octraban_backend/.env.example at main · octraban/octraban_backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
# ─── Docker Compose database credentials ─────────────────────────────────────
# REQUIRED when using docker-compose. Use a strong, unique password.
# Never commit real credentials; rotate immediately if leaked.
# Exception process: document any known-vulnerable dependency below with an
# expiry date, e.g.: # EXCEPTION: lodash@4.17.20 CVE-2021-23337 expires 2025-12-31
POSTGRES_USER=postgres
POSTGRES_PASSWORD=changeme_before_deploying

# ─── Server ───────────────────────────────────────────────────────────────────
NODE_ENV=development
PORT=3000

# ─── Authentication (JWT) ─────────────────────────────────────────────────────
# REQUIRED in production. RS256 key pair for signing JWT tokens.
# Use `openssl genrsa -out private.pem 2048` and `openssl rsa -in private.pem -pubout -out public.pem`
# Note: replace newlines with \n when setting as environment variables.
# JWT_KEY_ID=key_1
# JWT_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
# JWT_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"

# ─── Active network ───────────────────────────────────────────────────────────
# Which network this server instance serves.
# Valid values: testnet | mainnet | devnet
# The matching NETWORK_* variables below are loaded automatically.
STELLAR_NETWORK=testnet

# ─── Testnet ──────────────────────────────────────────────────────────────────
TESTNET_DATABASE_URL="postgresql://postgres:password@localhost:5432/soroban_testnet"
TESTNET_READ_REPLICA_URL="postgresql://postgres:password@localhost:5432/soroban_testnet"
TESTNET_RPC_URL=https://soroban-testnet.stellar.org
TESTNET_RPC_WS_URL=wss://soroban-testnet.stellar.org
TESTNET_HORIZON_URL=https://horizon-testnet.stellar.org
TESTNET_PASSPHRASE="Test SDF Network ; September 2015"
TESTNET_API_SUBDOMAIN=testnet-api.localhost
TESTNET_CACHE_URL=memory://

# ─── Mainnet ──────────────────────────────────────────────────────────────────
MAINNET_DATABASE_URL="postgresql://postgres:password@localhost:5433/soroban_mainnet"
MAINNET_READ_REPLICA_URL="postgresql://postgres:password@localhost:5433/soroban_mainnet"
# Replace <API_KEY> with your provider key (e.g. Validation Cloud, QuickNode)
MAINNET_RPC_URL=https://mainnet.stellar.validationcloud.io/v1/<API_KEY>
MAINNET_RPC_WS_URL=wss://mainnet.stellar.validationcloud.io/v1/<API_KEY>
MAINNET_HORIZON_URL=https://horizon.stellar.org
MAINNET_PASSPHRASE="Public Global Stellar Network ; September 2015"
MAINNET_API_SUBDOMAIN=api.localhost
MAINNET_CACHE_URL=memory://

# ─── Devnet (local Stellar Quickstart) ────────────────────────────────────────
DEVNET_DATABASE_URL="postgresql://postgres:password@localhost:5434/soroban_devnet"
DEVNET_READ_REPLICA_URL="postgresql://postgres:password@localhost:5434/soroban_devnet"
DEVNET_RPC_URL=http://localhost:8000/soroban/rpc
DEVNET_RPC_WS_URL=ws://localhost:8000/soroban/rpc
DEVNET_HORIZON_URL=http://localhost:8000
DEVNET_PASSPHRASE="Standalone Network ; February 2017"
DEVNET_API_SUBDOMAIN=devnet-api.localhost
DEVNET_CACHE_URL=memory://

# ─── Indexer ──────────────────────────────────────────────────────────────────
INDEXER_START_LEDGER=0
INDEXER_POLL_INTERVAL_MS=5000
INDEXER_BATCH_SIZE=100
# Number of parallel workers during historical catch-up (1 = sequential)
INDEXER_CATCHUP_WORKERS=4

# ─── Rate limiting ────────────────────────────────────────────────────────────
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_MAX=100
RATE_LIMIT_PUBLIC_MAX=100
RATE_LIMIT_DEVELOPER_MAX=300
RATE_LIMIT_PREMIUM_MAX=1000
RATE_LIMIT_PUBLIC_WINDOW_MS=60000
RATE_LIMIT_DEVELOPER_WINDOW_MS=60000
RATE_LIMIT_PREMIUM_WINDOW_MS=60000
RATE_LIMIT_ADAPTIVE_ENABLED=true
RATE_LIMIT_ADAPTIVE_THRESHOLD=0.85
RATE_LIMIT_ADAPTIVE_MULTIPLIER=0.75
# Optional: set to a value > 0 to trigger adaptive throttling based on server load
RATE_LIMIT_LOAD_FACTOR=0
# Optional: shared Redis store so rate limits are enforced across multiple API
# instances (e.g. Docker Compose scale-out). Omit to use the in-memory fallback.
# REDIS_URL=redis://localhost:6379

# ─── Archival / TTL (cold storage) ───────────────────────────────────────────
# Days before raw XDR is archived to S3 (parsed/human-readable data stays in DB)
RAW_XDR_RETENTION_DAYS=90
# Rows processed per archival batch
ARCHIVE_BATCH_SIZE=500
# AWS S3 bucket for cold XDR storage (leave unset to skip archival)
ARCHIVE_S3_BUCKET=soroban-xdr-archive
# S3 storage class: STANDARD_IA (default) | GLACIER | DEEP_ARCHIVE
ARCHIVE_S3_STORAGE_CLASS=STANDARD_IA
AWS_REGION=us-east-1
# AWS_ENDPOINT_URL=http://localhost:4566  # LocalStack for local dev

# ─── OpenTelemetry tracing ────────────────────────────────────────────────────
# Tracing is OFF by default. Uncomment TRACING_ENABLED to turn it on.
# Setting OTLP_ENDPOINT alone also enables tracing (for existing deployments).
# TRACING_ENABLED=true
# OTLP_ENDPOINT=http://localhost:4318
# SERVICE_NAME=octraban

# ─── On-chain registry contract IDs (issue #10) ───────────────────────────────
# The Octraban on-chain registry/explorer contract deployed per network.
# Leave blank to disable on-chain registry reads for that network (safe default).
# Design decision documented in: docs/on-chain-registry.md
REGISTRY_CONTRACT_ID_TESTNET=CBKPNRQ4D3KTAAE7MMJ4HL6JNF2J2EBG2PSSRW4YHOMHTRHUU734CFWJ
REGISTRY_CONTRACT_ID_MAINNET=
REGISTRY_CONTRACT_ID_DEVNET=

# ─── WebSocket security ───────────────────────────────────────────────────────
# Comma-separated list of exact Origin URLs allowed for browser WebSocket clients.
# Example: "https://app.example.com,https://staging.example.com"
# Leave empty to allow all origins (development only — not safe for production).
WS_ALLOWED_ORIGINS=

# Maximum number of concurrent WebSocket connections across all clients.
WS_MAX_CONNECTIONS_GLOBAL=10000

# Maximum number of concurrent WebSocket connections from a single IP address.
WS_MAX_CONNECTIONS_PER_IP=10

# Maximum number of active filters (contract + eventType) per connection.
WS_MAX_FILTERS_PER_CONNECTION=10

# Interval in milliseconds between server-side ping frames sent to clients.
# Clients that do not pong within this interval are considered idle and closed.
WS_HEARTBEAT_INTERVAL_MS=30000

# Time in milliseconds after which an unresponsive connection is reaped.
# Should be >= WS_HEARTBEAT_INTERVAL_MS.
WS_IDLE_TIMEOUT_MS=120000

# ─── Outbound webhook dispatcher ──────────────────────────────────────────────
# Maximum number of delivery attempts before a webhook delivery is moved to the
# terminal "dead_letter" state and no longer retried (#45).
WEBHOOK_MAX_ATTEMPTS=5

# Base delay (ms) for the exponential retry backoff. Attempt N waits
# WEBHOOK_BACKOFF_BASE_MS * 3^(N-1), capped at 15 minutes.
# Default schedule: 10s, 30s, 90s, 270s, 810s.
WEBHOOK_BACKOFF_BASE_MS=10000

# Maximum concurrent outbound HTTP deliveries for fan-out and retry passes.
WEBHOOK_DISPATCH_CONCURRENCY=10