render.yaml

# render.yaml — the API on Render, as a Blueprint.
#
# One file describes the service, so a deploy is "connect the repo" rather
# than a sequence of dashboard clicks nobody remembers a month later.
#
# What is NOT here:
#   - PostgreSQL: Render's free database expires after 90 days. The API
#     expects DATABASE_URL from Neon or Supabase instead (see docs/deployment.md).
#   - Secrets: JWT_SECRET, STRIPE_*, RESEND_API_KEY are set in the dashboard,
#     never in a file that is committed. `sync: false` below marks each one
#     as "you must supply this".
#   - The frontend: it is static files and lives on Vercel.

services:
  - type: web
    name: fakturly-api
    runtime: docker
    rootDir: backend
    dockerfilePath: ./Dockerfile
    plan: free
    region: frankfurt
    # Liveness only: "is the process up". NOT /health/ready — Render calls
    # this every few seconds, and a check that queries the database kept
    # Neon's compute awake around the clock until the free monthly quota ran
    # out and Neon paused the project (2026-09-23). A database outage is not
    # something a restart can fix anyway; restarting only added a crash loop.
    healthCheckPath: /health
    envVars:
      - key: NODE_ENV
        value: production
      - key: PORT
        value: "3000"
      - key: DEMO_MODE
        value: "true"
      # The frontend is on Vercel, the API here: two sites. Without this the
      # refresh cookie (SameSite=Strict) is never sent and reloads log out.
      - key: CROSS_SITE_COOKIES
        value: "true"
      # Render sits behind Cloudflare, which overwrites this header with the
      # real client address. X-Forwarded-For here starts with whatever the
      # client sent, so it cannot be used for rate limiting. See lib/clientIp.ts.
      - key: CLIENT_IP_HEADER
        value: cf-connecting-ip
      - key: FRONTEND_URL
        sync: false
      - key: DATABASE_URL
        sync: false
      # Supabase's private root CA, committed in backend/certs. The URL
      # itself must carry no ssl* parameters — see src/lib/databaseTls.ts.
      - key: DATABASE_CA_CERT
        value: certs/supabase-prod-ca-2021.crt
      - key: REDIS_URL
        fromService:
          type: redis
          name: fakturly-redis
          property: connectionString
      - key: JWT_SECRET
        generateValue: true
      - key: STRIPE_SECRET_KEY
        sync: false
      - key: STRIPE_WEBHOOK_SECRET
        sync: false
      - key: RESEND_API_KEY
        sync: false

  # Render's managed Redis. Free tier, no persistence — fine for rate-limit
  # counters, the token denylist and the job queue, all of which are
  # rebuilt or expire on their own.
  - type: redis
    name: fakturly-redis
    plan: free
    region: frankfurt
    ipAllowList: []