Render

Deploy the console on Render with the console image and Render Postgres 18: one-click Deploy to Render, manual creation in the Dashboard, and the Render CLI equivalents.

RequirementsCopy Anchor Link

TopologyCopy Anchor Link

Render forwards one HTTP port per web service and terminates TLS at its load balancer. The node channel's 8443 is not exposed: nodes enroll with wss://<name>.onrender.com, and the node channel's TLS runs inside the WebSocket, terminated by the console with mTLS; see The node channel's WebSocket entry.

One-click creationCopy Anchor Link

render.yaml at the repository root is the Blueprint:

Both resources are created in Render's default region, oregon, which cannot be changed afterwards; for another region use manual creation.

1. Click Deploy to Render at the top of this page (https://render.com/deploy?repo=https://github.com/marvinli001/edgeweir) and sign in to Render.
2. Enter a Blueprint name, check that edgeweir and edgeweir-db will be created, and click Deploy Blueprint.
3. Turn off automatic sync: on the Blueprint's Settings page, set Auto Sync to No. Otherwise every change to this repository's render.yaml syncs to your deployment and overwrites the same settings changed in the Dashboard (image, variables).
4. Save the master key: on the edgeweir service's Environment page, copy the value of EDGEWEIR_MASTER_KEY and keep it offline, apart from database backups; see Backup and recovery.
5. Pin the version, then initialize.

Manual creationCopy Anchor Link

Equivalent to one-click creation, with a region of your choice.

1. Generate the master key:

   Copy Text

   umask 077
   openssl rand -base64 32 > edgeweir-master-key

2. Database: Dashboard + New → Postgres. Name edgeweir-db, PostgreSQL Version 18, pick the region and plan, click Create Database.

   • Copy the internal connection string (Internal) from the Connect menu at the top right of the database page.
   • A new database accepts password connections from any address (0.0.0.0/0): in the Networking section of the database's Info page, remove that entry and keep the private network only, like ipAllowList: [] in one-click creation.

3. Console: + New → Web Service, under Source Code pick Existing Image, enter ghcr.io/marvinli001/edgeweir:20260929-a1b2c3d (replace with the target tag) as Image URL, click Connect.

4. Name edgeweir, Region the same as the database, plan 0.5c-512mb or larger.

5. Advanced:

   • environment variables below;
   • Health Check Path /healthz.

   Copy Text

   PORT=3000
   DATABASE_URL=<internal connection string>
   EDGEWEIR_MASTER_KEY=<contents of edgeweir-master-key>
   EDGEWEIR_PUBLIC_URL=https://edgeweir.onrender.com
   EDGEWEIR_NODE_API_WEBSOCKET=true

   EDGEWEIR_PUBLIC_URL follows the service name; when the name is taken, Render assigns another subdomain. Look up the actual address on the service page after creation, correct it on Environment, and choose Save and deploy.

6. Click Create Web Service.

Pin the versionCopy Anchor Link

One-click creation runs the latest image. Once the first deploy succeeds, pin the tag it runs:

1. Read the running version:

   Copy Text

   curl -fsS https://<name>.onrender.com/healthz

   The version field is the tag, e.g. 20260929-a1b2c3d.

2. In the Deploy section of the edgeweir service's Settings page, change the image URL to ghcr.io/marvinli001/edgeweir:<that tag> and save.

InitializationCopy Anchor Link

An uninitialized console logs the same setup token on every start.

1. edgeweir service Logs, search for first-run setup.
2. The line's setupToken field is the setup token and its url field the setup wizard (<EDGEWEIR_PUBLIC_URL>/setup).
3. Open the wizard and enter the setup token; see Quick start.

VariablesCopy Anchor Link

ROLE, HOST, and NODE_API_PORT keep the image defaults all, 0.0.0.0, and 8443; only the WebSocket entry connects to 8443, inside the container. All variables: Environment variables.

VerificationCopy Anchor Link

Custom domainCopy Anchor Link

Do this before enrolling nodes; enrolled nodes connect to the address they enrolled with, see Node channel URL and certificate.

1. edgeweir service Settings → Custom Domains → + Add Custom Domain, enter console.example.com; add the CNAME the page shows to DNS and click Verify.

2. Change on Environment, choose Save and deploy:

   Copy Text

   EDGEWEIR_PUBLIC_URL=https://console.example.com

   The default node channel URL becomes wss://console.example.com. The Blueprint's Auto Sync must be No, or the next sync sets EDGEWEIR_PUBLIC_URL back to RENDER_EXTERNAL_URL.

3. Verify: run the commands of Verification with the new domain.

With nodes already enrolled through wss://<name>.onrender.com, save wss://console.example.com under "Node channel" in System settings instead of changing environment variables: the old name stays in the node channel certificate. Keep the onrender.com subdomain on (do not set Render Subdomain to Disabled).

UpgradeCopy Anchor Link

1. Back up the database: database page Recovery → Create export, download the export; paid plans also have Point-in-Time Recovery. See Backup and recovery.

2. In the Deploy section of the edgeweir service's Settings page, change the image URL to the new tag and save; on the Deploys page, Manual Deploy → Deploy latest reference.

3. Verify:

   Copy Text

   curl -fsS https://<name>.onrender.com/healthz

   Expected: version is the new tag.

Migrations, signature verification, and rollback: Versions, upgrades and rollback.

Render CLICopy Anchor Link

LimitationsCopy Anchor Link