Add the Bills and Renewals check

[HarrisonWard]

What

A private GET /api/health/upkeep route for Uptime Kuma that checks the things that quietly stop BandWagon when a bill or a renewal slips:

• Domains: renewal date of the APP_URL domain plus any in WATCH_DOMAINS (public RDAP). Yellow inside 30 days, red inside 7. A failed lookup is yellow.
• Builds: whether GitHub actually ran the last build on GITHUB_BRANCH. When every job has no steps, it says GitHub didn't start the build, which is almost always a failed payment or the Actions spending limit.

200 when all is well, 503 when something is red. Results cached 6 hours per instance. Code in apps/web/src/lib/upkeep.ts, route in apps/web/src/app/api/health/upkeep/route.ts.

Why

A failed GitHub payment on Oct 7 to 8, 2026 silently stopped builds and nothing said so. This makes that (and a lapsing domain) page the phone.

Setup

1. Coolify: set UPKEEP_TOKEN to 32+ random characters (secret). Use a different value on staging.
2. GitHub > Settings > Developer settings > Fine-grained tokens: this repo only, Actions: Read, Contents: Read, 1 year expiry (calendar reminder). Set it as GITHUB_STATUS_TOKEN (secret). GITHUB_REPO and GITHUB_BRANCH default to harrisonwardtechnology/BandWagon and main.
3. Optional: WATCH_DOMAINS=flomogo.app (and any other domains to watch).
4. Uptime Kuma: HTTP(s) monitor "Bills and Renewals", https://bandwagon.club/api/health/upkeep, every 6 hours, retries 1, header {"Authorization": "Bearer <UPKEEP_TOKEN>"}, shared phone alert channel, not on the public status page.

Docs: docs/operations/UPTIME-KUMA-PLAYBOOK.md#bills-and-renewals-check, docs/COOLIFY.md. Variables added to the three Coolify compose files and config/env.schema.example.ts.

Security Notes

• Plain 404 unless the request carries Authorization: Bearer <UPKEEP_TOKEN>; the token must be at least 24 characters and is compared in constant time.
• Neither token is logged or returned. The response is Cache-Control: no-store.
• Only outbound GETs: rdap.org and api.github.com. GITHUB_REPO and GITHUB_BRANCH are validated before use.
• The middleware needed no change: it never required a session for GET health routes; only the bearer token unlocks this one.
• The GitHub token can only read build results and file names in this repo.

Tests Run

• npm test: 334 pass, 0 fail (new tests/upkeep.test.ts: token 404, short token, domain inside a week, billing never started, real failure, bad repo name, network failure, 6 hour cache; all network mocked)
• npm run typecheck: clean

🤖 Generated with Claude Code

https://claude.ai/code/session_017y11pRAne97h322a6bhYgD

---

Generated by Claude Code