Skip to content

PayPal sandbox only. No real money moves.

OperatorsRun it yourself

Deploy staging

Hosting the server on Render and the web client on Cloudflare.

Plannednot done yet

Page last changed 9 Nov 2026 (from the git history)

Server on Render

render.yaml describes one web service, gavel-host, with one instance and a 1 GB disk at /var/data. The build bundles the server and workspace packages into packages/server/dist/main.js; the start command runs node dist/main.js, so no dev tooling is in the runtime. The health check is /healthz. Auto deploy is off.

The real deploy path: the owner uses Manual Deploy of main in the Render dashboard, then checks GET /version and runs scripts/smoke.sh. deploy-staging is an optional workflow that runs by hand only; it calls the Render deploy hook, waits, then runs scripts/smoke.sh. It is not configured, so a run says SKIPPED in its job summary and a manual start fails.

The smoke script checks, with timeouts: GET /healthz is 200, GET /warmup is 200, an unsigned POST /webhooks/paypal is 400, and POST /api/auctions without a key is 401.

Settings the owner must provide (names only)

WhereNames
Render environmentPUBLIC_URL, CORS_ORIGINS, TOKEN_SECRET, ADMIN_KEY, PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET, PAYPAL_WEBHOOK_ID
GitHub environment stagingsecret RENDER_DEPLOY_HOOK_URL, secret ADMIN_KEY (optional), variable STAGING_URL
Hosted checksvariables UPTIME_ENABLED, PRODUCTION_URL

Without them the uptime probe is skipped. The nightly judge smoke needs no variable: it targets the public domains unless a run is started with other web_url and api_url inputs.

Rate limits behind one address

Socket upgrades and HTTP joins share one per-address bucket. RATE_JOIN_BURST (default 40) is the bucket size and RATE_JOIN_PER_MIN (default 10) the refill. A venue where many judges share one NAT address can raise RATE_JOIN_BURST. Each address may hold at most 20 open sockets.

Known limits

  • The smoke may pass against the old instance if it answers before the new build is live; the workflow waits 60 seconds first.
  • Boot validation exits 78 and names each missing or invalid variable before the server listens.
Edit on GitHub

Last updated on

Use the real PayPal sandbox

The settings that switch GAVEL from the fake PayPal to the sandbox.

Hosting on Render code-checked

How GAVEL uses Render for its API and WebSocket host, why one instance with a persistent disk, how deploys and checks work, and what we would change to scale out.

On this page

Server on RenderSettings the owner must provide (names only)Rate limits behind one addressKnown limits