render.yaml

# Render Blueprint — backend web service.
# Native auto-deploy: Render watches the connected fork's `main` branch and rebuilds on push.
#
# Build notes:
#  - backend depends on the SDK via `file:../SDK` and SDK/dist is gitignored, so the SDK is
#    compiled first, and the committed circuit json is copied into the SDK dist.
#  - `--include=dev` is required because Render sets NODE_ENV=production, which would otherwise
#    skip devDependencies (typescript, prisma, etc.) that the build needs.
#  - Prisma 7: the client is no longer emitted into node_modules — `prisma generate` writes it to
#    backend/src/generated/prisma (gitignored), so it MUST run before `tsc`. The CLI connection
#    lives in backend/prisma.config.ts; the runtime uses the @prisma/adapter-pg driver adapter.
#  - Backed by managed Postgres (Neon) via NEON_CONNECTION_STRING. `prisma db push` syncs the
#    schema at build time (non-destructive; it errors instead of dropping data).
#
# NEON_CONNECTION_STRING must be the DIRECT (non-pooled) Neon URL with `?sslmode=require&uselibpqcompat=true`
# and NO `channel_binding` (Prisma's pg adapter doesn't support it). The pooled (-pooler) host can
# hang/fail during `prisma db push`, and this long-running service doesn't need PgBouncer anyway.

services:
  - type: web
    name: shieldpass-backend
    runtime: node
    plan: free
    region: oregon
    branch: main
    # Install ONCE at the workspace root (this is an npm-workspaces monorepo). Per-package
    # `cd SDK && npm install` fails with "Invalid Version" on a fresh clone; a single root
    # install resolves all workspaces from the committed lockfile. Then build each package.
    buildCommand: >-
      npm install --include=dev --no-audit --no-fund &&
      cd SDK && npx tsc && cp ../frontend/public/reusable_kyc.json dist/reusable_kyc.json &&
      cd ../backend && npx prisma generate &&
      npx prisma db push --accept-data-loss && npm run build
    startCommand: cd backend && npm start
    envVars:
      - key: NODE_VERSION
        value: "22"
      # Non-secret defaults
      - key: STELLAR_RPC_URL
        value: https://soroban-testnet.stellar.org
      - key: CHANNELS_URL
        value: https://channels.openzeppelin.com/testnet
      - key: XLM_SAC_ADDRESS
        value: CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC
      - key: USDC_SAC_ADDRESS
        value: CBIELTK6YBZJU5UP2WWQEUCYKLPU6AUNZ2BQ4WWFEIE3USCIHMXQDAMA
      # USDC shielded pool (enables shielded USDC). Non-secret contract id.
      - key: USDC_POOL_CONTRACT_ID
        value: CCRQD3ALTYX5GMSQA5GDN65CF3DPLLHPWOOKHQOKRDO3JNK3FVYDM7ZP
      # Set to the deployed frontend origin(s), comma-separated (e.g. https://shieldpass.vercel.app).
      # Left unset here since it depends on your Vercel deployment; set it in the Render dashboard.
      - key: CORS_ORIGIN
        sync: false
      # Secrets — set these in the Render dashboard (sync: false keeps them out of the repo)
      - key: NEON_CONNECTION_STRING
        sync: false
      - key: STELLAR_CONTRACT_ID
        sync: false
      - key: STELLAR_RELAYER_SECRET
        sync: false
      - key: CHANNELS_API_KEY
        sync: false
      - key: PAYSTACK_SECRET_KEY
        sync: false