# Render Blueprint — ProjectAchilles
# Deploy: https://render.com/deploy?repo=<your-repo-url>
# Docs:   https://render.com/docs/blueprint-spec

services:
  # ─── Backend (Express + TypeScript) ──────────────────────────────────────────
  - type: web
    name: achilles-backend
    # Deploy only after the commit's GitHub checks pass (CI tests, security
    # scans), matching Fly's test-first deploy. Without this, Render deploys
    # the moment a commit lands on main, even if CI later fails.
    autoDeployTrigger: checksPass
    runtime: docker
    dockerfilePath: ./Dockerfile
    dockerContext: .
    rootDir: backend
    # Bumped starter -> standard (Nov 2026): the starter 512 MB / 0.5 CPU instance
    # was starved by concurrent Elasticsearch analytics + background syncs (and
    # on-demand Go builds), slowing the /api/health check to ~1.7 s until Render
    # recycled the instance mid-build ("Build was interrupted...", "Failed to
    # load tests"). standard = 2 GB / 1 CPU. Bump to `pro` if builds stay heavy.
    plan: standard  # 2 GB / 1 CPU; starter tripped health-check restarts under load
    healthCheckPath: /api/health
    buildFilter:
      paths:
        - src/**
        - package.json
        - package-lock.json
        - tsconfig.json
        - Dockerfile
    disk:
      name: achilles-data
      mountPath: /root/.projectachilles
      sizeGB: 5  # Bumped from 1 GB May-2026: agent build go-cache hit 681 MB
                 # alone, leaving no headroom for the Go toolchain auto-download.
    envVars:
      - key: NODE_ENV
        value: production
      - key: PORT
        value: "3000"
      - key: BUILD_NICE
        value: "15"  # run go/build_all.sh subprocesses at lower CPU priority so a
                     # build can't starve the API/health check and trip a restart
      - key: CLERK_PUBLISHABLE_KEY
        sync: false  # set manually in Render dashboard
      - key: CLERK_SECRET_KEY
        sync: false
      - key: SESSION_SECRET
        generateValue: true  # Render auto-generates a random 256-bit secret
      - key: ENCRYPTION_SECRET
        generateValue: true
      - key: CORS_ORIGIN
        sync: false  # https://<your-frontend>.onrender.com (full URL with scheme)
      - key: AGENT_SERVER_URL
        sync: false  # https://<your-backend>.onrender.com (full URL with scheme)
      - key: TESTS_REPO_URL
        sync: false
      - key: TESTS_REPO_BRANCH
        value: main
      - key: AGENT_REPO_URL
        sync: false  # https://github.com/projectachilles/ProjectAchilles.git (for agent builds)
      - key: AGENT_REPO_BRANCH
        value: main
      - key: GITHUB_TOKEN
        sync: false
      - key: ELASTICSEARCH_CLOUD_ID
        sync: false
      - key: ELASTICSEARCH_API_KEY
        sync: false

  # ─── Frontend (Vite + nginx) ─────────────────────────────────────────────────
  - type: web
    name: achilles-frontend
    # Deploy only after the commit's GitHub checks pass (CI tests, security
    # scans), matching Fly's test-first deploy. Without this, Render deploys
    # the moment a commit lands on main, even if CI later fails.
    autoDeployTrigger: checksPass
    runtime: docker
    dockerfilePath: ./Dockerfile
    dockerContext: .
    rootDir: frontend
    plan: starter
    buildFilter:
      paths:
        - src/**
        - public/**
        - package.json
        - package-lock.json
        - tsconfig.json
        - Dockerfile
        - nginx.conf
        - docker-entrypoint.sh
    envVars:
      - key: CLERK_PUBLISHABLE_KEY
        sync: false  # same publishable key as backend — set manually
      - key: VITE_API_URL
        sync: false  # https://<your-backend>.onrender.com (direct CORS, no nginx proxy)