FlowerShop IoT Platform — Free-Tier Deployment Spec

Target: findmyflowers.pl demo / early-access deployment Cost target: $0/month, accepting cold starts on non-critical surfaces Status: proposal — no code shipped against this yet

Diagrams

Component → host matrix

DNS layout (all CNAME → provider apex, auto-TLS)

Code changes required before first deploy

These are blockers, not nice-to-haves.

1. src/backend/FlowerShop.API/Program.cs — add app.UseForwardedHeaders(...) with XForwardedFor | XForwardedProto before UseHttpsRedirection() (currently line 190). Without it, Request.Scheme stays http behind Fly’s proxy and Keycloak rejects the OIDC reply URL.
2. src/backend/FlowerShop.API/Program.cs — add app.UseWebSockets() before the MapHub<BouquetHub>() call (line 227). Belt-and-suspenders for SignalR over reverse proxies.
3. CORS — replace Cors:AllowedOrigins: ["*"] in prod appsettings with the four portal / mobile origins above. The portals aren’t in the dev allow-list — they only work in dev because of the wildcard.
4. Secrets externalized to env vars on each host: ConnectionStrings__DefaultConnection, ConnectionStrings__Redis, MQTT__*, RabbitMQ__*, Authentication__Keycloak__*, Stripe__SecretKey, Stripe__WebhookSecret. Never bake into Docker images.
5. Fix known VendorPortal bugs before exposing to a real vendor:
   • Bouquets/Index.cshtml.cs — reads VendorId from session instead of JWT claim (EP-12 T-12-003).
   • Vases/Details.cshtml.cs — POSTs to hardcoded http://localhost:8080/api/mock-vase/... (EP-12 T-12-004).
6. Keycloak realm export — run kc.sh export --dir /opt/keycloak/data/import --realm flowershop on the dev instance, commit the JSON, and mount it into the Fly Keycloak VM so it boots with the same clients (flowershop-api, flowershop-customer-app, flowershop-admin-portal, flowershop-vendor-portal) the code expects.

Runtime configuration per host

Fly — FlowerShop.API

ASPNETCORE_URLS=http://+:8080
ASPNETCORE_FORWARDEDHEADERS_ENABLED=true
ConnectionStrings__DefaultConnection=Host=<aiven>;Database=flowershop_iot;Username=...;Password=...;SslMode=Require
ConnectionStrings__ReadConnection=<same host, read-only user>
ConnectionStrings__Redis=<upstash rediss:// url>
MQTT__BrokerHost=<cluster>.hivemq.cloud
MQTT__BrokerPort=8883
MQTT__UseTls=true
MQTT__Username=<hivemq user>
MQTT__Password=<hivemq pass>
RabbitMQ__ConnectionString=<amqps cloudamqp url>
Authentication__UseKeycloak=true
Authentication__Keycloak__Authority=https://auth.findmyflowers.pl/realms/flowershop
Authentication__Keycloak__ClientId=flowershop-api
Authentication__Keycloak__ClientSecret=<secret>
Stripe__SecretKey=<sk_live_...>
Stripe__WebhookSecret=<whsec_...>
FileStorage__R2__AccessKeyId=<r2 access key id>
FileStorage__R2__SecretAccessKey=<r2 secret access key>
Cors__AllowedOrigins__0=https://app.findmyflowers.pl
Cors__AllowedOrigins__1=https://admin.findmyflowers.pl
Cors__AllowedOrigins__2=https://vendor.findmyflowers.pl

Migrations run automatically on startup (Program.cs calls Database.MigrateAsync() with 10-attempt retry).

Fly — Keycloak

KC_DB=postgres
KC_DB_URL=jdbc:postgresql://<aiven>:5432/keycloak?sslmode=require
KC_DB_USERNAME=<keycloak_db_user>
KC_DB_PASSWORD=<...>
KC_HOSTNAME=auth.findmyflowers.pl
KC_PROXY=edge
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=<strong>
# command: start --optimized --import-realm

Render — each portal

ASPNETCORE_URLS=http://+:8080
ASPNETCORE_FORWARDEDHEADERS_ENABLED=true
ApiSettings__BaseUrl=https://api.findmyflowers.pl
Authentication__Authority=https://auth.findmyflowers.pl/realms/flowershop   # CustomerApp only
Authentication__ClientId=flowershop-customer-app                            # CustomerApp only
Authentication__ClientSecret=<secret>                                       # CustomerApp only
Authentication__PostLoginRedirectUri=https://app.findmyflowers.pl/          # CustomerApp only

Known risks at this topology

Alternatives considered

• Render free for everything — simplest, one provider, but cold starts break MQTT ingest. Rejected.
• Railway end-to-end — better DX than Render but only $5 one-time credit; not truly free long-term. Keep as upgrade path.
• Neon Postgres — 0.5 GB too tight once orders + analytics + Keycloak sessions share a box. Aiven’s 5 GB wins.
• Supabase Auth instead of Keycloak — removes a VM from the diagram, but the code already integrates with Keycloak (KeycloakAdminClient, VendorOnboardingService). Re-platforming auth is a separate epic, not a deployment task.
• Azure Container Apps free tier — generous free grant but requires a credit card and the 180k-vCPU-sec cap runs out fast with 5 background workers ticking. Rejected.

Upgrade path ($7–20/mo when demo graduates)

1. Move FlowerShop.API to Fly paid (shared-cpu-1x dedicated, ~$2/mo) → SLA-backed uptime.
2. Move CustomerApp to Fly (~$2/mo) → no cold starts, drop the keep-warm cron.
3. Upgrade Aiven PG to Startup tier (or move to Supabase Pro $25/mo) → automated backups.
4. HiveMQ Starter ($5/mo) → 1k device cap.
5. Keep AdminPortal + VendorPortal on Render free — internal traffic doesn’t need SLA.