# brewless.yml Every key of brewless.yml, what it means, and what Brewless does with it today. `brewless.yml` sits in the root of your project and belongs in the repository. It says which organisation and application the project is, and how each environment should be. Run `brewless plan` to see, per environment, what the file asks for next to what stands now; nothing is changed by it. A file with only `organisation`, `application`, `framework` and `php` is as valid as a long one. ```yaml brewless.yml organisation: acme application: shop framework: laravel php: "8.4" default-environment: staging environments: production: kind: production region: fr-par web: memory: 1024 min: 1 max: 10 database: shop-main queue: sqs domains: - shop.example.eu variables: APP_LOCALE: nl staging: kind: staging web: max: 2 scheduler: false ``` ## Keys A key under `environments.*` is set per environment, under its name. A key you leave out keeps what stands; the default is what an environment gets when Brewless sets it up. A key Brewless does not know is refused by name, so a typo does not go unnoticed. | Key | Type | Default | What it is | | --- | --- | --- | --- | | `organisation` | string | – | The organisation at Brewless, as in its address. | | `application` | string | – | The application within the organisation. | | `framework` | laravel, symfony, generic | `generic` | How the application is built and released. | | `php` | 8.3, 8.4, 8.5 | `8.4` | The PHP version a release is built for and runs on. | | `default-environment` | string | – | The environment `brewless deploy` and `brewless plan` use when you name none. Has to be one under `environments`. | | `build` | list of commands | – | Extra build commands, after those of the framework. | | `release` | list of commands | – | The commands that run against a new release before it goes live, in this order. | | `environments` | map of environments | – | The environments, by name: lowercase letters, digits and dashes. | | `environments.*.kind` | production, staging, development | `staging` | What the environment is for. | | `environments.*.region` | fr-par, nl-ams, pl-waw, it-mil | `fr-par` | The Scaleway region the environment runs in. | | `environments.*.web.memory` | whole number, megabytes | `512` | Memory of the web container. | | `environments.*.web.cpu` | whole number, thousandths of a vCPU | `500` | Processor time of the web container. | | `environments.*.web.timeout` | whole number, seconds | `60` | How long one request may take. | | `environments.*.web.min` | whole number, replicas | `0` | Replicas that keep running; 0 lets the container sleep. | | `environments.*.web.max` | whole number, replicas | `2` | The most replicas it scales out to. | | `environments.*.web.concurrency` | whole number, requests per replica | `50` | Requests one replica takes at once before another one starts. | | `environments.*.web.tmp-storage` | whole number, megabytes | `1000` | Local disk of the web container, for files that do not have to outlive a request. | | `environments.*.release.memory` | whole number, megabytes | `512` | Memory of the container the release commands run in. | | `environments.*.release.cpu` | whole number, thousandths of a vCPU | `500` | Processor time of the release container. | | `environments.*.release.timeout` | whole number, seconds | `900` | How long one call to the release container may take. Release commands themselves get 90 seconds per release. | | `environments.*.release.min` | whole number, replicas | `0` | Replicas of the release container that keep running. | | `environments.*.release.max` | whole number, replicas | `1` | The most replicas of the release container. | | `environments.*.release.tmp-storage` | whole number, megabytes | `1000` | Local disk of the release container. | | `environments.*.worker.memory` | whole number, megabytes | `512` | Memory of the container that works the queue and the schedule. | | `environments.*.worker.cpu` | whole number, thousandths of a vCPU | `500` | Processor time of the worker container. | | `environments.*.worker.timeout` | whole number, seconds | `120` | How long one run of the worker may take. | | `environments.*.worker.min` | whole number, replicas | `0` | Replicas of the worker container that keep running. | | `environments.*.worker.max` | whole number, replicas | `1` | The most replicas of the worker container. | | `environments.*.worker.tmp-storage` | whole number, megabytes | `1000` | Local disk of the worker container. | | `environments.*.worker.queues` | list of queue names | `default` | The queues the worker works, the first one being the default. | | `environments.*.scheduler` | true or false | `true` | Whether the schedule runs. The worker is called at the moments a task is due. | | `environments.*.database` | name of a database, map with name and standby, or false | – | The database the environment uses, by name; `false` for none. | | `environments.*.database.name` | name of a database | – | The name of the database, in the map form. | | `environments.*.database.standby` | true or false | `false` | Keeps a standby copy of a Managed Database in another zone of the region, which `brewless db:failover` or the console switches to. Scaleway bills it like a second node. See [Databases](/running/databases#a-standby-copy-in-another-zone). | | `environments.*.queue` | sqs, database or false | – | Where jobs wait: Scaleway Queues, the database, or nowhere. | | `environments.*.network` | private or public | `public` | private puts the containers on the Private Network of the Scaleway project, and reaches a Managed Database over it. | | `environments.*.cache` | name of a cache, map with name and size, or false | – | A Managed Database for Redis on the Private Network, as the cache of the application; `false` lets it go. | | `environments.*.cache.name` | name of a cache | – | The name of the cache at Scaleway. One that stands is used as it is. | | `environments.*.cache.size` | RED1-micro, RED1-2XS, RED1-XS, RED1-S, RED1-M, RED1-L, RED1-XL | `RED1-micro` | The node type a new cache gets. | | `environments.*.cache.nodes` | 1, or 3 to 6 for a cluster | `1` | How many nodes a new cache gets: 3 to 6 make a Redis cluster that keeps answering when one node fails. Every node is billed. See [A cache](/applications/applications-and-environments#a-cache). | | `environments.*.storage` | name of a bucket, map with name and keep_versions_days, or false | – | A private bucket for the files of the application, by name or as a map with `name` and `keep_versions_days`; `false` for none. See [Applications and environments](/applications/applications-and-environments#a-bucket-for-files). | | `environments.*.storage.name` | name of a bucket | – | The name of the bucket for files. Required in the map. | | `environments.*.storage.keep_versions_days` | whole number, days (1 to 3650) | – | Switches on versioning: a file that is overwritten or removed is kept as an older version, which Object Storage removes this many days after it became one. Files themselves are never removed by it. Without it, the bucket keeps no versions. | | `environments.*.backup` | map with region and expire_days, or false | – | A private bucket for backups with versioning, in a region of its own, closed to every other key of the project; `false` lets it go. See [Applications and environments](/applications/applications-and-environments#a-bucket-for-backups). | | `environments.*.backup.name` | name of a bucket | `{application}-{environment}-{project}-backups` | The name of the bucket for backups. Without it, the name of the environment and your project with `-backups`. | | `environments.*.backup.region` | fr-par, nl-ams, pl-waw, it-mil | – | The Scaleway region the bucket for backups stands in. Required. | | `environments.*.backup.expire_days` | whole number, days (1 to 3650) | – | Object Storage removes a backup this many days after it was put. Required. | | `environments.*.backup.keep_versions_days` | whole number, days (1 to 3650) | `expire_days` | Object Storage removes an older version of a backup this many days after it became one. Without it, `expire_days`. A backup is kept at most `expire_days` plus this. | | `environments.*.databases` | map with prefix, or false | – | Lets the running application ask Brewless for a Serverless SQL Database per tenant; `false` lets it ask for none, and the databases it made stay. Needs a Serverless SQL Database under `database`. See [Databases per tenant](/running/tenant-databases). | | `environments.*.databases.prefix` | lowercase letters, digits and dashes, ending in - | – | What the name of every such database starts with, such as `shop-`. Required. | | `environments.*.firewall` | map with rate_limit and bot_control, or false | – | bunny.net Shield in front of the environment; `false` takes away what Brewless set. See [Firewall](/running/firewall). | | `environments.*.firewall.rate_limit` | whole number, requests per 10 seconds from one address (1 to 100000), or false | – | How many requests one address may make in 10 seconds before bunny.net blocks it for a minute. Free on Shield Basic. | | `environments.*.firewall.bot_control` | challenge, log, off | – | What Shield does with a visitor that looks like a bot. Needs Shield Advanced or higher, which bunny.net bills to your own account. | | `environments.*.domains` | list of domain names | – | The domains the environment answers on. | | `environments.*.variables` | map of plain values | – | Plain variables, such as `APP_LOCALE`. Never a secret. | | `environments.*.services` | map of services | – | Services next to the application, by name: lowercase letters and digits, without dashes. Each runs in a container of its own on an image you build. See [Services](/running/services). | | `environments.*.services.*.build` | path of a directory with a Dockerfile | – | The directory with the Dockerfile of the service, relative to `brewless.yml`. `brewless service:push` builds it on your machine. | | `environments.*.services.*.memory` | whole number, megabytes | `1024` | Memory of the service's container. | | `environments.*.services.*.cpu` | whole number, thousandths of a vCPU | `560` | Processor time of the service's container. | | `environments.*.services.*.timeout` | whole number, seconds | `60` | How long one request to the service may take. | | `environments.*.services.*.min` | whole number, replicas | `0` | Replicas of the service that keep running; 0 lets it sleep. | | `environments.*.services.*.max` | whole number, replicas | `1` | The most replicas of the service. | | `environments.*.services.*.concurrency` | whole number, requests per replica | `50` | Requests one replica of the service takes at once before Scaleway starts another, up to `max`. Without it the container keeps what it has. | | `environments.*.services.*.private` | true or false | `false` | `true` gives the service no public address: it is reached over the Private Network only, on its private endpoint. Needs `network: private`. See [Services](/running/services#a-private-service). | ## Sizes Memory is from 128 to 12288 megabytes and processor time from 70 to 6000 thousandths of a vCPU. Scaleway pairs the two: the memory has to be at least the processor time and at most 4 times it. Give only one of them and the other follows, as Scaleway pairs them (1024 MB with 560). Local disk (`tmp-storage`) is from 1000 megabytes up to 4 times the memory, at most 24456. A timeout is from 10 to 3600 seconds; `concurrency` from 1 to 80 requests. Release commands get 90 seconds per release, whatever the timeout of the release container. ## No secrets A secret never belongs in a file in your repository. Under `variables`, a name that looks like one (it contains `KEY`, `SECRET`, `PASSWORD`, `TOKEN`, `CREDENTIALS`, `PRIVATE`, `DSN`, `SALT` or `AUTH` as a word) is refused. Keep secrets in Secret Manager with `brewless env:push`; see [Variables](/running/variables). ## What a deploy does with it today A deploy sends the whole file along. Brewless builds the release for `php` with the `build` steps after those of the framework, runs the `release` commands instead of the application's own (this needs `brewless/laravel` 0.3 or later), gives each container the sizes, scale, timeout and local disk the file names, works the `worker.queues` and leaves the schedule out with `scheduler: false`. Plain `variables` go into a new revision of the environment's variables in your Secret Manager before the build; that needs the environment's variables kept through Brewless (push them once with `brewless env:push`). A rollback puts back what the file asked of the release it goes back to. What the file sets is shown in the console as set in `brewless.yml`, and the console and `brewless scale` leave it alone. `default-environment` is the environment `brewless deploy` uses when you name none. Before the release, a deploy makes an environment the file names that does not exist yet, with its `kind` and `region`, and sets up the `database`, `queue`, `storage` and `backup` the file names; an environment that runs gets those it is missing, another number of `backup.expire_days` or `backup.keep_versions_days` sets the bucket for backups up again, and another number of `storage.keep_versions_days` sets the bucket for files up again. `databases` gives the application what it needs to ask for a database per tenant; another `databases.prefix` is refused while databases of the one that stands are recorded. The `domains` it does not answer on yet are named, and added after a yes or with `brewless deploy --domains`, because adding one can move its visitors. What stands is never switched for something else: another region, kind, database, bucket, bucket for backups or queue is refused before anything is made. `false` lets a database, a bucket or the bucket for backups go from the environment, while it keeps running at Scaleway. Removing a key from the file never removes anything: what it set stays as it is. `services` are put live with `brewless service:push`, which also gives their containers the sizes and scaling the file names; a deploy gives the application each service's address and secret, and is refused while a service it names does not run yet.