AudioBlock_Backend/.env.example at main · cristianooR7/AudioBlock_Backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
# Server Configuration
PORT=4000
NODE_ENV=development

# Database Configuration
POSTGRES_HOST=
POSTGRES_PORT=
POSTGRES_USER=
POSTGRES_PASSWORD=
POSTGRES_DATABASE=

# Connection pool tuning (Issue #134). Defaults shown; override per-deployment.
DB_POOL_MAX=20
DB_POOL_MIN=5
DB_CONNECTION_TIMEOUT_MS=30000
DB_IDLE_TIMEOUT_MS=300000
# How often (ms) to log pool metrics and run the idle-connection health check.
DB_POOL_METRICS_INTERVAL_MS=30000

# Redis Configuration
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_URL=redis://redis:6379
REDIS_PASSWORD=
REDIS_USERNAME=

PGADMIN_DEFAULT_EMAIL=admin@local.com
PGADMIN_DEFAULT_PASSWORD=admin123

JWT_SECRET=
JWT_EXPIRER_AT="1d"

PRIVATE_KEY=
PRIVATE_KEY_2=

# Soroban (Stellar) Configuration
# The backend never holds artist secret keys — artists sign Soroban
# invocations client-side (e.g. Freighter) and the backend only builds and
# relays transactions. These are the deployed AudioBlocks Soroban contract
# IDs and RPC endpoint (see AudioB_Contract_Soroban/README.md).
SOROBAN_NETWORK=testnet
SOROBAN_TESTNET_RPC_URL=https://soroban-testnet.stellar.org
SOROBAN_TESTNET_NETWORK_PASSPHRASE="Test SDF Network ; September 2015"
SOROBAN_TESTNET_NFT_CONTRACT_ID=
SOROBAN_TESTNET_ARTIST_CONTRACT_ID=
SOROBAN_TESTNET_CATALOG_CONTRACT_ID=
SOROBAN_TESTNET_ROYALTY_CONTRACT_ID=
SOROBAN_TESTNET_MARKETPLACE_CONTRACT_ID=
SOROBAN_MAINNET_RPC_URL=https://mainnet.sorobanrpc.com
SOROBAN_MAINNET_NETWORK_PASSPHRASE="Public Global Stellar Network ; September 2015"
SOROBAN_MAINNET_NFT_CONTRACT_ID=
SOROBAN_MAINNET_ARTIST_CONTRACT_ID=
SOROBAN_MAINNET_CATALOG_CONTRACT_ID=
SOROBAN_MAINNET_ROYALTY_CONTRACT_ID=
SOROBAN_MAINNET_MARKETPLACE_CONTRACT_ID=

# Comma-separated list of allowed CORS origins (listener-app and artist-dashboard deployed domains).
# Example: https://listener.audioblockz.com,https://artist.audioblockz.com
# Defaults to localhost origins when unset.
ALLOWED_ORIGINS=

# Twitter OAuth 2.0 (PKCE) — used for artist Twitter account linking
# Register your app at https://developer.twitter.com/en/apps and enable OAuth 2.0.
TWITTER_APP_ID=
TWITTER_API_KEY=
TWITTER_API_SECRET_KEY=
TWITTER_AUTH_TOKEN=
TWITTER_ACCESS_TOKEN=
TWITTER_ACCESS_TOKEN_SECRET=

# OAuth 2.0 PKCE credentials (set in the Twitter developer portal)
TWITTER_CLIENT_ID=
TWITTER_CLIENT_SECRET=
# The callback URL registered in the Twitter app (must match exactly)
TWITTER_REDIRECT_URI=http://localhost:4000/api/auth/twitter/callback

# Artist-dashboard route that receives the post-OAuth redirect.
# The frontend reads the ?twitter_connected=1 query param and updates its UI.
# REQUIRED — startup will throw if unset.
# Example: https://artist.audioblockz.com/settings/social
TWITTER_SUCCESS_REDIRECT=

# Email Configuration
EMAIL_PROVIDER=resend
EMAIL_API_KEY=
EMAIL_FROM=noreply@audioblocks.com

# Frontend URL for email verification and password reset links
APP_URL=http://localhost:3000

# ── Rate limiting (Issue #29) ─────────────────────────────────────────────────
# Auth endpoints (/login, /register, /register-email, /login-email, etc.)
# Window and max requests are per IP+email combination.
AUTH_RATE_LIMIT_WINDOW_MS=900000   # 15 minutes
AUTH_RATE_LIMIT_MAX=20             # max 20 requests per window
# /nonce/:email is more aggressively rate-limited to prevent email enumeration.
NONCE_RATE_LIMIT_WINDOW_MS=900000  # 15 minutes
NONCE_RATE_LIMIT_MAX=10            # max 10 requests per window

# ── Structured logging (Issue #33) ───────────────────────────────────────────
# Pino log level: debug | info | warn | error  (default: info)
# Set to "debug" during local development for verbose output.
LOG_LEVEL=info

# ── Malware scanning (Issue #38) ─────────────────────────────────────────────
# SCAN_PROVIDER: "clamav" (production default) or "skip" (dev/test only — never in prod)
SCAN_PROVIDER=clamav
# URL of the ClamAV REST sidecar (e.g. clamd-rest container)
CLAMAV_URL=http://clamav:9000/scan
# Timeout for a single scan request in milliseconds (default: 30 s)
CLAMAV_TIMEOUT_MS=30000

# ── Worker retry / back-off (Issue #36) ──────────────────────────────────────
# Maximum number of processing attempts before a job is moved to the DLQ.
WORKER_MAX_ATTEMPTS=3
# Base delay (ms) for exponential back-off: delay = BASE * 2^(attempt-1)
WORKER_BACKOFF_BASE_MS=2000
# Ceiling delay (ms) — back-off will never exceed this value.
WORKER_BACKOFF_MAX_MS=30000

# ── Background job queue (Issue #132) ────────────────────────────────────────
# Default max attempts per job before it is dead-lettered.
JOB_MAX_ATTEMPTS=3
# Exponential backoff for retries: delay = BASE * 2^(attempt-1), capped at MAX.
JOB_BACKOFF_BASE_MS=2000
JOB_BACKOFF_MAX_MS=30000
# How long (seconds) to retain completed job records for inspection.
JOB_COMPLETED_TTL_S=3600
# Warn when total queued jobs exceed this threshold.
JOB_QUEUE_WARN_THRESHOLD=100
# How often (ms) to log job queue depth metrics.
JOB_MONITOR_INTERVAL_MS=30000