.env.example

# =============================================================================
# PropChain Frontend Environment Configuration Template
# =============================================================================
# Copy this file to .env.local for local development
# IMPORTANT: Never commit actual secrets to version control!
# =============================================================================

# -----------------------------------------------------------------------------
# Authentication
# -----------------------------------------------------------------------------
# Secret used to sign and verify auth-token cookies. Use a random value with
# at least 32 characters and keep it server-side only.
AUTH_SECRET=

# -----------------------------------------------------------------------------
# Application General Settings
# -----------------------------------------------------------------------------

# Application name displayed in UI
NEXT_PUBLIC_APP_NAME=PropChain

# Base URL for the application (include protocol and trailing slash)
NEXT_PUBLIC_APP_URL=http://localhost:3000/

# Current deployment environment
# Options: development, staging, production
NODE_ENV=development

# Enable build analysis (set to "true" for bundle analysis)
ANALYZE=false

# Enable CSP enforcement for the nonce-based CSP built in src/middleware.ts.
# Secure default (#1107): when unset/empty, CSP is ENFORCED in production and
# staging and disabled in development. Set "true" to enforce everywhere (e.g.
# to test CSP locally); set "false" only to debug CSP issues in production.
# Verify enforcement with: curl -I <url> (see docs/csp.md)
CSP_ENFORCE=

# -----------------------------------------------------------------------------
# Security / CSRF Protection
# -----------------------------------------------------------------------------

# HMAC signing secret for CSRF tokens. REQUIRED: CSRF token minting and
# verification fail closed when this is unset. Generate a strong random value,
# e.g.: openssl rand -hex 32
CSRF_SECRET=

# -----------------------------------------------------------------------------
# API Configurations
# -----------------------------------------------------------------------------

# Property API endpoint for fetching property data
NEXT_PUBLIC_PROPERTY_API_URL=https://api.propchain.example.com

# Analytics API endpoint (optional)
NEXT_PUBLIC_ANALYTICS_API_URL=https://analytics.propchain.example.com

# Server-side endpoint that receives POST /api/errors reports (required to persist reports)
ERROR_REPORTING_ENDPOINT=https://analytics.propchain.example.com/errors

# Optional bearer token for the error-reporting destination
# ERROR_REPORTING_API_KEY=your-error-reporting-api-key

# -----------------------------------------------------------------------------
# Redis Cache Configuration
# -----------------------------------------------------------------------------
# Redis connection settings for property data caching

# Redis server hostname or IP address
REDIS_HOST=localhost

# Redis server port
REDIS_PORT=6379

# Redis password (if authentication is enabled)
# REDIS_PASSWORD=your_redis_password

# Redis database number (0-15)
REDIS_DB=0

# Blockchain contract address for property events
PROPERTY_CONTRACT_ADDRESS=0x0000000000000000000000000000000000000000

# Blockchain RPC URL for event listening
BLOCKCHAIN_RPC_URL=https://mainnet.infura.io/v3/YOUR_INFURA_PROJECT_ID

# -----------------------------------------------------------------------------
# Web3 / Blockchain RPC Configurations
# -----------------------------------------------------------------------------
# These URLs are used for blockchain interactions. For production,
# use reliable RPC providers like Infura, Alchemy, or QuickNode.
# Format:_provider://YOUR_API_KEY

# Ethereum Mainnet RPC URL
ETHEREUM_MAINNET_RPC_URL=https://mainnet.infura.io/v3/YOUR_INFURA_PROJECT_ID

# Polygon Mainnet RPC URL  
POLYGON_MAINNET_RPC_URL=https://polygon-rpc.com

# Binance Smart Chain Mainnet RPC URL
BSC_MAINNET_RPC_URL=https://bsc-dataseed.binance.org

# Local Foundry/Anvil RPC URL for offline development
LOCAL_RPC_URL=http://localhost:8545

# Batch purchase contract address (deployed batch-purchase contract).
# Checkout fails closed with a configuration error when this is unset.
NEXT_PUBLIC_BATCH_PURCHASE_ADDRESS=

# -----------------------------------------------------------------------------
# Wallet Connect Configuration
# -----------------------------------------------------------------------------
# Get your Project ID at https://cloud.walletconnect.com
# This is required for WalletConnect functionality
NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID=your-walletconnect-project-id

# -----------------------------------------------------------------------------
# Feature Flags
# -----------------------------------------------------------------------------

# Enable/disable analytics tracking
NEXT_PUBLIC_ANALYTICS_ENABLED=false

# Enable/disable error reporting
NEXT_PUBLIC_ERROR_REPORTING_ENABLED=true

# Enable/disable debug mode (shows additional logging)
NEXT_PUBLIC_DEBUG_MODE=false

# Enable/disable maintenance mode
NEXT_PUBLIC_MAINTENANCE_MODE=false

# -----------------------------------------------------------------------------
# Internationalization (i18n)
# -----------------------------------------------------------------------------

# Default language
NEXT_PUBLIC_DEFAULT_LOCALE=en

# Supported locales (comma-separated)
NEXT_PUBLIC_SUPPORTED_LOCALES=en,es,fr,de,zh,ar,he

# -----------------------------------------------------------------------------
# External Services (Optional)
# -----------------------------------------------------------------------------

# Google Analytics Measurement ID (optional)
NEXT_PUBLIC_GA_MEASUREMENT_ID=

# Sentry DSN for error tracking (optional)
# Format: https://[PUBLIC_KEY]@o[ORG_ID].ingest.sentry.io/[PROJECT_ID]
NEXT_PUBLIC_SENTRY_DSN=

# Public IPFS gateway for on-chain property assets. Emitted as a preconnect
# hint in the root layout when set.
NEXT_PUBLIC_IPFS_GATEWAY=https://ipfs.io

# -----------------------------------------------------------------------------
# Development/Testing Only
# -----------------------------------------------------------------------------
# These should NOT be set in production

# Mock data mode (bypasses real API calls)
NEXT_PUBLIC_USE_MOCK_DATA=false

# Skip authentication for development
NEXT_PUBLIC_SKIP_AUTH=false

# Mock wallet connector (DEV ONLY — never set in production builds).
# Even when set to "true", the mock connector is ignored when NODE_ENV is
# "production", so production builds always use real injected connectors.
# The mock signs with a randomly generated per-session key (no committed
# private key).
NEXT_PUBLIC_MOCK_WALLET=false

# -----------------------------------------------------------------------------
# Phishing Manifest (CDN) Configuration
# -----------------------------------------------------------------------------
# The phishing denylist is fetched from a CDN and verified against a signature
# before it is applied. The manifest is NEVER fetched or applied unless
# NEXT_PUBLIC_MANIFEST_SIGNING_KEY is set (the check fails closed). Without it,
# only the bundled fallback list is used and a warning is logged.

# Signer address (Ethereum address) that signed the phishing manifest.
# Required for CDN manifest verification; the manifest is rejected when unset.
NEXT_PUBLIC_MANIFEST_SIGNING_KEY=

# CDN URL of the signed phishing manifest (optional, uses default if not set)
# NEXT_PUBLIC_PHISHING_MANIFEST_URL=https://cdn.propchain.io/security/phishing-manifest.json

# -----------------------------------------------------------------------------
# Rate Limiting Configuration
# -----------------------------------------------------------------------------

# Rate limit time window in milliseconds (default: 15 minutes)
RATE_LIMIT_WINDOW_MS=900000

# Maximum requests per IP per time window (default: 100)
RATE_LIMIT_MAX_REQUESTS=100

# Maximum requests per wallet address per time window (default: 50)
RATE_LIMIT_MAX_REQUESTS_PER_WALLET=50

# -----------------------------------------------------------------------------
# Upstash Redis Configuration (for distributed rate limiting)
# -----------------------------------------------------------------------------
# Get your Upstash Redis instance at https://upstash.com
# Set UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN for distributed
# rate limiting across serverless/edge deployments. When not set, the
# rate limiter falls back to in-memory storage (per-instance only).

UPSTASH_REDIS_REST_URL=
UPSTASH_REDIS_REST_TOKEN=

# -----------------------------------------------------------------------------
# -----------------------------------------------------------------------------
# Chainalysis Security API Configuration
# -----------------------------------------------------------------------------
# API key for Chainalysis address/transaction risk checks.
# IMPORTANT: This is read server-side only. Never expose it to the browser.
# CHAINALYSIS_API_KEY=your_chainalysis_api_key

# -----------------------------------------------------------------------------
# Secret Management (Production)
# -----------------------------------------------------------------------------
# For production deployments, use a secrets management service:
# - Vercel: Use Vercel Environment Variables
# - AWS: Use AWS Secrets Manager
# - GCP: Use Google Secret Manager
# - Azure: Use Azure Key Vault
# -----------------------------------------------------------------------------

# -----------------------------------------------------------------------------
# Demo / QA Routes
# -----------------------------------------------------------------------------
# Enable demo-only routes (/error-test, /i18n-demo, /performance,
# /ux-improvements-demo, /mobile-properties). Leave "false" (or unset) so they
# 404 in production; set to "true" for local development and QA.
NEXT_PUBLIC_ENABLE_DEMOS=false