Backend/.env.example at main · Veloxous/Backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
# --- Stellar / Soroban ---
# testnet | mainnet (selects the network passphrase)
STELLAR_NETWORK=testnet
# Stellar secret key (S...) used to sign update_impact_score transactions
ADMIN_SECRET_KEY=
# Soroban contract address for the ProjectRegistry
PROJECT_REGISTRY_CONTRACT_ID=
# Stellar RPC endpoint
RPC_URL=https://soroban-testnet.stellar.org

# --- Notifications (BullMQ queue, email, realtime) ---
# Redis connection backing the BullMQ notification (and swap-timeout) queues
REDIS_HOST=localhost
REDIS_PORT=6379
# SMTP transport used by the notification worker to send templated emails
SMTP_HOST=
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=
SMTP_PASS=
SMTP_FROM=no-reply@veloxous.com
# Supabase project used for Realtime broadcast (in-app push notifications)
SUPABASE_URL=
SUPABASE_SERVICE_KEY=

# --- HTTP server ---
# Port the API listens on
PORT=3001
# Origin allowed by CORS
FRONTEND_URL=http://localhost:3000
# Bearer token for /api/admin/*. If unset, admin auth is skipped (dev only).
ADMIN_API_KEY=
# Token required to open a /ws WebSocket connection (via ?token= or Bearer auth).
# Falls back to ADMIN_API_KEY; if both unset, WebSocket auth is skipped (dev only).
WS_AUTH_TOKEN=

# --- Rate limiting (optional; sensible defaults applied when unset) ---
# Public endpoints: window length and max requests per IP per window
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_MAX=100
# Admin endpoints: stricter limits (default window mirrors RATE_LIMIT_WINDOW_MS)
RATE_LIMIT_ADMIN_WINDOW_MS=60000
RATE_LIMIT_ADMIN_MAX=20

# --- IP Whitelist for admin endpoints (optional) ---
# Comma-separated list of allowed IPs or CIDR ranges
# If empty or unset, IP whitelist is disabled (all IPs allowed)
ADMIN_IP_WHITELIST=
# Set to "false" to NOT bypass private/internal networks (default: true bypasses them)
ADMIN_IP_WHITELIST_BYPASS_PRIVATE=true

# --- Request Signing (optional) ---
# HMAC secret for request signature verification
# If empty or unset, request signing is disabled
REQUEST_SIGNING_SECRET=

# --- APM (Application Performance Monitoring) ---
# APM provider: "datadog" | "newrelic" | "opentelemetry" | "none"
APM_PROVIDER=none
# DataDog APM (if APM_PROVIDER=datadog)
DD_AGENT_HOST=localhost
DD_SERVICE=veloxous-backend
DD_ENV=development
DD_VERSION=1.0.0
# New Relic (if APM_PROVIDER=newrelic)
NEW_RELIC_LICENSE_KEY=
NEW_RELIC_APP_NAME=veloxous-backend
# OpenTelemetry (if APM_PROVIDER=opentelemetry)
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
OTEL_SERVICE_NAME=veloxous-backend

# --- Logging ---
# Log level: debug | info | warn | error
# Defaults to environment-based: development=debug, staging=info, production=warn
LOG_LEVEL=

# --- CSRF Protection ---
# Comma-separated list of allowed origins for CSRF validation
CORS_ORIGINS=

# --- Secrets Management ---
# Provider: env | aws | vault | azure
SECRETS_PROVIDER=env
# AWS Secrets Manager (if SECRETS_PROVIDER=aws)
AWS_REGION=us-east-1
AWS_SECRET_ID=
AWS_SECRET_VERSION_ID=
# HashiCorp Vault (if SECRETS_PROVIDER=vault)
VAULT_ENDPOINT=http://localhost:8200
VAULT_TOKEN=
VAULT_SECRET_PATH=secret/data/veloxous
# Azure Key Vault (if SECRETS_PROVIDER=azure)
AZURE_VAULT_URL=
AZURE_TENANT_ID=
AZURE_CLIENT_ID=
AZURE_CLIENT_SECRET=
# Secret rotation (optional)
SECRETS_ROTATION_ENABLED=false
SECRETS_ROTATION_INTERVAL_MS=3600000

# S3 image uploads (presigned URLs)
S3_BUCKET=
S3_REGION=us-east-1
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
# Optional CDN fronting the bucket; falls back to the bucket's public URL
CDN_BASE_URL=
MAX_UPLOAD_SIZE_BYTES=10485760
PRESIGN_EXPIRY_SECONDS=300