790 with a generated WORKER_TOKEN. To deploy without browsing, delete this service and the BROWSER_WORKER_URL and WORKER_TOKEN entries on the API.

The README Deploy section covers the button, first run (copy the access key, sign in, send a message), and the env vars. It also notes why the API is on Standard: at 512 MB the process runs out of memory while PGlite loads. The disk holds the database, PDFs, and the signing key. Chat threads stay on CopilotKit Intelligence. The Docker computer and Google mail or calendar are unchanged and are not started by this Blueprint.

Verification

Deployed this commit in a Render workspace as new services, including both disks:

• All three services went live. GET /api/health returned ok: true, mode: live, agentConfigured: true, browserConfigured: true.
• Signed in with the generated OPENMUSE_ACCESS_KEY. The workspace reported the browser connection as connected.
• API disk: created a draft, redeployed openmuse-api, and the same session still authenticated. GET /api/drafts returned that draft.
• Browser disk: opened https://example.com, closed the session, and redeployed openmuse-browser. The same session id came back with its title and URL, and reopen returned it active on example.com.
• The static site returned 200 for / and for a client route through the rewrite.
• render blueprints validate render.yaml passed.

These services were created from this render.yaml through the Render API. The Deploy button reads render.yaml from the default branch, so it works after this merges.

Integration limits

• The deploy needs CPK_INTELLIGENCE_API_KEY (npx copilotkit@latest login, then project select) and OPENAI_API_KEY. Another provider means changing MODEL and supplying that key.
• The API and the browser are both Standard, each with a 1 GB disk.
• The Docker computer and Google are not part of the Blueprint.
• If the private hostname is not openmuse-browser (this happened in the test workspace), set BROWSER_WORKER_URL to http://<that-host>:8790.

[jerelvelarde]

Thanks @ojusave, this is great. It covers everything from the Slack thread, and adding the browser worker was a nice bonus.

I checked render.yaml against the server and worker config. The env var names, the live-mode checks, the generated key and token lengths, the worker's fixed port 8790, and the Docker context all line up.

One fix before merge:

• README.md: the intro still says the Blueprint "deploys two services", and First run step 1 only waits for openmuse-api and openmuse-web. Both predate the browser commit. Could you change it to three services and add openmuse-browser to step 1? Otherwise someone can sign in before the browser service is up. The workspace would already show the browser as "connected", because that status only checks that the URL and token are set, but page reads would fail.

Optional:

• You mentioned the private hostname wasn't openmuse-browser in your test workspace. A line in the README on setting BROWSER_WORKER_URL to http://<host>:8790 when that happens would save people some debugging.
• The default MODEL is openai/gpt-4o-mini. We'd prefer a current default, for example openai/gpt-5, which the repo uses elsewhere.

The browser and browser-container failures are a flaky network test: example.com didn't load inside Chromium. They're unrelated to this PR, and I'll re-run them.