render.yaml

# Render Blueprint: Render -> New -> Blueprint -> pick this repository.
# Builds the Dockerfile and asks for each secret (sync: false) in the dashboard; nothing secret is stored here.
services:
  - type: web
    name: proofpath
    runtime: docker
    plan: free
    dockerfilePath: ./Dockerfile
    healthCheckPath: /api/ai/status
    autoDeploy: true
    envVars:
      - key: GROQ_API_KEY
        sync: false
      - key: DATABASE_URL          # e.g. Neon: postgres://user:pass@host/db?sslmode=require (jdbc: URLs work too)
        sync: false
      - key: GITHUB_TOKEN          # optional, raises the GitHub API limit from 60 to 5,000 requests/hour
        sync: false
      - key: GITHUB_WEBHOOK_PUBLIC_BASE_URL   # optional, set to this service's https://….onrender.com URL
        sync: false
      - key: GITHUB_OAUTH_CLIENT_ID   # optional, enables "Sign in with GitHub"
        sync: false
      - key: GITHUB_OAUTH_CLIENT_SECRET
        sync: false
      - key: APP_BASE_URL             # the site people open: https://proofpath-ai.netlify.app (OAuth callback and profile links)
        value: https://proofpath-ai.netlify.app
      - key: FRONTEND_ORIGIN          # Netlify forwards the browser's Origin header, so the backend must allow it
        value: https://proofpath-ai.netlify.app
      - key: RESEND_API_KEY           # optional: enables confirm-your-email and password-reset emails (free at resend.com)
        sync: false
      - key: EMAIL_FROM               # optional sender, e.g. ProofPath <hello@yourdomain.com> once the domain is verified in Resend
        sync: false
      - key: SESSION_SECRET           # long random string that encrypts stored GitHub tokens
        generateValue: true