render.yaml

# render.yaml: Render Blueprint for ChessTB Explorer
#
# Deploys this repository as a single Docker web service on Render,
# straight from GitHub. See README.md's "Deploying to Render" section
# for the full walkthrough (including the manual, non-Blueprint path);
# deployment steps:
#
#   1. Push this repository to GitHub.
#   2. In the Render Dashboard: New -> Blueprint -> connect the repo.
#      Render finds this file automatically.
#   3. TABLEBASE_PATH is requested before the first deploy. ADMIN_TOKEN
#      and FLASK_SECRET_KEY are generated automatically.
#
# Every push to the connected branch redeploys automatically afterwards.
#
# See https://render.com/docs/blueprint-spec for the full field
# reference for additional configuration options.

services:
  - type: web
    name: chesstb-explorer
    runtime: docker
    # dockerfilePath/dockerContext default to ./Dockerfile and the repo
    # root; no additional path configuration is required.

    # "free" works for casual/demo use, at the cost of the service
    # spinning down after periods of inactivity (slow first request after
    # a wake-up) and a smaller, shared CPU/RAM allocation, which mainly
    # shows up as slower probes rather than incorrect ones. Since probing
    # (tablebase block decompression) is CPU-bound, a dedicated-vCPU plan
    # such as "starter" is worth the upgrade for a deployment expecting
    # real traffic -- see README.md "Deploying to Render" for more on
    # sizing.
    plan: free
    region: oregon   # Region for the Render service.

    # Matches the GET /health route in app.py: 200 once TABLEBASE_PATH has
    # opened successfully, 503 ("degraded") otherwise -- so Render won't
    # mark a deploy healthy until a tablebase is actually reachable and
    # probing.
    healthCheckPath: /health

    envVars:
      # The one setting every deployment genuinely differs on, so it's
      # prompted for here (sync: false) instead of hardcoded. Point this
      # at an http(s):// base URL serving the ChessTB layout remotely
      # (see README.md "Getting the tablebase files") -- REMOTE_MODE
      # defaults to "direct" in config.py, so nothing is written to
      # Render's (ephemeral, and for a set this size, impractically
      # small and expensive) local disk.
      - key: TABLEBASE_PATH
        sync: false

      # Both generated automatically -- Render fills in a random value
      # at deploy time and stores it as a secret env var. Rotate either
      # from the service's "Environment" tab in the Render Dashboard at
      # any time; app.py picks up the new value on the next restart.
      # ADMIN_TOKEN gates /admin and /admin/cache/*; leaving it
      # ungenerated (delete the block below) is also valid -- those
      # routes respond 503 until a token is set, the same as when
      # ADMIN_TOKEN is left unset entirely.
      - key: ADMIN_TOKEN
        generateValue: true
      - key: FLASK_SECRET_KEY
        generateValue: true

      # Render always terminates TLS at its edge, so the browser's own
      # connection to this deployment is HTTPS even though this process
      # itself speaks plain HTTP to Render's proxy. config.py's
      # default for this setting is False, tuned for a local plain-HTTP
      # installation rather than this deployment, so it's set explicitly
      # here instead of left to that default.
      - key: SESSION_COOKIE_SECURE
        value: "true"

      # Not set here: PORT is injected by Render itself at deploy time,
      # and config.py already reads it (falling back to 7860 only when
      # PORT isn't present, e.g. running the same image locally) -- see
      # config.py's "Server" section. SOURCE_REPOSITORY_URL is also left unset;
      # add it as a plain env var from the dashboard, or edit the
      # literal default in config.py, to enable the header's source repository button.