FastAPI_IDBI_Project/render.yaml at main · anandravichandran/FastAPI_IDBI_Project · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
# Render deployment blueprint for the Financial Suite (modular monolith).
# Docs: https://render.com/docs/blueprint-spec
#
# ╔══════════════════════════════════════════════════════════════════════════╗
# ║  REQUIRED: Set these sync:false secrets in the Render dashboard or an  ║
# ║  env group BEFORE the first deploy. Without them the app will crash    ║
# ║  at startup with EnvironmentValidationError:                           ║
# ║                                                                        ║
# ║    API_KEYS          – comma-separated allowlist (e.g. key1,key2)      ║
# ║    JWT_SECRET        – HS256 signing secret (min 256-bit entropy)      ║
# ║    TRUSTED_HOSTS     – e.g. financial-suite.onrender.com               ║
# ║    CORS_ALLOW_ORIGINS – e.g. https://myapp.vercel.app                  ║
# ║    DEEPSEEK_API_KEY  – DeepSeek API key (if LLM_PROVIDER=deepseek)     ║
# ║    NVIDIA_API_KEY    – NVIDIA NIM key (if LLM_PROVIDER=nvidia)         ║
# ║    OPENBB_PAT        – OpenBB Personal Access Token                    ║
# ╚══════════════════════════════════════════════════════════════════════════╝
services:
  - type: web
    name: financial-suite
    runtime: docker
    dockerfilePath: ./Dockerfile
    plan: standard
    healthCheckPath: /livez
    autoDeploy: false
    numInstances: 2
    envVars:
      - key: ENVIRONMENT
        value: production
      - key: LOG_JSON
        value: "true"
      - key: LOG_LEVEL
        value: INFO
      # ---- Authentication (fail-closed in production) ----
      - key: AUTH_ENABLED
        value: "true"
      - key: API_KEYS
        sync: false
      - key: JWT_SECRET
        sync: false
      - key: JWT_ALGORITHMS
        value: HS256
      - key: JWT_ISSUER
        sync: false
      - key: JWT_AUDIENCE
        sync: false
      # ---- Network policy ----
      - key: TRUSTED_HOSTS
        sync: false
      - key: CORS_ALLOW_ORIGINS
        sync: false
      - key: CORS_ALLOW_CREDENTIALS
        value: "false"
      # ---- Edge rate limiting ----
      - key: RATE_LIMIT_ENABLED
        value: "true"
      - key: RATE_LIMIT_PER_MINUTE
        value: "120"
      - key: RATE_LIMIT_BURST
        value: "40"
      # ---- Security headers ----
      - key: SECURITY_HEADERS_ENABLED
        value: "true"
      - key: HSTS_ENABLED
        value: "true"
      # ---- SSRF allowlist for outbound calls ----
      - key: OUTBOUND_ALLOWED_HOSTS
        value: api.deepseek.com,integrate.api.nvidia.com
      # ---- LLM / market provider secrets ----
      - key: LLM_PROVIDER
        value: nvidia
      - key: NVIDIA_API_KEY
        sync: false
      - key: NVIDIA_BASE_URL
        value: https://integrate.api.nvidia.com/v1
      - key: NVIDIA_MODEL
        value: deepseek-ai/deepseek-v4-pro
      - key: DEEPSEEK_API_KEY
        sync: false
      - key: OPENBB_PAT
        sync: false