Reference / blueprint / v1

blueprint examples

Every example below is validated against the schema on this page in CI, so an example that does not validate fails the build rather than shipping.

llm-connection.yaml

specVersion: v1
kind: BLUEPRINT
metadata:
  slug: support-assistant
  revision: 1
  description: A support assistant that answers questions with the language model the installer chooses.
spec:
  parameters:
    llm:
      from: "${{ connections.llm.default }}"
      ui:
        label: Language model
  components:
    llm:
      componentRef: ./components/openai-chat.yaml
      bindings:
        llm:
          parameter: llm
    assistant:
      componentRef: ./components/assistant.yaml
      compute:
        profile: general.standard.small
      bindings:
        llmBaseURL:
          node: llm
          output: baseURL
        llmAPIKey:
          node: llm
          output: apiKey
        llmModel:
          node: llm
          output: model

minimal.yaml

specVersion: v1
kind: BLUEPRINT
metadata:
  slug: postgres
  revision: 1
  description: A single PostgreSQL database with a generated superuser password.
spec:
  parameters:
    postgresPassword:
      generator:
        byteLength: 32
        encoding: BASE64URL
  components:
    db:
      componentRef: ./components/postgres.yaml
      compute:
        profile: general.standard.small
      volumes:
        data:
          sizeGiB: 10
      bindings:
        postgresPassword:
          parameter: postgresPassword

organization-variables.yaml

specVersion: v1
kind: BLUEPRINT
metadata:
  slug: organization-variables
  revision: 1
  description: A web application that reads its region and error-reporting endpoint from organization variables.
spec:
  parameters:
    region:
      from: "${{ variables.cloud.region }}"
    errorReportingURL:
      from: "${{ variables.observability.errorReportingURL }}"
  components:
    web:
      componentRef: ./components/web.yaml
      compute:
        profile: general.standard.small
      exposure:
        web: PUBLIC
      bindings:
        region:
          parameter: region
        errorReportingURL:
          parameter: errorReportingURL

published-reference.yaml

specVersion: v1
kind: BLUEPRINT
metadata:
  slug: postgres
  revision: 1
  description: A PostgreSQL database deployed from revision 3 of a published component.
spec:
  parameters: {}
  components:
    db:
      componentRef: 550e8400-e29b-41d4-a716-446655440000
      revision: 3
      compute:
        profile: general.standard.small
      bindings: {}

signed-in-gateway.yaml

specVersion: v1
kind: BLUEPRINT
metadata:
  slug: signed-in-gateway
  revision: 1
  description: A web gateway behind the platform's sign-in, receiving each viewer's identity in a header.
spec:
  parameters: {}
  components:
    gateway:
      componentRef: ./components/trusted-proxy-gateway.yaml
      compute:
        profile: general.standard.small
      exposure:
        web:
          visibility: PUBLIC
          access: AUTHENTICATED
          viewerIdentity: HEADER
      # The node binds its own outputs back into its inputs: a discovery
      # dependency on allocated facts, not a value cycle.
      bindings:
        identityHeader:
          node: gateway
          output: identityHeader
        trustedProxies:
          node: gateway
          output: trustedProxies
        publicOrigin:
          node: gateway
          output: publicURL

signed-in-workspace.yaml

specVersion: v1
kind: BLUEPRINT
metadata:
  slug: signed-in-workspace
  revision: 1
  description: A chat workspace that signs viewers in through the platform's OpenID Connect provider.
spec:
  parameters: {}
  components:
    workspace:
      componentRef: ./components/oidc-client-workspace.yaml
      compute:
        profile: general.standard.small
      exposure:
        web:
          visibility: PUBLIC
          access: AUTHENTICATED
          viewerIdentity: OIDC
          # The workspace creates accounts with an email and a display name,
          # so the node releases both. Each is visible here to a reviewer.
          viewerClaims: [EMAIL, NAME]
      bindings:
        issuerURL:
          node: workspace
          output: issuerURL
        clientID:
          node: workspace
          output: clientID
        clientSecret:
          node: workspace
          output: clientSecret
        redirectURI:
          node: workspace
          output: redirectURI

web-and-database.yaml

specVersion: v1
kind: BLUEPRINT
metadata:
  slug: web-and-database
  revision: 1
  description: A web application backed by PostgreSQL on dedicated compute and fast local storage.
spec:
  parameters:
    postgresPassword:
      generator:
        byteLength: 32
        encoding: BASE64URL
    siteTitle:
      ui:
        label: Site title
      default: My site
    telemetry:
      ui:
        label: Telemetry to export
        prominence: SECONDARY
        enumLabels:
          logs: Logs
          metrics: Metrics
          traces: Traces
  components:
    db:
      componentRef: ./components/postgres.yaml
      compute:
        profile: general.standard.medium
        placement:
          cpuDedication: dedicated
      volumes:
        data:
          sizeGiB: 20
          storageClass: local-nvme
          minIOPS: 3000
      bindings:
        postgresPassword:
          parameter: postgresPassword
    web:
      componentRef: ./components/web.yaml
      compute:
        profile: general.standard.small
      exposure:
        web: PUBLIC
      bindings:
        databaseAddress:
          node: db
          output: address
        databasePassword:
          parameter: postgresPassword
        siteTitle:
          parameter: siteTitle
        telemetry:
          parameter: telemetry
        mode:
          value: production

with-external-node.yaml

specVersion: v1
kind: BLUEPRINT
metadata:
  slug: with-external-node
  revision: 1
  description: A web application using a managed PostgreSQL database that runs outside the platform.
spec:
  parameters:
    databaseHost:
      from: "${{ variables.databases.primary.host }}"
    databasePassword:
      from: "${{ variables.databases.primary.password }}"
    databaseName:
      ui:
        label: Database name
        prominence: SECONDARY
      default: app
  components:
    database:
      componentRef: ./components/managed-postgres.yaml
      bindings:
        host:
          parameter: databaseHost
        database:
          parameter: databaseName
        username:
          value: app
        password:
          parameter: databasePassword
    web:
      componentRef: ./components/web.yaml
      compute:
        profile: general.standard.small
      exposure:
        web: PUBLIC
      bindings:
        databaseHost:
          node: database
          output: host
        databasePort:
          node: database
          output: port
        databaseName:
          node: database
          output: database
        databaseUser:
          node: database
          output: username
        databasePassword:
          node: database
          output: password

workflow-with-webhooks.yaml

specVersion: v1
kind: BLUEPRINT
metadata:
  slug: workflow-with-webhooks
  revision: 1
  description: A workflow editor behind the platform's sign-in, whose webhooks stay reachable and whose owner is the installer.
spec:
  parameters:
    # Disclosed to the installer, and never bound: the workload receives only
    # its hash.
    ownerPassword:
      generator:
        byteLength: 24
        encoding: BASE64URL
      ui:
        label: Owner password
    ownerPasswordHash:
      hash:
        parameter: ownerPassword
        algorithm: BCRYPT
    ownerEmail:
      from: "${{ deployment.installer.email }}"
  components:
    workflows:
      componentRef: ./components/workflow-with-webhooks.yaml
      compute:
        profile: general.standard.small
      exposure:
        web:
          visibility: PUBLIC
          access: AUTHENTICATED
          accessExemptions: [PATHS]
      bindings:
        ownerEmail:
          parameter: ownerEmail
        ownerPasswordHash:
          parameter: ownerPasswordHash