render.yaml

# Render Infrastructure-as-Code Blueprint
# Deploy: Connect repo to Render, it auto-detects this file
# Stack: Render (Backend) + Vercel (Frontend) + Supabase (PostgreSQL) + Render Redis
#
# IMPORTANT: JWT_SECRET and FERNET_KEY MUST be the SAME across all 3 backend services.
# Generate once:
#   python -c "import secrets; print(secrets.token_hex(32))"
#   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# Then set the SAME value in the Render dashboard for minicode-api, minicode-worker, and minicode-beat.

services:
  # ================================
  # Redis Cache (Render Key Value)
  # ================================
  - type: keyvalue
    name: minicode-redis
    plan: free
    region: oregon
    ipAllowList: []

  # ================================
  # Backend API (FastAPI + Gunicorn)
  # ================================
  - type: web
    name: minicode-api
    runtime: docker
    dockerfilePath: ./backend/Dockerfile
    dockerContext: ./backend
    dockerCommand: "gunicorn main:app --workers 4 --worker-class uvicorn.workers.UvicornWorker --bind 0.0.0.0:$PORT --timeout 120"
    plan: starter
    region: oregon
    branch: main
    preDeployCommand: "CREATE_TABLES=1 python main.py"
    healthCheckPath: /health
    envVars:
      - key: DATABASE_URL
        sync: false  # Set to your Supabase PostgreSQL connection string
      - key: REDIS_URL
        fromService:
          type: keyvalue
          name: minicode-redis
          property: connectionString
      - key: CELERY_BROKER_URL
        fromService:
          type: keyvalue
          name: minicode-redis
          property: connectionString
      - key: CELERY_RESULT_BACKEND
        fromService:
          type: keyvalue
          name: minicode-redis
          property: connectionString
      - key: GITHUB_CLIENT_ID
        sync: false  # Set in Render dashboard
      - key: GITHUB_CLIENT_SECRET
        sync: false  # Set in Render dashboard
      - key: GEMINI_API_KEY
        sync: false  # Set in Render dashboard
      - key: JWT_SECRET
        sync: false  # MUST be same across api, worker, beat — set manually in dashboard
      - key: FERNET_KEY
        sync: false  # MUST be same across api, worker, beat — set manually in dashboard
      - key: GOOGLE_CLIENT_ID
        sync: false  # Set in Render dashboard (optional)
      - key: GOOGLE_CLIENT_SECRET
        sync: false  # Set in Render dashboard (optional)
      - key: CORS_ORIGINS
        sync: false  # REQUIRED: Set to your Vercel frontend URL, e.g. https://minicode.vercel.app
      - key: ENVIRONMENT
        value: "production"
      - key: WEB_CONCURRENCY
        value: "4"
      - key: RESEND_API_KEY
        sync: false  # Set in Render dashboard
      - key: SMTP_EMAIL
        sync: false  # Set in Render dashboard (optional)
      - key: SMTP_PASSWORD
        sync: false  # Set in Render dashboard (optional)

  # ================================
  # Celery Worker (Background Tasks)
  # ================================
  - type: worker
    name: minicode-worker
    runtime: docker
    dockerfilePath: ./backend/Dockerfile
    dockerContext: ./backend
    dockerCommand: "celery -A worker.celery_app worker --loglevel=info"
    plan: starter
    region: oregon
    branch: main
    envVars:
      - key: DATABASE_URL
        sync: false  # Set to your Supabase PostgreSQL connection string
      - key: REDIS_URL
        fromService:
          type: keyvalue
          name: minicode-redis
          property: connectionString
      - key: CELERY_BROKER_URL
        fromService:
          type: keyvalue
          name: minicode-redis
          property: connectionString
      - key: CELERY_RESULT_BACKEND
        fromService:
          type: keyvalue
          name: minicode-redis
          property: connectionString
      - key: GITHUB_CLIENT_ID
        sync: false
      - key: GITHUB_CLIENT_SECRET
        sync: false
      - key: GEMINI_API_KEY
        sync: false
      - key: JWT_SECRET
        sync: false  # MUST be same across api, worker, beat
      - key: FERNET_KEY
        sync: false  # MUST be same across api, worker, beat
      - key: RESEND_API_KEY
        sync: false
      - key: SMTP_EMAIL
        sync: false
      - key: SMTP_PASSWORD
        sync: false
      - key: ENVIRONMENT
        value: "production"

  # ================================
  # Celery Beat (Scheduled Tasks)
  # ================================
  - type: worker
    name: minicode-beat
    runtime: docker
    dockerfilePath: ./backend/Dockerfile
    dockerContext: ./backend
    dockerCommand: "celery -A worker.celery_app beat --loglevel=info"
    plan: starter
    region: oregon
    branch: main
    envVars:
      - key: DATABASE_URL
        sync: false  # Set to your Supabase PostgreSQL connection string
      - key: REDIS_URL
        fromService:
          type: keyvalue
          name: minicode-redis
          property: connectionString
      - key: CELERY_BROKER_URL
        fromService:
          type: keyvalue
          name: minicode-redis
          property: connectionString
      - key: CELERY_RESULT_BACKEND
        fromService:
          type: keyvalue
          name: minicode-redis
          property: connectionString
      - key: GITHUB_CLIENT_ID
        sync: false
      - key: GITHUB_CLIENT_SECRET
        sync: false
      - key: GEMINI_API_KEY
        sync: false
      - key: JWT_SECRET
        sync: false  # MUST be same across api, worker, beat
      - key: FERNET_KEY
        sync: false  # MUST be same across api, worker, beat
      - key: RESEND_API_KEY
        sync: false
      - key: SMTP_EMAIL
        sync: false
      - key: SMTP_PASSWORD
        sync: false
      - key: ENVIRONMENT
        value: "production"