render.yaml

# Render Blueprint — deploys the MVP: API (web) + worker, managed Postgres
# (pgvector) + Key Value (Redis). Architecture brief §8: single Postgres + 2
# workers. Secrets (OPENAI/DEEPSEEK keys, PUBLIC_BASE_URL) are set in the Render
# dashboard, not here (sync: false).

databases:
  - name: zynd-postgres
    plan: basic-256mb            # bump for production; free tier expires in 90 days
    postgresMajorVersion: "16"

services:
  - type: keyvalue
    name: zynd-redis
    plan: free
    ipAllowList: []             # only reachable from Render services
    maxmemoryPolicy: noeviction # arq jobs must not be evicted

  - type: web
    name: zynd-api
    runtime: docker
    dockerfilePath: ./Dockerfile
    plan: starter
    # Apply the schema (idempotent) before each deploy goes live.
    preDeployCommand: python -m app.schema_apply
    dockerCommand: uvicorn app.main:app --host 0.0.0.0 --port $PORT
    envVars: &shared_env
      - key: DATABASE_URL
        fromDatabase:
          name: zynd-postgres
          property: connectionString
      - key: REDIS_URL
        fromService:
          type: keyvalue
          name: zynd-redis
          property: connectionString
      - key: MOCK_LLM
        value: "false"
      - key: OPENAI_API_KEY
        sync: false              # set in dashboard
      - key: DEEPSEEK_API_KEY
        sync: false              # optional; extraction falls back to OpenAI
      - key: JWT_SECRET
        generateValue: true
      - key: OAUTH_CLIENT_SECRET
        generateValue: true
      - key: PUBLIC_BASE_URL
        sync: false              # set to the API URL after first deploy

  - type: worker
    name: zynd-worker
    runtime: docker
    dockerfilePath: ./Dockerfile
    plan: starter
    dockerCommand: arq app.worker.WorkerSettings
    envVars: *shared_env         # same DB/Redis/keys as the API