EmpireOS/render.yaml at main · miamicreme/EmpireOS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
# Render Blueprint for Empire OS (Next.js 14 App Router).
# Docs: https://render.com/docs/blueprint-spec
#
# Deploy: push this file, then in Render → New → Blueprint, point at this repo.
# Render reads this file and provisions the service. Fill in the secret env vars
# (sync: false) in the Render dashboard before the first build — the
# NEXT_PUBLIC_* values are baked into the client bundle at build time, so they
# must be set prior to deploying.
#
# Supabase is managed separately (not provisioned here): create the project,
# apply supabase/migrations in order, then paste its URL/keys below.

services:
  - type: web
    name: empire-os
    runtime: node
    plan: starter # free tier also works (spins down when idle); bump for always-on
    region: oregon
    branch: main
    # next start honors $PORT (Render injects it); no -p flag needed.
    buildCommand: npm ci && npm run build
    startCommand: npm run start
    healthCheckPath: /api/health
    autoDeploy: false # flip to true to deploy on every push to `branch`
    envVars:
      - key: NODE_VERSION
        value: "20"
      - key: NEXT_TELEMETRY_DISABLED
        value: "1"

      # --- Supabase (required) -------------------------------------------------
      # NEXT_PUBLIC_* are public and baked into the client bundle at build time.
      - key: NEXT_PUBLIC_SUPABASE_URL
        sync: false
      - key: NEXT_PUBLIC_SUPABASE_ANON_KEY
        sync: false
      # Server-only secret. Never exposed to the client.
      - key: SUPABASE_SERVICE_ROLE_KEY
        sync: false

      # --- Passkey / WebAuthn (required) --------------------------------------
      # Canonical production domain. Keep these values in sync. Passkeys are
      # cryptographically bound to this relying-party domain.
      - key: WEBAUTHN_ORIGIN
        value: https://empire.kohronburton.com
      - key: WEBAUTHN_RP_ID
        value: empire.kohronburton.com
      - key: WEBAUTHN_RP_NAME
        value: Empire OS
      - key: OWNER_EMAIL
        sync: false
      # Break-glass recovery code. Set this to let a locked-out owner (lost or
      # replaced device) clear the old passkey from the login screen and
      # re-register. Leave unset to disable recovery. Generate: openssl rand -hex 16
      - key: OWNER_RECOVERY_CODE
        sync: false

      # --- AI provider keys (optional) ----------------------------------------
      # Absent → the AI layer runs in deterministic stub mode. Users can also add
      # their own keys at runtime via Settings → AI Providers.
      - key: ANTHROPIC_API_KEY
        sync: false
      - key: OPENAI_API_KEY
        sync: false
      - key: GOOGLE_GENERATIVE_AI_API_KEY
        sync: false
      # Free-tier fallback providers (OpenAI-API-compatible). Optional; the AI
      # layer fails over to whichever are configured when a paid quota errors.
      - key: GROQ_API_KEY
        sync: false
      - key: CEREBRAS_API_KEY
        sync: false
      - key: OPENROUTER_API_KEY
        sync: false
      - key: MISTRAL_API_KEY
        sync: false

      # --- AI model + encryption config ---------------------------------------
      - key: AI_DEFAULT_PROVIDER
        value: anthropic
      - key: AI_DEFAULT_MODEL
        value: claude-sonnet-4-6
      - key: AI_FAST_MODEL
        value: claude-haiku-4-5-20251001
      - key: AI_JUDGE_MODEL
        value: claude-sonnet-4-6
      # Encrypts user-entered provider API keys at rest (AES-256-GCM). Optional:
      # if unset, a key is derived from SUPABASE_SERVICE_ROLE_KEY. To set one,
      # generate with: openssl rand -base64 32
      - key: AI_PROVIDER_ENCRYPTION_KEY
        sync: false