Talenttrust-Backend/.env.example at main · Alisadev-dev/Talenttrust-Backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
# =============================================================================
# TalentTrust Backend — Environment Variables
# =============================================================================
# Copy this file to .env and fill in the values for your environment.
# See docs/backend/config.md for detailed documentation.
# =============================================================================

# Server
PORT=3001
NODE_ENV=development
API_BASE_URL=https://api.example.com
DEBUG=true

# SSRF Protection
# Default: false (private/loopback/metadata hosts are blocked).
# Set to true only in development|test|staging to allow private hosts
# (e.g. local health probes, webhook fixtures). Rejected outright when
# NODE_ENV=production — startup validation will fail if this is true.
# SSRF_ALLOW_PRIVATE_HOSTS=false

# Security

JWT_SECRET=your-secret-key-at-least-32-chars-long

JWT_SECRET=your-secret-key-at-least-8-chars-long
# COMPLIANCE_AUDIT_SECRET must be a strong, random key of at least 32 characters.
# Example: openssl rand -hex 32

COMPLIANCE_AUDIT_SECRET=your-compliance-secret-key

# Admin API Authentication
# Optional API key for admin endpoints (DLQ, deploy).
# Must be set alongside ADMIN_API_KEY_HASH in production.
# ADMIN_API_KEY=your-admin-api-key-here
# ADMIN_API_KEY_HASH=<salt>:<hash> (generated via the API key utilities)

# Key rotation
# Set ROTATE_ADMIN_API_KEY=true to generate a new key on next boot (development only)
# ROTATE_ADMIN_API_KEY=false

# Database
DATABASE_URL=postgresql://localhost:5432/talenttrust

# CORS Configuration
# Comma-separated list of allowed origins for CORS requests
# Example: CORS_ALLOWED_ORIGINS=https://app.example.com,https://admin.example.com
# Note: Wildcard (*) is not allowed in production mode
# CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3001

# Stellar Network
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
STELLAR_NETWORK_PASSPHRASE=Test SDF Network ; September 2015

# Soroban Smart Contracts
SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
SOROBAN_CONTRACT_ID=

# Example: ROUTE_BODY_LIMITS=/api/upload:1048576,/api/data:2048
# ROUTE_BODY_LIMITS=

# Circuit Breaker Thresholds
# CB_FAILURE_THRESHOLD=5   # consecutive failures before opening (default: 5)
# CB_SUCCESS_THRESHOLD=1   # consecutive successes in HALF_OPEN before closing (default: 1)
# CB_TIMEOUT_MS=30000      # ms to wait in OPEN before probing again (default: 30000)

# Webhook Delivery Circuit Breaker
# Per-provider circuit breaker for outbound webhook delivery.
# Intentionally separate from CB_* so webhook and RPC failure modes can be tuned independently.
# WEBHOOK_CB_FAILURE_THRESHOLD=5    # consecutive failures before opening (1-100, default: 5)
# WEBHOOK_CB_SUCCESS_THRESHOLD=1    # consecutive successes in HALF_OPEN before closing (1-20, default: 1)
# WEBHOOK_CB_TIMEOUT_MS=60000       # cooldown ms before probing (1000-300000, default: 60000)
#                                   # Recommended: >= max retry backoff delay (default: 30000)

# Blue-Green Auto-Rollback (post-switch soak)
# After `npm run deploy:switch-green`, the deployer watches the HTTP 5xx
# error-rate metric for a soak window and automatically runs `rollback` if the
# threshold is breached.  See docs/backend/auto-rollback.md.
# AUTO_ROLLBACK_ENABLED=true            # master switch (default: true)
# ROLLBACK_ERROR_RATE_THRESHOLD=0.05    # 5xx fraction that triggers rollback (0..1, default: 0.05)
# ROLLBACK_SOAK_WINDOW_MS=30000         # total observation window (1000-600000, default: 30000)
# ROLLBACK_SAMPLE_INTERVAL_MS=5000      # time between samples (100-60000, default: 5000)
# ROLLBACK_MIN_REQUESTS=20              # min requests in window before acting (>=0, default: 20)

# Graceful Shutdown — Webhook Delivery Drain
# How long (ms) to wait for in-flight webhook deliveries to finish after SIGTERM
# before force-flushing them to the DLQ.  Set to a value that covers your p99
# delivery latency. During a blue/green switch the router stops sending traffic
# to the old color before SIGTERM arrives, so most deliveries will already be
# done by the time this timeout starts.
# WEBHOOK_DRAIN_TIMEOUT_MS=30000

# Rate Limiting — Milestones / Contracts
# RL_MILESTONES_MAX=60           # Max requests per window (default: 60)
# RL_MILESTONES_WINDOW_MS=60000  # Window duration in ms (default: 60000)

# Idempotency Store TTL
# How long (ms) idempotency keys are retained before eviction.
# Default: 3600000 (1 hour). Re-submissions after expiry are processed fresh.
# IDEMPOTENCY_TTL_MS=3600000

# Webhooks Feature Flag
# Set to false to disable all webhook behavior at runtime without a deploy.
# When false: WebhookService.trigger() becomes a no-op (no deliveries, no DLQ writes),
# and the /api/v1/webhook-subscriptions router is not mounted (all endpoints return 404).
# Default: true (webhooks are enabled)
# WEBHOOKS_ENABLED=true

# Audit Feature Flag
# Set to false to disable all audit subsystem behavior at runtime without a deploy.
# When false: res.locals.audit.log() becomes a no-op, protectedEndpointMiddleware
# skips its finish listener, and the /api/v1/audit router is not mounted.
# Default: true (audit is enabled)
# AUDIT_ENABLED=true

# =============================================================================
# Reputation upstream client resilience
# =============================================================================
# Retry and circuit-breaker parameters for outbound HTTP calls to an external
# reputation service. Safe production defaults are shown.
#
# REPUTATION_CLIENT_BASE_URL=https://example.invalid/reputation
# REPUTATION_CLIENT_TIMEOUT_MS=5000        (100..120000)
# REPUTATION_CLIENT_MAX_ATTEMPTS=3          (1..20)
# REPUTATION_CLIENT_BASE_DELAY_MS=200       (0..60000)
# REPUTATION_CLIENT_MAX_DELAY_MS=5000       (0..60000)
# REPUTATION_CLIENT_CB_FAILURE_THRESHOLD=5  (1..100)
# REPUTATION_CLIENT_CB_SUCCESS_THRESHOLD=1  (1..20)
# REPUTATION_CLIENT_CB_TIMEOUT_MS=30000     (1000..300000)