moistello-frontend/.env.example at master · CodedTricks/moistello-frontend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# ═══════════════════════════════════════════════════════════
# MOISTELLO — ENVIRONMENT VARIABLES
# Copy to .env.local and fill in the values
#
# This file is the ONLY env file tracked by git and it must never
# contain a real value. `.env` and every other `.env.*` variant are
# gitignored — put working credentials there, not here.
# ═══════════════════════════════════════════════════════════

# Wallet session HMAC key — cryptographically random hex string (32+ bytes / 64+ hex chars)
# This key protects localStorage session data from tampering. It is fetched by the
# client once per page load via GET /api/wallet/hmac/key and never enters the JS bundle.
#
# Generate a new one: `openssl rand -hex 32`
# Rotate by replacing the value and restarting the server. Old HMACs become invalid,
# so sessions are re-fetched cleanly. Plan rotation windows accordingly.
#
# REQUIRED in production — without it the server returns 500 on the key endpoint.
WALLET_HMAC_KEY=9fe903151d646503421c57f3bd7dc844ca10196ac0003c6bb6189e98748ada41

# WalletConnect v2 Project ID — get from https://cloud.walletconnect.com
# Required for QR modal. Without it, WC2 falls back to deep links.
NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID=

# Passkey WebAuthn Configuration
# RP ID: use "localhost" for dev, your domain for production
NEXT_PUBLIC_PASSKEY_RP_ID=localhost
# Server-side pepper (never exposed to client). Used for Stellar key
# derivation, so treat it like a signing key: generate a unique value per
# environment and never commit it. Production refuses to boot without it.
PASSKEY_SERVER_PEPPER=
# Expected origin for WebAuthn verification — must match client origin exactly
PASSKEY_EXPECTED_ORIGIN=http://localhost:1110

# Bot detection — hCaptcha (email verification step)
# Get yours: https://www.hcaptcha.com/
NEXT_PUBLIC_HCAPTCHA_SITE_KEY=
HCAPTCHA_SECRET_KEY=

# Bot detection — Cloudflare Turnstile (captcha step)
# Get yours: https://developers.cloudflare.com/turnstile/
NEXT_PUBLIC_TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=

# Stellar Network Configuration
# Set to "mainnet" for production. Defaults to "testnet" if not set.
# Horizon and Soroban RPC URLs are automatically derived from this value.
NEXT_PUBLIC_STELLAR_NETWORK=testnet

# Feature Flags — set to "false" to disable a wallet type
# Multi-wallet support (connect more than one wallet per account)
NEXT_PUBLIC_FEATURE_MULTI_WALLET=true
# WalletConnect v2 (200+ mobile wallets)
NEXT_PUBLIC_FEATURE_WALLETCONNECT=true
# Passkey (WebAuthn biometric login)
NEXT_PUBLIC_FEATURE_PASSKEY=true
# Hardware Wallet (Ledger via WebUSB/BLE)
NEXT_PUBLIC_FEATURE_HARDWARE_WALLET=true
# Browser extension wallets (xBull, Rabet, Albedo)
NEXT_PUBLIC_FEATURE_EXTENSION_WALLETS=true

# Governance & Reputation Tiers (Phase 11)
# Set to "false" to disable the governance UI and tier-based reputation features
NEXT_PUBLIC_FEATURE_GOVERNANCE=true
NEXT_PUBLIC_FEATURE_REPUTATION_TIERS=true

# API Configuration
# NEXT_PUBLIC_API_URL=http://localhost:3001

# Sentry Error Monitoring
# Get your DSN from https://sentry.io/settings/projects/
# Required for production error tracking and debugging
NEXT_PUBLIC_SENTRY_DSN=

# Custom Metrics Endpoint
# Set to your metrics collection service URL
# Required for analytics and performance monitoring
NEXT_PUBLIC_METRICS_ENDPOINT=

# Redis Configuration (for serverless challenge store)
# Redis connection URL for persistent challenge storage
REDIS_URL=redis://127.0.0.1:6379
# Optional: Redis password if authentication is enabled
REDIS_PASSWORD=