frontier/render.yaml at main · cafzal/frontier · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
# Render blueprint — deploys the Frontier MCP engine + the web UI together.
# Point Render at your fork (New → Blueprint) or push to a connected repo. Two
# free web services + one shared bearer token (auto-generated below) that gates
# the public engine. The only thing to set by hand after the first deploy is
# ANTHROPIC_API_KEY.

envVarGroups:
  - name: frontier-shared
    envVars:
      # Shared secret that gates the engine. Render generates it once and
      # injects the SAME value into both services so they always match. Copy it
      # from the dashboard to hand MCP-client beta users (Claude Code / Codex /
      # Cursor) their bearer token. Rotate by regenerating here.
      - key: FRONTIER_MCP_TOKEN
        generateValue: true

services:
  - type: web
    name: frontier
    runtime: python
    branch: main
    # sse = uvicorn for the SSE transport; highs = the CPU exact backend so the
    # hosted engine can run the certify/sensitivity flows the README demos.
    # -c constraints.txt pins the full resolved dependency tree (reproducible,
    # supply-chain-pinned builds) — regenerate with the command in its header.
    buildCommand: pip install -c constraints.txt ".[sse,highs]"
    startCommand: MCP_TRANSPORT=sse python -m mcp_server.server
    envVars:
      - key: PYTHON_VERSION
        value: "3.11"
      # Bind on all interfaces so Render can route to the engine.
      - key: MCP_HOST
        value: 0.0.0.0
      # FRONTIER_MCP_TOKEN — the expected bearer token (shared with the web app).
      - fromGroup: frontier-shared

  - type: web
    name: frontier-web
    runtime: node
    branch: main
    rootDir: ui
    buildCommand: npm install && npm run build
    startCommand: npm start
    envVars:
      - key: NODE_VERSION
        value: "22"
      # FRONTIER_MCP_TOKEN — sent to the engine via the MCP connector.
      - fromGroup: frontier-shared
      # Engine URL is derived from the sibling service's host (no hardcoded URL).
      # The web app composes https://$FRONTIER_MCP_HOST/sse.
      - key: FRONTIER_MCP_HOST
        fromService:
          name: frontier
          type: web
          property: host
      # Anthropic key — the one secret to set by hand (CLAUDE_API_KEY also works).
      - key: ANTHROPIC_API_KEY
        sync: false
      - key: AGENT_BACKEND
        value: messages-api
      # Shared password gating the web UI (Basic Auth) — set by hand, hand it to
      # beta users. The engine token above does NOT gate the UI. Leaving this
      # unset on a production build makes the app fail closed (503) rather than
      # serve unauthenticated — set it before the UI will serve.
      - key: UI_ACCESS_PASSWORD
        sync: false