render.yaml

# Render Blueprint — YGC / MedReport free-tier deploy (Path A)
#
# Deploys TWO free web services:
#   1. ygc-backend  — Node/Express API  (keep this one awake 24/7: 744h < 750h budget)
#   2. ygc-rag      — FastAPI RAG service, Tesseract-only OCR image (Dockerfile.render)
#
# IMPORTANT (verified against this repo's code, 2026-07-31):
#   - Env var names below match what the code actually reads (MONGO_DB_URI,
#     RAG_INTERNAL_API_KEY ...). Do NOT rename them to MONGO_URI / INTERNAL_API_KEY.
#   - The x-internal-api-key middleware only protects the RAG API when
#     RAG_INTERNAL_API_KEY is set — set it on BOTH services to the same long value.
#   - A month has ~744h; two always-on free services = ~1,488h > 750h workspace
#     budget -> Render suspends everything. Keep ONLY ygc-backend pinged awake;
#     let ygc-rag sleep and accept a 30-60s cold start on first use (or migrate
#     the RAG service to Oracle — see deploy/oracle/README.md).
#
# After first deploy, two manual steps in the Render dashboard:
#   A. ygc-backend  -> set RAG_API_URL   = https://<ygc-rag>.onrender.com  (redeploy)
#   B. ygc-backend  -> set CORS_ORIGINS and FRONTEND_URL = your Vercel domain
#      ygc-rag      -> set RAG_CORS_ORIGINS = your Vercel domain (browser-direct calls, if any)
#   C. Both         -> set MONGO_DB_URI (Atlas M0 SRV) + shared RAG_INTERNAL_API_KEY + GROQ_API_KEY

services:
  - type: web
    name: ygc-rag
    runtime: docker
    plan: free
    dockerContext: ./rag_model
    dockerfilePath: ./Dockerfile.render
    healthCheckPath: /health
    envVars:
      - key: ENABLE_OCR
        value: "true"            # Tesseract-only image; scanned PDFs OCR'd (flagged uncorroborated)
      - key: ENABLE_VECTOR_MEMORY
        value: "false"
      - key: VISION_FALLBACK_ENABLED
        value: "false"
      - key: HANDWRITING_ENABLED
        value: "false"
      - key: STORE_ORIGINAL_FILES
        value: "true"            # needed for click-to-verify citation rendering
      - key: STORE_RAW_TEXT
        value: "true"
      - key: RAW_TEXT_MAX_CHARS
        value: "50000"
      - key: MAX_UPLOAD_MB
        value: "15"
      - key: MONGO_DB_NAME
        value: medreport
      - key: MONGO_DB_URI
        sync: false              # Atlas M0 SRV connection string
      - key: GROQ_API_KEY
        sync: false              # free tier; empty = deterministic fallback responses
      - key: RAG_INTERNAL_API_KEY
        sync: false              # MUST equal the value set on ygc-backend
      - key: RAG_CORS_ORIGINS
        sync: false              # https://<your-app>.vercel.app
      - key: ENABLE_SELF_CONSISTENCY
        value: "true"            # flip to "false" on demo day if Groq free-tier 429s appear
      - key: ENABLE_TEMPLATE_EXPLANATIONS
        value: "true"
      - key: AUTO_GENERATE_HEALTH_PROFILE
        value: "true"
      - key: SYNC_WORKER_ENABLED
        value: "true"
      - key: SYNC_WORKER_INTERVAL_SECONDS
        value: "60"
      - key: SYNC_WORKER_INITIAL_DELAY
        value: "15"
      - key: ENABLE_RXNAV
        value: "true"
      - key: ENABLE_OPENFDA
        value: "true"

  - type: web
    name: ygc-backend
    runtime: node
    plan: free
    rootDir: Backend
    buildCommand: npm ci --omit=dev
    startCommand: node index.js
    healthCheckPath: /health
    envVars:
      - key: NODE_ENV
        value: production
      - key: TRUST_PROXY
        value: "true"           # MUST be exactly "true" (Backend/index.js:40) — enables rate-limit behind Render's proxy
      - key: MONGO_DB_NAME
        value: medreport
      - key: MONGO_DB_URI
        sync: false             # same Atlas M0 SRV string as ygc-rag
      - key: RAG_API_URL
        sync: false             # https://<ygc-rag>.onrender.com  (manual step A — needs the scheme)
      - key: RAG_INTERNAL_API_KEY
        sync: false             # same value as on ygc-rag — middleware enforces it
      - key: ACCESS_TOKEN_SECRET
        generateValue: true     # the code reads ACCESS_TOKEN_SECRET (not JWT_SECRET)
      - key: CORS_ORIGINS
        sync: false             # https://<your-app>.vercel.app — exact origin, never "*"
      - key: FRONTEND_URL
        sync: false             # https://<your-app>.vercel.app
      - key: DEMO_MODE_ENABLED
        value: "true"           # public /api/demo/* — synthetic data only
      - key: REQUIRE_EMAIL_VERIFICATION
        value: "true"           # needs the Gmail OAuth vars below; else links only appear in backend logs
      - key: EMAIL_USER
        sync: false             # Gmail address that sends verification/reset mail (Gmail API, OAuth2)
      - key: GOOGLE_CLIENT_ID
        sync: false
      - key: GOOGLE_CLIENT_SECRET
        sync: false
      - key: GOOGLE_REFRESH_TOKEN
        sync: false             # see docs/PRODUCTION_ENV_SETUP.md §6 for how to mint these
      - key: MAX_UPLOAD_MB
        value: "15"