render.yaml

# Render Blueprint for My Nethesis
# =============================================================================
# Architecture: Private services exposed via proxy
# PRODUCTION: my.nethesis.it (release-based deployment)
# QA: qa.my.nethesis.it (auto-deploy + PR previews)
#
# Env vars are organized in 5 groups per environment (qa, prod):
#   - infra-{env}        internal service URLs (e.g. MIMIR_URL)
#   - spaces-{env}       DigitalOcean Spaces credentials and buckets
#   - app-secrets-{env}  cross-service shared secrets
#   - logto-{env}        Logto tenant + JWT auth config
#   - smtp-{env}         SMTP / email config
# Group values are managed in Render Dashboard. Values declared with
# `sync: false` must be set there before first deploy.
# =============================================================================

# =============================================================================
# DATABASES
# =============================================================================

databases:
  # Production PostgreSQL Database
  - name: my-postgres-prod
    plan: basic-256mb
    region: frankfurt
    databaseName: noc
    ipAllowList: []

  # QA PostgreSQL Database
  - name: my-postgres-qa
    plan: basic-256mb
    databaseName: noc
    ipAllowList: []

# =============================================================================
# ENVIRONMENT VARIABLE GROUPS
# =============================================================================

envVarGroups:
  # ---------- PROD ----------

  - name: infra-prod
    envVars:
      - key: MIMIR_URL
        value: http://my-mimir-prod:9009

  - name: spaces-prod
    envVars:
      # Shared DigitalOcean Spaces credentials (used by mimir, backend, collect)
      - key: S3_ENDPOINT
        sync: false
      - key: S3_ACCESS_KEY
        sync: false
      - key: S3_SECRET_KEY
        sync: false
      # Service-specific buckets
      - key: MIMIR_S3_ALERTMANAGER_BUCKET
        sync: false
      - key: BACKUP_S3_BUCKET
        sync: false

  - name: app-secrets-prod
    envVars:
      - key: ALERTING_HISTORY_WEBHOOK_SECRET
        sync: false

  - name: logto-prod
    envVars:
      - key: LOGTO_TENANT_ID
        sync: false
      - key: LOGTO_TENANT_DOMAIN
        sync: false
      - key: APP_URL
        sync: false
      - key: JWT_SECRET
        sync: false
      - key: LOGTO_BACKEND_APP_ID
        sync: false
      - key: LOGTO_BACKEND_APP_SECRET
        sync: false

  - name: smtp-prod
    envVars:
      - key: SMTP_HOST
        sync: false
      - key: SMTP_PORT
        sync: false
      - key: SMTP_USERNAME
        sync: false
      - key: SMTP_PASSWORD
        sync: false
      - key: SMTP_FROM
        sync: false
      - key: SMTP_FROM_NAME
        sync: false
      - key: SMTP_TLS
        sync: false

  # ---------- QA ----------

  - name: infra-qa
    envVars:
      - key: MIMIR_URL
        value: http://my-mimir-qa:9009

  - name: spaces-qa
    envVars:
      # Shared DigitalOcean Spaces credentials (used by mimir, backend, collect)
      - key: S3_ENDPOINT
        sync: false
      - key: S3_ACCESS_KEY
        sync: false
      - key: S3_SECRET_KEY
        sync: false
      # Service-specific buckets
      - key: MIMIR_S3_ALERTMANAGER_BUCKET
        sync: false
      - key: BACKUP_S3_BUCKET
        sync: false

  - name: app-secrets-qa
    envVars:
      - key: ALERTING_HISTORY_WEBHOOK_SECRET
        sync: false

  - name: logto-qa
    envVars:
      - key: LOGTO_TENANT_ID
        sync: false
      - key: LOGTO_TENANT_DOMAIN
        sync: false
      - key: APP_URL
        sync: false
      - key: JWT_SECRET
        sync: false
      - key: LOGTO_BACKEND_APP_ID
        sync: false
      - key: LOGTO_BACKEND_APP_SECRET
        sync: false

  - name: smtp-qa
    envVars:
      - key: SMTP_HOST
        sync: false
      - key: SMTP_PORT
        sync: false
      - key: SMTP_USERNAME
        sync: false
      - key: SMTP_PASSWORD
        sync: false
      - key: SMTP_FROM
        sync: false
      - key: SMTP_FROM_NAME
        sync: false
      - key: SMTP_TLS
        sync: false

services:
# =============================================================================
# PRODUCTION ENVIRONMENT - my.nethesis.it
# Release-based deployment (GitHub Actions)
# =============================================================================

  # Production Redis Cache
  - type: keyvalue
    name: my-redis-prod
    plan: starter
    region: frankfurt
    maxmemoryPolicy: allkeys-lru
    ipAllowList: []

  # Production Mimir (Private Service - NOT internet accessible)
  - type: pserv
    name: my-mimir-prod
    runtime: image
    plan: starter
    region: frankfurt
    image:
      url: ghcr.io/nethserver/my/mimir:v0.6.1
    envVars:
      - fromGroup: spaces-prod
      - key: PORT
        value: 9009
      # Go must honor the cgroup limit, otherwise GC waits too long and the
      # container is OOM-killed before any GC pass. ~78% of the 512 MB plan.
      - key: GOMEMLIMIT
        value: 400MiB
      - key: GOGC
        value: 50

  # Production Backend API Server (Private Service)
  - type: pserv
    name: my-backend-prod
    runtime: image
    plan: starter
    region: frankfurt
    image:
      url: ghcr.io/nethserver/my/backend:v0.6.1
    envVars:
      - fromGroup: infra-prod
      - fromGroup: spaces-prod
      - fromGroup: app-secrets-prod
      - fromGroup: logto-prod
      - fromGroup: smtp-prod

      # Server Configuration
      - key: GIN_MODE
        value: release
      - key: LISTEN_ADDRESS
        value: 0.0.0.0:10000
      - key: LOG_LEVEL
        value: info
      - key: LOG_FORMAT
        value: json

      # Redis Configuration
      - key: REDIS_URL
        fromService:
          type: keyvalue
          name: my-redis-prod
          property: connectionString
      - key: REDIS_DB
        value: 0

      # PostgreSQL Configuration
      - key: DATABASE_URL
        fromDatabase:
          name: my-postgres-prod
          property: connectionString

      # Backend-only alerting webhook URL (env-specific public URL)
      - key: ALERTING_HISTORY_WEBHOOK_URL
        sync: false

  # Production Collect Service (Private Service)
  - type: pserv
    name: my-collect-prod
    runtime: image
    plan: starter
    region: frankfurt
    image:
      url: ghcr.io/nethserver/my/collect:v0.6.1
    envVars:
      - fromGroup: infra-prod
      - fromGroup: spaces-prod
      - fromGroup: app-secrets-prod

      # Server Configuration
      - key: GIN_MODE
        value: release
      - key: LISTEN_ADDRESS
        value: 0.0.0.0:10000
      - key: LOG_LEVEL
        value: info
      - key: LOG_FORMAT
        value: json

      # Go must honor the cgroup limit, otherwise GC waits too long and the
      # container is OOM-killed before any GC pass. ~78% of the 512 MB plan.
      - key: GOMEMLIMIT
        value: 400MiB
      - key: GOGC
        value: 50

      # Redis Configuration
      - key: REDIS_URL
        fromService:
          type: keyvalue
          name: my-redis-prod
          property: connectionString
      - key: REDIS_DB
        value: 1

      # PostgreSQL Configuration
      - key: DATABASE_URL
        fromDatabase:
          name: my-postgres-prod
          property: connectionString

  # Production Frontend (Private Service)
  - type: pserv
    name: my-frontend-prod
    runtime: image
    plan: starter
    region: frankfurt
    image:
      url: ghcr.io/nethserver/my/frontend:v0.6.1
    envVars:
      - key: VITE_PRODUCT_NAME
        value: "My Nethesis"
      - key: VITE_LOGTO_ENDPOINT
        sync: false  # Configure in Render dashboard
      - key: VITE_LOGTO_APP_ID
        sync: false  # Configure in Render dashboard
      - key: VITE_API_BASE_URL
        value: "/backend/api"
      - key: VITE_SIGNIN_REDIRECT_URI
        value: "login-redirect"
      - key: VITE_SIGNOUT_REDIRECT_URI
        value: "login"

  # Production Proxy - Public Entry Point (my.nethesis.it)
  - type: web
    name: my-proxy-prod
    runtime: image
    plan: starter
    region: frankfurt
    image:
      url: ghcr.io/nethserver/my/proxy:v0.6.1
    domains:
      - my.nethesis.it
    envVars:
      # Service names for automatic URL generation
      - key: BACKEND_SERVICE_NAME
        value: my-backend-prod
      - key: COLLECT_SERVICE_NAME
        value: my-collect-prod
      - key: FRONTEND_SERVICE_NAME
        value: my-frontend-prod


# =============================================================================
# QA ENVIRONMENT - qa.my.nethesis.it
# Auto-deploy on every commit + PR previews
# =============================================================================

  # QA Redis Cache
  - type: keyvalue
    name: my-redis-qa
    plan: starter
    maxmemoryPolicy: allkeys-lru
    ipAllowList: []

  # QA Mimir (Private Service)
  - type: pserv
    name: my-mimir-qa
    runtime: docker
    plan: starter
    rootDir: services/mimir
    dockerfilePath: Containerfile
    envVars:
      - fromGroup: spaces-qa
      - key: PORT
        value: 9009
      # Go must honor the cgroup limit, otherwise GC waits too long and the
      # container is OOM-killed before any GC pass. ~78% of the 512 MB plan.
      - key: GOMEMLIMIT
        value: 400MiB
      - key: GOGC
        value: 50
    autoDeploy: true
    branch: main
    pullRequestPreviewsEnabled: true

  # QA Backend API Server (Private Service)
  - type: pserv
    name: my-backend-qa
    runtime: docker
    plan: starter
    rootDir: backend
    dockerfilePath: Containerfile
    envVars:
      - fromGroup: infra-qa
      - fromGroup: spaces-qa
      - fromGroup: app-secrets-qa
      - fromGroup: logto-qa
      - fromGroup: smtp-qa

      # Server Configuration
      - key: GIN_MODE
        value: debug
      - key: LISTEN_ADDRESS
        value: 0.0.0.0:10000
      - key: LOG_LEVEL
        value: debug
      - key: LOG_FORMAT
        value: json

      # Redis Configuration
      - key: REDIS_URL
        fromService:
          type: keyvalue
          name: my-redis-qa
          property: connectionString
      - key: REDIS_DB
        value: 0

      # PostgreSQL Configuration
      - key: DATABASE_URL
        fromDatabase:
          name: my-postgres-qa
          property: connectionString

      # Backend-only alerting webhook URL (env-specific public URL)
      - key: ALERTING_HISTORY_WEBHOOK_URL
        sync: false

    autoDeploy: true   # Auto-deploy on every commit
    branch: main
    pullRequestPreviewsEnabled: true  # PR previews enabled

  # QA Collect Service (Private Service)
  - type: pserv
    name: my-collect-qa
    runtime: docker
    plan: starter
    rootDir: collect
    dockerfilePath: Containerfile
    envVars:
      - fromGroup: infra-qa
      - fromGroup: spaces-qa
      - fromGroup: app-secrets-qa

      # Server Configuration
      - key: GIN_MODE
        value: debug
      - key: LISTEN_ADDRESS
        value: 0.0.0.0:10000
      - key: LOG_LEVEL
        value: debug
      - key: LOG_FORMAT
        value: json

      # Go must honor the cgroup limit, otherwise GC waits too long and the
      # container is OOM-killed before any GC pass. ~78% of the 512 MB plan.
      - key: GOMEMLIMIT
        value: 400MiB
      - key: GOGC
        value: 50

      # Redis Configuration
      - key: REDIS_URL
        fromService:
          type: keyvalue
          name: my-redis-qa
          property: connectionString
      - key: REDIS_DB
        value: 1

      # PostgreSQL Configuration
      - key: DATABASE_URL
        fromDatabase:
          name: my-postgres-qa
          property: connectionString

    autoDeploy: true   # Auto-deploy on every commit
    branch: main
    pullRequestPreviewsEnabled: true  # PR previews enabled

  # QA Frontend (Private Service)
  - type: pserv
    name: my-frontend-qa
    runtime: docker
    plan: starter
    rootDir: frontend
    dockerfilePath: Containerfile
    envVars:
      - key: PORT
        value: 10000
      - key: VITE_PRODUCT_NAME
        value: "My Nethesis"
      - key: VITE_LOGTO_ENDPOINT
        sync: false  # Configure in Render dashboard
      - key: VITE_LOGTO_APP_ID
        sync: false  # Configure in Render dashboard
      - key: VITE_API_BASE_URL
        value: "/backend/api"
      - key: VITE_SIGNIN_REDIRECT_URI
        value: "login-redirect"
      - key: VITE_SIGNOUT_REDIRECT_URI
        value: "login"
    autoDeploy: true   # Auto-deploy on every commit
    branch: main
    pullRequestPreviewsEnabled: true  # PR previews enabled

  # QA Proxy - Public Entry Point (qa.my.nethesis.it)
  - type: web
    name: my-proxy-qa
    runtime: docker
    plan: starter
    rootDir: proxy
    dockerfilePath: Containerfile
    domains:
      - qa.my.nethesis.it
    envVars:
      # Dynamic service names from other services
      - key: BACKEND_SERVICE_NAME
        fromService:
          name: my-backend-qa
          type: pserv
          property: host
      - key: COLLECT_SERVICE_NAME
        fromService:
          name: my-collect-qa
          type: pserv
          property: host
      - key: FRONTEND_SERVICE_NAME
        fromService:
          name: my-frontend-qa
          type: pserv
          property: host
    autoDeploy: true   # Auto-deploy on every commit
    branch: main
    pullRequestPreviewsEnabled: true  # PR previews enabled