authorizer-render/render.yaml at main · authorizerdev/authorizer-render · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
services:
  - type: web
    name: authorizer
    env: docker
    autoDeploy: false
    healthCheckPath: /health
    envVars:
      - key: DATABASE_URL
        fromDatabase:
          name: authorizer-db
          property: connectionString
      - key: DATABASE_TYPE
        value: postgres
      - key: CLIENT_ID
        generateValue: true
      - key: CLIENT_SECRET
        generateValue: true
      - key: ADMIN_SECRET
        # REQUIRED, must be non-empty. As of the April 2026 security
        # release the authorizer binary refuses to start when this is
        # empty (the previous insecure "password" default has been
        # removed). generateValue makes Render mint a strong random
        # value on first deploy.
        generateValue: true
      - key: JWT_SECRET
        generateValue: true
      # Encrypts TOTP secrets and OTP digests at rest. Required with RS*/ES*;
      # with HS* it falls back to JWT_SECRET, but a distinct value keeps JWT
      # secret rotation from locking out enrolled TOTP users.
      - key: ENCRYPTION_KEY
        generateValue: true
      - key: JWT_TYPE
        value: HS256
      - key: MCP_ENABLED
        # Serve the MCP tool surface over HTTP at POST <AUTHORIZER_URL>/mcp as
        # an OAuth 2.1 resource server for AI agents. REQUIRES AUTHORIZER_URL:
        # the audience every MCP token is checked against is derived from it, so
        # the server exits at boot if this is true without one. Off by default —
        # it is a new internet-facing authenticated surface.
        value: "false"
      - key: AUTHORIZER_URL
        # REQUIRED — the server exits at boot without it, so the service will
        # fail to start until this is set. Render prompts for it at blueprint
        # deploy; if you skip the prompt, set it in the dashboard as soon as
        # the service URL is known and redeploy.
        #
        # Canonical/trusted base URL of this deployment — your Render service
        # URL, e.g. https://authorizer.onrender.com (include the scheme; a
        # bare hostname is rejected). It is the only source used to build
        # verification/reset/magic-link URLs, the JWT iss claim, and OIDC
        # discovery URLs; deriving them from request headers instead exposes
        # host-header-injection account takeover (CWE-640).
        #
        # Not populated automatically: a blueprint cannot concatenate the
        # scheme onto fromService.host, and the value must be a full URL.
        sync: false
      # ----------------------------------------------------------------
      # April 2026 security hardening flags. See
      # https://docs.authorizer.dev/core/security for the full reference.
      # ----------------------------------------------------------------
      - key: REDIRECT_URIS
        # Comma-separated EXACT redirect URIs for this deployment's own client
        # (CLIENT_ID above), e.g.
        #   https://authorizer.onrender.com/app,https://yoursite.com/callback
        #
        # Unset keeps the pre-2.4.0 behaviour: redirect_uri is matched against
        # ALLOWED_ORIGINS, which compares origins only, so any path under an
        # allowed host is accepted. Empty is a no-op, not a lockout.
        #
        # sync:false because the value is deployment-specific and cannot be
        # derived here — set it in the Render dashboard once your service URL
        # and app callbacks are known. It applies to EVERY flow carrying this
        # client_id, so list all of them or those logins are refused with
        # invalid redirect_uri.
        sync: false
      - key: OAUTH2_1_STRICT
        value: "false"
      - key: TRUSTED_PROXIES
        # Render terminates TLS at their edge and routes traffic through
        # their own router. Set this in the Render dashboard to the
        # router CIDR (or leave empty and accept that per-IP rate
        # limiting will key on the router IP). sync:false marks the
        # value as sensitive — Render will not sync it from this YAML.
        sync: false
      - key: REFRESH_TOKEN_EXPIRES_IN
        value: "2592000"
      - key: ENABLE_HSTS
        # Render terminates TLS at the edge so HSTS is safe to enable.
        value: "true"
      - key: DISABLE_CSP
        value: "false"
      - key: GRAPHQL_MAX_COMPLEXITY
        value: "300"
      - key: GRAPHQL_MAX_DEPTH
        value: "15"
      - key: GRAPHQL_MAX_ALIASES
        value: "30"
      - key: GRAPHQL_MAX_BODY_BYTES
        value: "1048576"

databases:
  - name: authorizer-db
    plan: free
    databaseName: authorizer