render.yaml

# Render Blueprint — deploys apps/api (Hono API + ledger watcher + cash-out
# poller) as ONE always-on Docker web service. Starter plan is mandatory: the
# free tier spins down after 15 min idle, which stops the watcher loop.
# The web app deploys separately to Vercel; the database is Turso (external).
#
# Secrets (sync: false) to set in the Render dashboard on first deploy:
#   DATABASE_URL                    libsql://<db-name>-<org>.turso.io
#   DATABASE_AUTH_TOKEN             from `turso db tokens create <db>` or the Turso dashboard
#   DEFAULT_SELLER_SECRET           S... secret for DEFAULT_SELLER_WALLET (SEP-10 signing)
#   KYC_ENCRYPTION_KEY              64 hex chars — REQUIRED whenever OFFRAMP=testanchor
#   WEBHOOK_SECRET_ENCRYPTION_KEY   64 hex chars — REQUIRED in production
#   JWT_SECRET                      session signing secret
#   SERVER_SIGNING_SECRET           S... the platform's own stable SEP-10 identity
#
# SERVER_SIGNING_SECRET is also the on-chain attester (issue 9.2), so its
# account MUST be funded on testnet to pay contract invocation fees. An
# unfunded attester fails attestation only — settlement is proven by the
# classic ledger and never blocks on it.
#
# Generate each 64-hex value with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

services:
  - type: web
    name: quay-api
    runtime: docker
    plan: starter
    dockerfilePath: ./apps/api/Dockerfile
    dockerContext: .
    # /ready checks the database is actually reachable (readiness), not just
    # that the process is up (/health, liveness) - matches the Dockerfile's
    # own HEALTHCHECK target. See apps/api/src/index.ts.
    healthCheckPath: /ready
    envVars:
      - key: API_PORT
        value: "8787"
      - key: STELLAR_NETWORK
        value: testnet
      - key: USDC_ISSUER_TESTNET
        value: GBBD47IF6LWK7P7MDEVSCWR7DPUWV3NY3DTQEVFL4NAT4AQH3ZLLFLA5
      - key: WATCH_POLL_MS
        value: "6000"
      - key: OFFRAMP
        value: testanchor
      - key: CORS_ORIGINS
        value: https://quay-web.vercel.app
      - key: DEFAULT_SELLER_WALLET
        value: GBMDH3QWSD74ILWD2ZVFOAOCMVRNPNGAHN557WA4KABLI5IFN2XYLMGY
      # HOME_DOMAIN is intentionally NOT declared here. env.ts derives it from
      # RENDER_EXTERNAL_HOSTNAME, which Render injects into every service, so
      # there is nothing to keep in sync and nothing to forget. Set it in the
      # dashboard only if a custom domain or proxy is put in front, where the
      # host wallets fetch stellar.toml from stops matching the platform's.
      - key: DATABASE_URL
        sync: false
      - key: DATABASE_AUTH_TOKEN
        sync: false
      - key: DEFAULT_SELLER_SECRET
        sync: false
      # OFFRAMP=testanchor above makes this REQUIRED: env.ts resolves it with
      # req() at module load, so the process cannot boot without it. It
      # encrypts seller SEP-12 KYC field values at rest.
      - key: KYC_ENCRYPTION_KEY
        sync: false
      # Encrypts webhook signing secrets at rest. Without it the process falls
      # back to a hardcoded, public dev key — anyone with the repo could then
      # decrypt stored secrets and forge delivery signatures. NODE_ENV is
      # `production` in the image, so a missing value is a hard boot failure.
      - key: WEBHOOK_SECRET_ENCRYPTION_KEY
        sync: false
      # Signs session JWTs. Auto-generated per boot when unset, which logs
      # every seller out on each restart and deploy.
      - key: JWT_SECRET
        sync: false
      # The platform's own SEP-10 signing identity, published as SIGNING_KEY in
      # stellar.toml. Auto-generated per boot when unset, so the advertised key
      # changes on every restart and any wallet that cached it breaks.
      - key: SERVER_SIGNING_SECRET
        sync: false
      # On-chain settlement attestation (issue 9.2). WITHOUT THIS the API boots
      # green, takes payments, and attests nothing — `createAttestation` returns
      # undefined and every receipt renders without the block. That failure is
      # invisible from the outside, which is exactly why it is declared here
      # rather than left to the dashboard: the contract being deployed and the
      # product actually calling it are two different claims.
      # Contract id is public (see contracts/README.md), so it is not a secret.
      - key: ATTESTATION_CONTRACT_ID
        value: CD6AFLZTNUKC6CWXWLAVOEH3FY4ZN47SVX6DPYQBZBTPBBSN6LEFIFZ3
      - key: SOROBAN_RPC_URL
        value: https://soroban-testnet.stellar.org