render.yaml

# Render Blueprint — deploys treg as one web service (API + dashboard + landing + tutorial +
# /llms.txt + /install.sh) backed by a managed Postgres. See docs/context/ops/deploy.md.
#
# The app is a single FastAPI service: `python -m treg` honors $PORT (Render routes + health-checks
# it). Web assets ship in the wheel via pyproject `force-include src/treg/web`, so `pip install .[server]`
# bundles everything — no separate frontend build. The `[server]` extra pulls the FastAPI/DB/crypto stack
# (the base install is the CLI only — see pyproject).
#
# Secrets (Fernet key, OAuth, Resend, admin/session tokens) are NOT in this file — they are set once
# in the Render dashboard (sync:false below marks them as dashboard-managed). The Postgres URL is
# auto-wired via fromDatabase; config.py rewrites postgres:// → postgresql+asyncpg:// at load.

databases:
  - name: treg-db
    databaseName: treg
    region: oregon
    plan: basic-256mb        # smallest paid tier with persistence; bump later if needed

services:
  - type: web
    name: treg
    runtime: python
    region: oregon
    plan: starter
    branch: main
    buildCommand: pip install ".[server]"
    preDeployCommand: python -m treg upgrade
    startCommand: python -m treg
    healthCheckPath: /meta
    autoDeploy: true
    envVars:
      # Postgres — auto-injected from the managed DB above (config.py adds the asyncpg driver).
      - key: TREG_DATABASE_URL
        fromDatabase:
          name: treg-db
          property: connectionString
      # Public base URL — drives the OAuth callback, /meta, /llms.txt, /install.sh, all {BASE} links.
      # CUTOVER (treg.superdesign.dev → treg.to, 2026-08): setting this back to
      # https://treg.superdesign.dev is the complete, lossless rollback — PUBLIC_HOST_ALIASES
      # keeps both names valid in both directions, and the old domain must stay attached on
      # Render forever (installed clients hold tokens against it).
      - key: TREG_PUBLIC_URL
        value: https://treg.to
      # Never return OTP codes in prod responses (account-takeover vector); email them via Resend.
      - key: TREG_EMAIL_DEV_MODE
        value: "false"
      # One rollout switch for OAuth permissions awaiting provider review. Remove a key after its
      # review succeeds; set an empty value after all listed reviews succeed.
      - key: TREG_OAUTH_REVIEW_PENDING
        value: instagram-login,page-messages
      # treg.to is Resend-verified (DKIM + SPF). Deliverability canary after every change to this
      # value: sign in via email OTP and confirm the code ARRIVES — send failures are swallowed by
      # design, so a broken sender silently kills OTP login. Rollback: the old sender stays
      # verified in Resend forever.
      - key: TREG_EMAIL_FROM
        value: tools-registry <no-reply@treg.to>
      - key: PYTHON_VERSION
        value: "3.12.7"
      # Dashboard-managed secrets (paste values in Render; sync:false keeps them out of git).
      - key: TREG_SECRET_KEY        # Fernet key — MUST equal local .env verbatim (irreplaceable).
        sync: false
      - key: TREG_SESSION_SECRET
        sync: false
      - key: TREG_ADMIN_TOKEN
        sync: false
      - key: TREG_GITHUB_CLIENT_ID
        sync: false
      - key: TREG_GITHUB_CLIENT_SECRET
        sync: false
      - key: TREG_RESEND_API_KEY
        sync: false
      # Support chat (Intercom Messenger, treg's own workspace). Unset = widget off everywhere.
      - key: TREG_INTERCOM_APP_ID   # public workspace id (visible in page source anyway)
        sync: false
      - key: TREG_INTERCOM_SECRET   # identity-verification secret — signs user_hash, never sent to the browser
        sync: false
      # Landing live-wire demo (optional — unset = sandbox calls all synthesize / webhook 404s).
      - key: TREG_DEMO_STRIPE_KEY       # Stripe sandbox restricted key (Charges only) for the live wire
        sync: false
      - key: TREG_DEMO_STRIPE_WEBHOOK_SECRET # whsec_… from the DEMO Stripe sandbox's webhook endpoint
        sync: false
      # Tier-4 platform keys: treg's OWN provider credentials, spent on a caller's behalf and metered
      # against their prepaid balance (docs/PLATFORM-BALANCE-PLAN.md §Phase 3). A key alone does
      # nothing — TREG_PLATFORM_PROVIDERS is the allow-list AND the kill switch: set it to "" to turn
      # tier 4 off instantly, without a redeploy. Fund each provider account upstream first.
      - key: TREG_PLATFORM_KEY_TIKHUB          # TikHub API key (Authorization: Bearer)
        sync: false
      - key: TREG_PLATFORM_KEY_DATAFORSEO      # base64 of "login:password" (HTTP Basic)
        sync: false
      - key: TREG_PLATFORM_KEY_SCRAPECREATORS  # ScrapeCreators API key (x-api-key)
        sync: false
      - key: TREG_PLATFORM_KEY_BRIGHTDATA      # Bright Data account API token (Authorization: Bearer)
        sync: false
      - key: TREG_PLATFORM_KEY_JUSTONEAPI
        sync: false
      - key: TREG_PLATFORM_KEY_SERPAPI
        sync: false
      - key: TREG_PLATFORM_KEY_MOZ                # base64 of "access_id:secret_key" (HTTP Basic)
        sync: false
      - key: TREG_PLATFORM_KEY_SERANKING
        sync: false
      - key: TREG_PLATFORM_KEY_HUNTER
        sync: false
      - key: TREG_PLATFORM_KEY_LEADMAGIC
        sync: false
      - key: TREG_PLATFORM_KEY_LUSHA
        sync: false
      - key: TREG_PLATFORM_KEY_PDL
        sync: false
      - key: TREG_PLATFORM_KEY_DIFFBOT
        sync: false
      - key: TREG_PLATFORM_KEY_AKTA
        sync: false
      - key: TREG_PLATFORM_KEY_APIFY
        sync: false
      - key: TREG_PLATFORM_KEY_SERPSTAT           # Serpstat API token (?token=…)
        sync: false
      - key: TREG_PLATFORM_KEY_SPYFU              # SpyFu SECRET KEY alone (?api_key=…), not id/base64
        sync: false
      - key: TREG_PLATFORM_KEY_CORESIGNAL         # Coresignal API key (`apikey` header)
        sync: false
      - key: TREG_PLATFORM_KEY_THECOMPANIESAPI    # raw token, injected as "Basic {secret}" un-encoded
        sync: false
      - key: TREG_PLATFORM_KEY_COMPANYENRICH      # CompanyEnrich API key (Authorization: Bearer)
        sync: false
      - key: TREG_PLATFORM_KEY_OCEANIO            # Ocean.io API token (X-Api-Token); tier 4 refused until fx.yaml prices it
        sync: false
      - key: TREG_PLATFORM_KEY_PREDICTLEADS       # base64 of "api_key:api_token" (HTTP Basic)
        sync: false
      - key: TREG_PLATFORM_KEY_FINDYMAIL          # Findymail API key (Authorization: Bearer)
        sync: false
      - key: TREG_PLATFORM_KEY_BRANDDEV           # Brand.dev API key (Authorization: Bearer)
        sync: false
      - key: TREG_PLATFORM_KEY_ICYPEAS            # Icypeas API key (raw Authorization header)
        sync: false
      - key: TREG_PLATFORM_KEY_LEADSFORGE         # LeadsForge API key (Authorization: Bearer)
        sync: false
      - key: TREG_PLATFORM_KEY_INFLUENCERSCLUB    # influencers.club dashboard API key, a JWT (Authorization: Bearer)
        sync: false
      - key: TREG_PLATFORM_KEY_CRUSTDATA          # Crustdata API key; x-api-version is injected from provider metadata
        sync: false
      - key: TREG_PLATFORM_KEY_AVIATO             # Aviato API key (Authorization: Bearer)
        sync: false
      - key: TREG_PLATFORM_KEY_EXA                # Exa API key (x-api-key); every response reports costDollars
        sync: false
      - key: TREG_PLATFORM_KEY_FIBER_AI           # Fiber AI key (x-api-key)
        sync: false
      - key: TREG_PLATFORM_KEY_TOMBA              # Tomba API key ta_… (X-Tomba-Key)
        sync: false
      - key: TREG_PLATFORM_KEY_TOMBA_SECRET       # Tomba API secret ts_… (X-Tomba-Secret) — set BOTH
        sync: false
      - key: TREG_PLATFORM_KEY_MINIMAX            # MiniMax Bearer key
        sync: false
      - key: TREG_PLATFORM_KEY_OPENROUTER         # OpenRouter Bearer key
        sync: false
      - key: TREG_PLATFORM_KEY_REPLICATE          # Replicate Bearer token
        sync: false
      - key: TREG_PLATFORM_PROVIDERS           # e.g. "tikhub,dataforseo,scrapecreators"; "" = tier 4 off
        value: ""
      # Overflow (docs/context/ops/capacity.md): treg-owned aggregator accounts serving the SAME vendor
      # endpoint when our own account is out. MODE is the switch: off (default) | shadow | on.
      - key: TREG_OVERFLOW_MODE
        value: "off"
      - key: TREG_OVERFLOW_DAILY_BUDGET_USD
        value: "20"
      - key: TREG_OVERFLOW_KEY_ORTHOGONAL
        sync: false
      - key: TREG_OVERFLOW_KEY_MONID
        sync: false
  # Worker profile: the hourly capacity sweep (docs/context/ops/capacity.md). Same code, same env
  # as the web service (fromService — add a platform key in the web service only), no HTTP.
  - type: cron
    name: treg-capacity-sweep
    runtime: python
    region: oregon
    plan: starter
    branch: main
    schedule: "17 * * * *"
    buildCommand: pip install ".[server]"
    startCommand: treg-worker capacity sweep
    envVars:
      - key: TREG_DATABASE_URL
        fromDatabase:
          name: treg-db
          property: connectionString
      - key: PYTHON_VERSION
        value: "3.12.7"
      - key: TREG_SECRET_KEY
        fromService:
          type: web
          name: treg
          envVarName: TREG_SECRET_KEY
      - key: TREG_OVERFLOW_KEY_ORTHOGONAL
        fromService:
          type: web
          name: treg
          envVarName: TREG_OVERFLOW_KEY_ORTHOGONAL
      - key: TREG_OVERFLOW_KEY_MONID
        fromService:
          type: web
          name: treg
          envVarName: TREG_OVERFLOW_KEY_MONID
      - key: TREG_PLATFORM_KEY_TIKHUB
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_TIKHUB
      - key: TREG_PLATFORM_KEY_DATAFORSEO
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_DATAFORSEO
      - key: TREG_PLATFORM_KEY_SCRAPECREATORS
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_SCRAPECREATORS
      - key: TREG_PLATFORM_KEY_BRIGHTDATA
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_BRIGHTDATA
      - key: TREG_PLATFORM_KEY_JUSTONEAPI
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_JUSTONEAPI
      - key: TREG_PLATFORM_KEY_SERPAPI
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_SERPAPI
      - key: TREG_PLATFORM_KEY_MOZ
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_MOZ
      - key: TREG_PLATFORM_KEY_SERANKING
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_SERANKING
      - key: TREG_PLATFORM_KEY_HUNTER
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_HUNTER
      - key: TREG_PLATFORM_KEY_LEADMAGIC
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_LEADMAGIC
      - key: TREG_PLATFORM_KEY_LUSHA
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_LUSHA
      - key: TREG_PLATFORM_KEY_PDL
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_PDL
      - key: TREG_PLATFORM_KEY_DIFFBOT
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_DIFFBOT
      - key: TREG_PLATFORM_KEY_AKTA
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_AKTA
      - key: TREG_PLATFORM_KEY_APIFY
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_APIFY
      - key: TREG_PLATFORM_KEY_SERPSTAT
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_SERPSTAT
      - key: TREG_PLATFORM_KEY_SPYFU
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_SPYFU
      - key: TREG_PLATFORM_KEY_CORESIGNAL
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_CORESIGNAL
      - key: TREG_PLATFORM_KEY_THECOMPANIESAPI
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_THECOMPANIESAPI
      - key: TREG_PLATFORM_KEY_COMPANYENRICH
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_COMPANYENRICH
      - key: TREG_PLATFORM_KEY_OCEANIO
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_OCEANIO
      - key: TREG_PLATFORM_KEY_PREDICTLEADS
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_PREDICTLEADS
      - key: TREG_PLATFORM_KEY_FINDYMAIL
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_FINDYMAIL
      - key: TREG_PLATFORM_KEY_BRANDDEV
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_BRANDDEV
      - key: TREG_PLATFORM_KEY_ICYPEAS
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_ICYPEAS
      - key: TREG_PLATFORM_KEY_LEADSFORGE
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_LEADSFORGE
      - key: TREG_PLATFORM_KEY_INFLUENCERSCLUB
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_INFLUENCERSCLUB
      - key: TREG_PLATFORM_KEY_CRUSTDATA
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_CRUSTDATA
      - key: TREG_PLATFORM_KEY_AVIATO
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_AVIATO
      - key: TREG_PLATFORM_KEY_EXA
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_EXA
      - key: TREG_PLATFORM_KEY_FIBER_AI
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_FIBER_AI
      - key: TREG_PLATFORM_KEY_TOMBA
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_TOMBA
      - key: TREG_PLATFORM_KEY_TOMBA_SECRET
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_TOMBA_SECRET

  # Completes holds opened by asynchronous metered submissions. It never creates a hold.
  - type: cron
    name: treg-asynctasks-settle
    runtime: python
    region: oregon
    plan: starter
    branch: main
    schedule: "*/2 * * * *"
    buildCommand: pip install ".[server]"
    startCommand: treg-worker asynctasks settle
    envVars:
      - key: TREG_DATABASE_URL
        fromDatabase:
          name: treg-db
          property: connectionString
      - key: PYTHON_VERSION
        value: "3.12.7"
      - key: TREG_SECRET_KEY
        fromService:
          type: web
          name: treg
          envVarName: TREG_SECRET_KEY
      - key: TREG_PLATFORM_PROVIDERS
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_PROVIDERS
      - key: TREG_PLATFORM_KEY_MINIMAX
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_MINIMAX
      - key: TREG_PLATFORM_KEY_OPENROUTER
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_OPENROUTER
      - key: TREG_PLATFORM_KEY_REPLICATE
        fromService:
          type: web
          name: treg
          envVarName: TREG_PLATFORM_KEY_REPLICATE