Environment classes

An app is described by a shared base.yaml merged with thin per-class overlays. The class determines where it runs and how it deploys — placement is never a scheduling decision.

Class	Node	Access	How it deploys	Lifetime
production	prod	public (custom domains, Cloudflare edge)	reviewed render PR — admin merge required	permanent
stable	private	VPN	auto-deploy from the latest tagged release (vX.Y.Z)	permanent
testing	private	VPN	auto-deploy from the latest main build	permanent
ephemeral	private	VPN	per pull request, generated from the base + a PR patch	TTL after PR close

Opt-in by overlay

An app runs a class only if it commits that class’s overlay (stable.yaml, production.yaml, …). An absent overlay simply means the app doesn’t run there — the platform never invents one.

Ingress hosts

Non-production classes get an auto-assigned host {app}.{project}.<base-domain> (previews get an {app}-pr{N}.… name) served over the VPN — the app only declares a port. Production uses real custom domains wired through Cloudflare and the public edge.

Public non-production apps

A non-production app can be made publicly reachable without moving off the private node by setting ingress.public: true on its overlay. The platform runs a Cloudflare Tunnel that dials out to Cloudflare and routes the app’s host through to its ingress — no inbound ports are opened and the node stays private. Handy for things that need a real public origin, such as third-party OAuth callbacks that can’t reach a VPN-only host.

Isolation between classes

Each class runs on its own per-project network, so a project can run stable, testing, and ephemeral side by side on the private node without their apps colliding — each class resolves its own siblings (api, web, …) independently. Databases stay isolated per class by name.

The production gate

Testing and stable render PRs auto-merge, preserving auto-deploy. The env/production render PR waits for an admin review of the exact final diff — that review is the production gate. Because class policies are enforced by branch protection on the ops repos, even a compromised dashboard cannot skip a production review.