FlowerShop IoT Platform — Free-Tier Deployment Spec

Target: findmyflowers.pl demo / early-access deployment Cost target: low-cost showcase, always-on where it matters Status: shipped — live at findmyflowers.pl. The final topology diverged from this proposal in two big ways: all three portals run on Fly.io (not Render) and PostgreSQL runs on Fly (not Aiven). Redis and RabbitMQ were never provisioned in prod (dev-only). The sections below have been updated to reflect what actually shipped.

Diagrams

Component → host matrix

DNS layout (all CNAME → provider apex, auto-TLS)

Code changes required before first deploy — DONE

These were blockers at proposal time. All are now shipped.

1. ✅ src/backend/FlowerShop.API/Program.cs — app.UseForwardedHeaders(...) with XForwardedFor | XForwardedProto is applied before UseHttpsRedirection(), so Request.Scheme is correct behind Fly’s proxy.
2. ✅ src/backend/FlowerShop.API/Program.cs — app.UseWebSockets() runs before MapHub<BouquetHub>() for SignalR over the reverse proxy.
3. ✅ CORS — prod Cors:AllowedOrigins lists the real portal / mobile origins; the dev wildcard is gone.
4. ✅ Secrets externalized to env vars on each host via Fly secrets: ConnectionStrings__DefaultConnection, Authentication__Keycloak__*, MQTT__*, Stripe__SecretKey, Stripe__WebhookSecret, FileStorage__R2__*. None baked into images. (Redis/RabbitMQ connection strings are unset in prod — those services aren’t provisioned.)
5. ✅ Known VendorPortal bugs fixed before exposing to a real vendor (EP-12 T-12-003 / T-12-004).
6. ✅ Keycloak realm committed at docker/keycloak/flowershop-realm.json and imported into the Fly Keycloak VM. Realm flowershop boots with clients flowershop-api, flowershop-customer-app, ESP32-40C86C and a Google IdP. Note: there is no dedicated admin/vendor OIDC client — both portals authenticate through the flowershop-api client via password grant.

Runtime configuration per host

Fly — FlowerShop.API

ASPNETCORE_URLS=http://+:8080
ASPNETCORE_FORWARDEDHEADERS_ENABLED=true
ConnectionStrings__DefaultConnection=Host=flower-shop-postgres.flycast;Database=flower_shop_backend_core;Username=...;Password=...
# Redis and RabbitMQ are NOT provisioned in prod — leave these unset:
#   ConnectionStrings__Redis   (RedisCacheService falls back to in-memory)
#   RabbitMQ__ConnectionString (InMemoryEventBus is the active impl)
MQTT__BrokerHost=<cluster>.hivemq.cloud
MQTT__BrokerPort=8883
MQTT__UseTls=true
MQTT__Username=<hivemq user>
MQTT__Password=<hivemq pass>
Authentication__UseKeycloak=true
Authentication__Keycloak__Authority=https://auth.findmyflowers.pl/realms/flowershop
Authentication__Keycloak__ClientId=flowershop-api
Authentication__Keycloak__ClientSecret=<secret>
Stripe__SecretKey=<sk_..._>
Stripe__WebhookSecret=<whsec_...>
FileStorage__R2__AccessKeyId=<r2 access key id>
FileStorage__R2__SecretAccessKey=<r2 secret access key>
Cors__AllowedOrigins__0=https://findmyflowers.pl
Cors__AllowedOrigins__1=https://admin.findmyflowers.pl
Cors__AllowedOrigins__2=https://vendors.findmyflowers.pl

Migrations run automatically on startup (Program.cs calls Database.MigrateAsync() with 10-attempt retry).

Fly — Keycloak

KC_DB=postgres
KC_DB_URL=jdbc:postgresql://flower-shop-postgres.flycast:5432/keycloak
KC_DB_USERNAME=<keycloak_db_user>
KC_DB_PASSWORD=<...>
KC_HOSTNAME=auth.findmyflowers.pl
KC_PROXY=edge
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=<strong>
# command: start --optimized --import-realm

Fly — each portal

ASPNETCORE_URLS=http://+:8080
ASPNETCORE_FORWARDEDHEADERS_ENABLED=true
ApiSettings__BaseUrl=https://api.findmyflowers.pl
Authentication__Authority=https://auth.findmyflowers.pl/realms/flowershop   # CustomerApp only
Authentication__ClientId=flowershop-customer-app                            # CustomerApp only
Authentication__ClientSecret=<secret>                                       # CustomerApp only
Authentication__PostLoginRedirectUri=https://app.findmyflowers.pl/          # CustomerApp only

The Admin and Vendor portals authenticate through the flowershop-api client via password grant (there is no dedicated portal OIDC client); they only need ApiSettings__BaseUrl plus the configurable Keycloak base URL.

Known risks at this topology

Alternatives considered (historical)

• Render free for the portals — the original proposal put the three portals on Render free. In the end all three portals shipped on Fly.io (region fra, min_machines_running=1) so cold starts never enter the picture and everything lives under one provider. Render is no longer used anywhere.
• Aiven free PG — the proposal called for Aiven. In the end PostgreSQL shipped on Fly Postgres (flower-shop-postgres, PG 17), co-located with the apps and reachable over .flycast.
• Railway end-to-end — better DX but only $5 one-time credit; not truly free long-term.
• Supabase Auth instead of Keycloak — removes a VM from the diagram, but the code already integrates with Keycloak (KeycloakAdminClient, VendorOnboardingService). Re-platforming auth is a separate epic, not a deployment task.
• Azure Container Apps free tier — generous free grant but requires a credit card and the 180k-vCPU-sec cap runs out fast with 5 background workers ticking. Rejected.

Upgrade path (when demo graduates)

1. Move FlowerShop.API to a dedicated Fly VM → SLA-backed uptime.
2. HiveMQ Starter ($5/mo) → 1k device cap.
3. Provision real Redis (ConnectionStrings:Redis) and RabbitMQ (RabbitMQ:ConnectionString) if/when the cache and event-bus load warrant it — the code already supports both.