render.yaml

# Exported from Render on 2024-11-07T15:50:51Z
services:
    # =========================================
    # Web Application Configuration (Frontend)
    # =========================================
    - type: web
      name: aai-unified1-web
      runtime: docker
      repo: https://github.com/the-answerai/theanswer
      plan: starter
      envVars:
          # =========================================
          # Web Application Configuration
          # =========================================
          - key: NODE_ENV
            value: production
          - key: PORT
            value: '3000'
          - key: HOSTNAME
            value: '0.0.0.0'
          - key: NEXT_TELEMETRY_DISABLED
            value: '1'
          - key: DEBUG
            value: 'true'
          - key: LOG_LEVEL
            value: 'debug'
          - key: ANALYZE
            value: 'false'
          - key: AUTH0_DEBUG
            value: 'true'
          - key: VERBOSE
            value: 'true'

          # =========================================
          # Web Database Configuration
          # =========================================
          - key: DATABASE_TYPE
            value: postgres
          - key: DATABASE_NAME
            fromDatabase:
                name: aai-unified3-database
                property: database
          - key: DATABASE_HOST
            fromDatabase:
                name: aai-unified3-database
                property: host
          - key: DATABASE_PORT
            fromDatabase:
                name: aai-unified3-database
                property: port
          # Database name will be set from DATABASE_SECRET
          - key: DATABASE_USER
            fromDatabase:
                name: aai-unified3-database
                property: user
          - key: DATABASE_PASSWORD
            fromDatabase:
                name: aai-unified3-database
                property: password
          # DATABASE_URL will be constructed by entrypoint.sh from DATABASE_SECRET
          - key: DATABASE_SECRET
            value: '{"engine":"postgres","host":"${DATABASE_HOST}","port":"${DATABASE_PORT}","dbname":"${DATABASE_NAME}","username":"${DATABASE_USER}","password":"${DATABASE_PASSWORD}"}'

          # =========================================
          # Web Auth0 Configuration (Must Match Backend)
          # =========================================
          - key: AUTH0_DOMAIN
            sync: false
          - key: AUTH0_BASE_URL
            sync: false
          - key: AUTH0_SECRET
            sync: false
          - key: AUTH0_CLIENT_ID
            sync: false
          - key: AUTH0_CLIENT_SECRET
            sync: false
          - key: AUTH0_AUDIENCE
            sync: false
          - key: AUTH0_ISSUER_BASE_URL
            sync: false
          - key: AUTH0_ORGANIZATION_ID
            sync: false
          - key: AUTH0_TOKEN_SIGN_ALG
            value: 'RS256'
          - key: AUTH0_SCOPE
            value: 'openid profile email'
          - key: AUTH0_JWKS_URI
            sync: false

          # =========================================
          # Web Domain Configurations
          # =========================================
          - key: ANSWERAI_DOMAIN
            fromService:
                name: aai-unified1-web
                type: web
                property: hostport
          - key: FLOWISE_DOMAIN
            fromService:
                name: aai-unified2-flowise
                type: web
                property: hostport
          - key: DOMAIN
            fromService:
                name: aai-unified2-flowise
                type: web
                property: hostport
          - key: API_HOST
            fromService:
                name: aai-unified2-flowise
                type: web
                property: hostport

          # =========================================
          # Web External Services
          # =========================================
          - key: REDIS_URL
            fromService:
                name: aai-unified4-redis
                type: redis
                property: connectionString
          - key: BILLING_STRIPE_SECRET_KEY
            sync: false
      region: virginia
      dockerContext: .
      dockerfilePath: ./apps/web/Dockerfile
      healthCheckPath: /healthcheck
      domains:
          - subdomain.theanswer.ai
          - web.subdomain.theanswer.ai

    # =========================================
    # Flowise Application Configuration (Backend)
    # =========================================
    - type: web
      name: aai-unified2-flowise
      runtime: docker
      repo: https://github.com/the-answerai/theanswer
      plan: standard
      envVars:
          # =========================================
          # Flowise Application Configuration
          # =========================================
          - key: NODE_ENV
            value: production
          - key: PORT
            value: '4000'
          - key: DEBUG
            value: 'true'
          - key: LOG_LEVEL
            value: 'warn'
          - key: LOG_PATH
            value: '/var/data'
          - key: DISABLE_FLOWISE_TELEMETRY
            value: 'true'
          - key: AUTH0_DEBUG
            value: 'true'
          - key: VERBOSE
            value: 'true'
          - key: NUMBER_OF_PROXIES
            value: '1'
          - key: FLOWISE_API_KEY
            generateValue: true
          - key: SESSION_SECRET
            generateValue: true

          # =========================================
          # Flowise Database Configuration
          # =========================================
          # DATABASE_URL will be constructed from DATABASE_SECRET
          - key: DATABASE_TYPE
            value: postgres
          - key: DATABASE_NAME
            fromDatabase:
                name: aai-unified3-database
                property: database
          - key: DATABASE_HOST
            fromDatabase:
                name: aai-unified3-database
                property: host
          - key: DATABASE_PORT
            fromDatabase:
                name: aai-unified3-database
                property: port
          # Database name will be set from DATABASE_SECRET
          - key: DATABASE_USER
            fromDatabase:
                name: aai-unified3-database
                property: user
          - key: DATABASE_PASSWORD
            fromDatabase:
                name: aai-unified3-database
                property: password

          # =========================================
          # Flowise Auth0 Configuration (Must Match Frontend)
          # =========================================
          - key: AUTH0_DOMAIN
            sync: false
          - key: AUTH0_BASE_URL
            sync: false
          - key: AUTH0_SECRET
            sync: false
          - key: AUTH0_CLIENT_ID
            sync: false
          - key: AUTH0_CLIENT_SECRET
            sync: false
          - key: AUTH0_AUDIENCE
            sync: false
          - key: AUTH0_ISSUER_BASE_URL
            sync: false
          - key: AUTH0_ORGANIZATION_ID
            sync: false
          - key: AUTH0_TOKEN_SIGN_ALG
            value: 'RS256'
          - key: AUTH0_SCOPE
            value: 'openid profile email'
          - key: AUTH0_JWKS_URI
            sync: false

          # =========================================
          # Flowise Domain Configuration
          # =========================================
          - key: CHATFLOW_DOMAIN
            fromService:
                name: aai-unified2-flowise
                type: web
                property: hostport
          - key: DOMAIN
            fromService:
                name: aai-unified2-flowise
                type: web
                property: hostport
          - key: FLOWISE_DOMAIN
            fromService:
                name: aai-unified2-flowise
                type: web
                property: hostport
          - key: ANSWERAI_DOMAIN
            fromService:
                name: aai-unified1-web
                type: web
                property: hostport

          # =========================================
          # Flowise Security & API Keys
          # =========================================
          # ⚠️ CRITICAL: FLOWISE_SECRETKEY_OVERWRITE is REQUIRED for Render deployments
          # Render containers are ephemeral - without this variable, each deploy generates
          # a new encryption key, making ALL stored credentials permanently unreadable.
          # Generate once with: openssl rand -base64 32
          # Store as a Render secret and NEVER regenerate unless rotating credentials.
          - key: FLOWISE_SECRETKEY_OVERWRITE
            sync: false
          - key: SECRETKEY_PATH
            value: '/var/data'
          - key: APIKEY_STORAGE_TYPE
            value: 'db'
          - key: APIKEY_PATH
            value: '/var/data'

          # =========================================
          # Flowise CORS & Iframe Settings
          # =========================================
          - key: CORS_ORIGINS
            value: '*'
          - key: IFRAME_ORIGINS
            value: '*'

          # =========================================
          # Flowise Redis Configuration
          # =========================================
          - key: REDIS_URL
            fromService:
                name: aai-unified4-redis
                type: redis
                property: connectionString
          - key: AAI_DEFAULT_REDIS_URL
            fromService:
                name: aai-unified4-redis
                type: redis
                property: connectionString

          # =========================================
          # Flowise Storage Configuration
          # =========================================
          - key: STORAGE_TYPE
            sync: false
          - key: S3_STORAGE_BUCKET_NAME
            sync: false
          - key: S3_STORAGE_ACCESS_KEY_ID
            sync: false
          - key: S3_STORAGE_SECRET_ACCESS_KEY
            sync: false
          - key: S3_STORAGE_REGION
            sync: false
          # S3_FORCE_PATH_STYLE: false for AWS S3, true for S3-compatible services (MinIO, DigitalOcean, etc.)
          - key: S3_FORCE_PATH_STYLE
            value: 'false'

          # =========================================
          # Flowise Langfuse Tracing
          # =========================================
          - key: LANGFUSE_HOST
            sync: false
          - key: LANGFUSE_PUBLIC_KEY
            sync: false
          - key: LANGFUSE_SECRET_KEY
            sync: false

          # =========================================
          # Flowise External Services
          # =========================================
          - key: AAI_DEFAULT_OPENAI_API_KEY
            sync: false
      region: virginia
      dockerContext: .
      dockerfilePath: ./Dockerfile
      healthCheckPath: /api/v1/ping
      domains:
          - api.subdomain.theanswer.ai
          - flowise.subdomain.theanswer.ai

    # ================================================================
    # Redis Application Configuration (Cache)
    # ================================================================
    - type: keyvalue
      name: aai-unified4-redis
      plan: free
      region: virginia
      maxmemoryPolicy: allkeys-lru
      ipAllowList: []
# ================================================================
# Database Application Configuration (Postgres)
# ================================================================
databases:
    - name: aai-unified3-database
      databaseName: aai_unified_database
      user: admin
      plan: basic-256mb
      region: virginia
      postgresMajorVersion: '16'
      # CURRENT SETTING: Internal-Renderonly access (most secure for Database services)
      ipAllowList: []
      # =========================================
      # SECURITY WARNING - DATABASE ACCESS CONTROL
      # =========================================
      # ⚠️  CRITICAL: Never use 0.0.0.0/0 for database access - this opens your database to the entire internet!
      # ⚠️  ALWAYS use specific IP addresses or internal-only access for production databases
      #
      # SECURE CONFIGURATION GUIDELINES:
      # • Use /32 CIDR notation for single IP addresses (most secure)
      # • Use /24 CIDR notation only for trusted corporate VPN subnets
      # • Never use broader ranges like /16 or /8 for database access
      # • Check your current IP at https://ipchicken.com before adding home office access
      #
      # Examples:
      # ipAllowList:
      #   - source: 203.0.113.4/32
      #     description: home-office-single-ip (check ipchicken.com for current IP)
      #   - source: 198.51.100.0/24
      #     description: corporate-vpn-subnet (only for trusted VPN ranges)