.env.example

NODE_ENV=development

# Service ports
PORT=3000
FX_ENGINE_URL=http://localhost:3002
SETTLEMENT_ENGINE_URL=http://localhost:3001
INDEXER_URL=http://localhost:3003

# Prometheus metrics — served on a dedicated port, separate from the app port
# (no auth, no rate limiting). Defaults to PORT + 1000 (e.g. 4000 for a
# service on 3000) when unset.
# METRICS_PORT=4000

# Fees — default basis points used when a merchant has no custom feeBps rule
FEES_DEFAULT_BPS=100

# Volume-based fee discount tiers — optional JSON array.
# Each tier: { "volumeUsd": <monthly gross threshold>, "discountBps": <discount to subtract> }
# Tiers are evaluated in descending volumeUsd order; the highest matching tier wins.
# Effective fee = feeBps − discountBps, clamped to [0, feeBps] (never negative).
# Example: two tiers — 10 bps off at $10 K/month, 25 bps off at $50 K/month
# FEE_DISCOUNT_TIERS=[{"volumeUsd":10000,"discountBps":10},{"volumeUsd":50000,"discountBps":25}]

# Auth — generate a strong secret for production
JWT_SECRET=change-me-to-a-long-random-secret-before-production
JWT_EXPIRES_IN=24h
# Field-level encryption key for sensitive DB columns (min 32 chars) — required
FIELD_ENCRYPTION_KEY=change-me-to-a-long-random-encryption-key-before-prod
AUTH_IP_THRESHOLD=20

# Google OAuth — MUST match NEXT_PUBLIC_GOOGLE_CLIENT_ID on the frontend
GOOGLE_CLIENT_ID=395539791502-i7rark5517dsa7t4vrchbhujko23ea6d.apps.googleusercontent.com

# Google OAuth — optional comma-separated list of allowed email domains.
# When set, only emails from these domains can authenticate via Google.
# Example: ALLOWED_EMAIL_DOMAINS=example.com,corp.com
# ALLOWED_EMAIL_DOMAINS=

# CORS — comma-separated list of allowed origins (required in production)
# Development defaults to http://localhost:3000 and http://localhost:5173 when unset
ALLOWED_ORIGINS=http://localhost:3000,https://betta-pay-frontend.vercel.app

# Stellar Testnet
STELLAR_RPC_URL=https://soroban-testnet.stellar.org
STELLAR_NETWORK_PASSPHRASE=Test SDF Network ; September 2015
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org

# Contract addresses (testnet — update after each deploy)
SETTLEMENT_CONTRACT_ID=your_settlement_contract_id
GOVERNANCE_CONTRACT_ID=your_governance_contract_id
ADMIN_ADDRESS=your_stellar_admin_address
ADMIN_SECRET=your_admin_secret_here

# Multi-contract indexing — comma-separated contract IDs for the indexer.
# Falls back to SETTLEMENT_CONTRACT_ID when unset (backward compatible).
# CONTRACT_IDS=your_settlement_contract_id,your_governance_contract_id

# Optional human-readable names for each contract, in the same order as CONTRACT_IDS.
# Format: contractId=name separated by commas.
# CONTRACT_NAMES=your_settlement_contract_id=settlement,your_governance_contract_id=governance

# Indexer — smart startup ledger discovery (#352)
# Number of ledgers to backfill from the network tip on fresh deployments (default: 1000).
# INITIAL_BACKFILL_LEDGERS=1000
# Manual override: skip auto-discovery and start from this specific ledger.
# INDEX_FROM_LEDGER=5000

# Redis (required by settlement engine BullMQ worker)
REDIS_URL=redis://localhost:6379
# BullMQ Redis connection tuning. BullMQ expects enableReadyCheck=false.
REDIS_MAX_RETRIES=3

# Settlement Engine — worker job timeout (ms). Jobs exceeding this duration are
# automatically failed by BullMQ. Default: 30000 (30 seconds).
# SETTLEMENT_JOB_TIMEOUT_MS=30000

# FX Engine — slippage tolerance (basis points; 100 bps = 1%)
DEFAULT_SLIPPAGE_BPS=50
MAX_SLIPPAGE_BPS=500

# FX Engine — quote minimum age (ms). Quotes younger than this are rejected
# to prevent replay attacks. Default: 1000 (1 second).
# QUOTE_MIN_AGE_MS=1000

# FX Engine — quote maximum lifetime (ms). Quotes older than this are rejected
# regardless of the rate-lock expiry. Must be greater than QUOTE_MIN_AGE_MS.
# Default: 300000 (5 minutes).
# QUOTE_MAX_LIFETIME_MS=300000

# FX Engine — rate staleness threshold (seconds). When rates are served, a structured
# WARN (live source) or ERROR (seed source) log is emitted if rates exceed this age.
# Default: 300 (5 minutes).
# MAX_STALE_SECONDS=300

# FX Engine — rate history retention (days). Snapshots older than this
# are purged daily by the rate-history-cleanup BullMQ job. Default: 7, min: 1.
# RATE_HISTORY_RETENTION_DAYS=7

# Database (required)
DATABASE_URL=postgresql://user:password@localhost:5432/bettapay

# Read-replica database URL (optional)
# When set, Prisma routes read queries (findMany, findFirst, count, aggregate)
# to this URL while writes go to DATABASE_URL. If absent a warning is logged
# and all queries use the primary database.
# DATABASE_READ_REPLICA_URL=postgresql://user:password@replica-host:5432/bettapay

# Connection pool — limits concurrent DB connections under load (default: 10).
# Increase for higher traffic, decrease for shared-resource environments.
# pool_timeout (in seconds) is the max time Prisma waits for a pooled connection.
DATABASE_POOL_SIZE=10
DATABASE_POOL_TIMEOUT=10