render.yaml

# Render Blueprint — deploys apps/api (Hono API + ledger watcher + cash-out
# poller) as ONE always-on Docker web service. Starter plan is mandatory: the
# free tier spins down after 15 min idle, which stops the watcher loop.
# The web app deploys separately to Vercel; the database is Turso (external).
#
# Secrets (sync: false) to set in the Render dashboard on first deploy:
#   DATABASE_URL                    libsql://<db-name>-<org>.turso.io
#   DATABASE_AUTH_TOKEN             from `turso db tokens create <db>` or the Turso dashboard
#   DEFAULT_SELLER_SECRET           S... secret for DEFAULT_SELLER_WALLET (SEP-10 signing)
#   KYC_ENCRYPTION_KEY              64 hex chars — REQUIRED whenever OFFRAMP=testanchor
#   WEBHOOK_SECRET_ENCRYPTION_KEY   64 hex chars — REQUIRED in production
#   JWT_SECRET                      session signing secret
#   SERVER_SIGNING_SECRET           S... the platform's own stable SEP-10 identity
#
# Generate each 64-hex value with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

services:
  - type: web
    name: quay-api
    runtime: docker
    # Free is right for staging: this service settles play money, and a
    # spun-down testnet instance costs a slow first request, nothing more.
    plan: free
    # Staging deploys from `dev`. Mainnet (render.mainnet.yaml) deploys from
    # `main`, so `main` is only ever what is already live on the public network
    # and every mainnet change has been exercised on testnet first. See
    # docs/RUNBOOK.md "Promotion: dev to main".
    branch: dev
    dockerfilePath: ./apps/api/Dockerfile
    dockerContext: .
    # /ready checks the database is actually reachable (readiness), not just
    # that the process is up (/health, liveness) - matches the Dockerfile's
    # own HEALTHCHECK target. See apps/api/src/index.ts.
    healthCheckPath: /ready
    envVars:
      - key: API_PORT
        value: "8787"
      - key: STELLAR_NETWORK
        value: testnet
      - key: USDC_ISSUER_TESTNET
        value: GBBD47IF6LWK7P7MDEVSCWR7DPUWV3NY3DTQEVFL4NAT4AQH3ZLLFLA5
      - key: WATCH_POLL_MS
        value: "6000"
      - key: OFFRAMP
        value: testanchor
      - key: CORS_ORIGINS
        value: https://quay-web.vercel.app
      - key: DEFAULT_SELLER_WALLET
        value: GBMDH3QWSD74ILWD2ZVFOAOCMVRNPNGAHN557WA4KABLI5IFN2XYLMGY
      # HOME_DOMAIN is intentionally NOT declared here. env.ts derives it from
      # RENDER_EXTERNAL_HOSTNAME, which Render injects into every service, so
      # there is nothing to keep in sync and nothing to forget. Set it in the
      # dashboard only if a custom domain or proxy is put in front, where the
      # host wallets fetch stellar.toml from stops matching the platform's.
      - key: DATABASE_URL
        sync: false
      - key: DATABASE_AUTH_TOKEN
        sync: false
      - key: DEFAULT_SELLER_SECRET
        sync: false
      # OFFRAMP=testanchor above makes this REQUIRED: env.ts resolves it with
      # req() at module load, so the process cannot boot without it. It
      # encrypts seller SEP-12 KYC field values at rest.
      - key: KYC_ENCRYPTION_KEY
        sync: false
      # Encrypts webhook signing secrets at rest. Without it the process falls
      # back to a hardcoded, public dev key — anyone with the repo could then
      # decrypt stored secrets and forge delivery signatures. NODE_ENV is
      # `production` in the image, so a missing value is a hard boot failure.
      - key: WEBHOOK_SECRET_ENCRYPTION_KEY
        sync: false
      # Signs session JWTs. Auto-generated per boot when unset, which logs
      # every seller out on each restart and deploy.
      - key: JWT_SECRET
        sync: false
      # The platform's own SEP-10 signing identity, published as SIGNING_KEY in
      # stellar.toml. Auto-generated per boot when unset, so the advertised key
      # changes on every restart and any wallet that cached it breaks.
      - key: SERVER_SIGNING_SECRET
        sync: false