Build/deploy hardening: slim migrate stage, runtime frontend config, env var reconciliation

.env.example

@@ -44,7 +44,7 @@ POSTGRES_DB=app
 # Network: `testnet` | `mainnet` | `futurenet` | `local`
 STELLAR_NETWORK=testnet
 STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
-STELLAR_SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
+SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
 STELLAR_NETWORK_PASSPHRASE=Test SDF Network ; September 2015
 
 # Secret key of the account used to sign transactions.
@@ -60,13 +60,16 @@ STELLAR_CONTRACT_VAULT_REGISTRY=CXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 STELLAR_CONTRACT_ACCESS_LEASE=CXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 STELLAR_CONTRACT_SUBSCRIPTION=CXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 
+# USDC token contract used for payments.
+USDC_CONTRACT_ID=CXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
 
 # -----------------------------------------------------------------------------
 # Supabase
 # -----------------------------------------------------------------------------
 SUPABASE_URL=https://your-project.supabase.co
 SUPABASE_ANON_KEY=your-supabase-anon-key
-SUPABASE_SERVICE_ROLE_KEY=your-supabase-service-role-key
+SUPABASE_SERVICE_KEY=your-supabase-service-role-key
 
 
 # -----------------------------------------------------------------------------
@@ -80,6 +83,19 @@ ADMIN_API_KEY=change-me-to-a-long-random-string
 VITE_API_URL=http://localhost:3000
 
 
+# -----------------------------------------------------------------------------
+# Agent / Registry / LLM
+# -----------------------------------------------------------------------------
+# Secret key used by the agent service to sign transactions.
+AGENT_SECRET_KEY=SXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+# Secret key used by the registry service to sign transactions.
+REGISTRY_SECRET_KEY=SXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+# OpenRouter API key used by the LLM-backed agent.
+OPENROUTER_API_KEY=your-openrouter-api-key
+
+
 # -----------------------------------------------------------------------------
 # Frontend (Vite)
 # -----------------------------------------------------------------------------

.github/workflows/deploy-k8s.yml

@@ -137,6 +137,10 @@ jobs:
             type=gha,scope=backend
           cache-to: type=gha,mode=max,scope=backend-migrate
 
+      # The frontend image is environment-agnostic: VITE_* values are no longer
+      # baked in at build time. Runtime configuration is injected via env vars
+      # (see frontend/Dockerfile entrypoint, which renders /config.js from
+      # window.__APP_CONFIG__) and supplied by the k8s manifests at deploy time.
       - name: Build and push frontend image
         id: build-frontend
         uses: docker/build-push-action@v7
@@ -332,13 +336,29 @@ jobs:
             "frontend=${PREFIX}/frontend:${TAG}"
           kubectl kustomize . | grep -E '^\s+image:'
 
+      # Runtime configuration for the frontend image. These env vars are read
+      # by the container entrypoint at start to render /config.js, so the same
+      # image can be promoted across environments without a rebuild.
+      - name: Configure frontend runtime env
+        if: steps.config.outputs.ready == 'true'
+        working-directory: ./k8s
+        env:
+          FRONTEND_API_URL: ${{ vars.FRONTEND_API_URL || '/api' }}
+          FRONTEND_NETWORK: ${{ vars.STELLAR_NETWORK || 'testnet' }}
+        run: |
+          kubectl -n synapsvault create configmap frontend-runtime-config \
+            --from-literal=API_URL="$FRONTEND_API_URL" \
+            --from-literal=NETWORK="$FRONTEND_NETWORK" \
+            --dry-run=client -o yaml | kubectl apply -f -
+
       - name: Apply manifests
         id: apply
         if: steps.config.outputs.ready == 'true'
         run: |
           kubectl apply -k k8s/overlays/production
           kubectl -n synapsvault delete job backend-migrate --ignore-not-found
           kubectl apply -k k8s/
+          kubectl -n synapsvault rollout restart deployment/frontend
           # Track which deployments have been rolled out so a failure can be
           # rolled back precisely. Each successful rollout is recorded.
           : > "$RUNNER_TEMP/rolled_out"

backend/Dockerfile

@@ -10,6 +10,12 @@
 ARG NODE_VERSION=22
 # The backend's dependency tree has unresolved peer conflicts (e.g.
 # x402-stellar wants @stellar/stellar-sdk@^12 while the app uses ^15), so npm
+# needs --legacy-peer-deps until that is fixed upstream. Override with
+# --build-arg NPM_FLAGS= once it is.
+#
+# TODO(#102): drop --legacy-peer-deps once the upstream peer conflict is
+# resolved. Tracked upstream at:
+#   https://github.com/SynapsVault/backend/issues (x402-stellar vs stellar-sdk)
 # needs --legacy-peer-deps until that is fixed upstream
 # (tracked in https://github.com/SynapsVault/backend/issues). Override with
 # --build-arg NPM_FLAGS= once the upstream peer dependency issue is resolved.
@@ -65,8 +71,22 @@ RUN mkdir -p node_modules/@synapsvault && \
 RUN npm run build && test -f dist/index.js
 
 # ---------- Target: migrate ----------
-FROM build AS migrate
+# Slim image: only drizzle-kit, the drizzle config and the migrations are
+# needed to run `drizzle-kit migrate`. Avoids shipping the full build stage
+# (dev deps, sources, compilers) in the init container.
+FROM node:${NODE_VERSION}-alpine AS migrate
+ARG NPM_FLAGS
+WORKDIR /app
+
 ENV NODE_ENV=production
+
+# Install drizzle-kit standalone (no app dependency tree required).
+RUN npm install --no-audit --no-fund --ignore-scripts ${NPM_FLAGS} drizzle-kit
+
+# Only the config and migrations are required at runtime.
+COPY drizzle.config.ts ./drizzle.config.ts
+COPY drizzle ./drizzle
+
 USER node
 CMD ["npx", "--no-install", "drizzle-kit", "migrate"]