Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
152 lines (131 loc) · 6.96 KB
/
Copy path.env.example
File metadata and controls
152 lines (131 loc) · 6.96 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
# 4evergent environment configuration
#
# SECURITY: Never put private keys or seeds in this file, in source code,
# in logs, or in tests. Signing keys are loaded from a secrets manager or
# KMS at runtime only.
# Stellar network (MVP is testnet-first)
STELLAR_NETWORK=testnet
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
STELLAR_PASSPHRASE=Test SDF Network ; September 2015
# Testnet signing key (development only).
# Load this into your shell environment; do NOT write it into a committed file.
# TestnetLocalSigner reads STELLAR_TESTNET_SECRET_KEY at runtime.
# Generate a testnet keypair and fund it via https://friendbot.stellar.org
#
# STELLAR_TESTNET_SECRET_KEY=S... <- testnet only, never commit, never log
# Live Testnet submission (disabled by default).
# Only set to "1" when you explicitly want real Testnet transactions.
# Requires STELLAR_TESTNET_SECRET_KEY to be set.
# LIVE_SUBMIT=1
# Server
PORT=3000
NODE_ENV=development
# Bind host for the API server.
# Local development / tests: leave unset — defaults to 127.0.0.1 (loopback only).
# Hosted production (container, VM, reverse proxy): set 0.0.0.0 so the process
# is reachable from outside its own network namespace.
# HOST=0.0.0.0
#
# SAFETY: a non-loopback HOST without API_KEYS refuses to start (fail closed).
# See "Production authentication" below.
# HOST=127.0.0.1
# API authentication (production).
# Comma-separated entries: key:ownerId[:subject]
# - key: random secret, never commit real values
# - ownerId: server-side owner identity (clients cannot override it)
# - subject: optional identity metadata
# When set, all requests require "Authorization: Bearer <key>".
# Malformed entries cause startup failure (fail fast, no dev fallback).
# When unset (or empty), the server uses development auth (DevAuthProvider).
# API_KEYS=<example-key>:<owner-id>:<subject>,<another-key>:<owner-id-2>:<subject-2>
# Development mode owner identity:
# DEV_OWNER_ID=operator
# Development auth opt-in for a PUBLIC bind (hosted deployments only).
# By default, development auth is allowed ONLY on a loopback bind. Setting
# HOST=0.0.0.0 without API_KEYS stops startup with a FATAL error. Set this to
# "1" only when you deliberately want an unauthenticated API on a public
# interface (e.g. a throwaway demo). Never set it for real deployments.
# ALLOW_DEV_AUTH=1
# Browser origin allow-list for the dashboard.
# Comma-separated exact origins. When unset, no Access-Control-Allow-Origin
# header is emitted — a browser frontend on another origin cannot call the API.
# Required when the frontend is served from a different origin than the API.
# CORS_ORIGIN=https://<frontend-host>,http://localhost:5173
# Persistence (Phase 3)
# If set, activity and approval records persist to this SQLite file via
# node:sqlite (Node 22+). If omitted, stores fall back to in-memory and
# all records are lost on process restart.
# DATABASE_PATH=./4evergent.db
# Schedule worker (disabled unless explicitly enabled by the server config).
# Schedules more than five minutes overdue are skipped and advanced to their
# next cron occurrence. If the expression cannot produce a future occurrence,
# the schedule is paused for an operator to correct; this prevents repeated
# processing of a stale occurrence.
# SCHEDULER_ENABLED=1
# SCHEDULER_MAX_LATENESS_MS=300000
# Bounded cleanup for transient retention data. Runs every 24 hours by default
# and deletes at most 500 rows per table per sweep. Session days are retained
# after expiration; daily-spending uses UTC calendar days. A zero-day window
# keeps that table forever, and DATA_RETENTION_ENABLED=0 disables the worker.
# DATA_RETENTION_ENABLED=1
# DATA_RETENTION_INTERVAL_MS=86400000
# AUTH_SESSION_RETENTION_DAYS=30
# DAILY_SPENDING_RETENTION_DAYS=90
# Background worker intervals, in milliseconds. Each must be a positive number;
# an invalid value (non-numeric, zero, negative) stops startup with a FATAL
# error. Unset or empty uses the default shown. The startup log lines
# ([reconciler] / [execution-queue] / [scheduler] started, interval: ...)
# report the effective value.
# RECONCILIATION_INTERVAL_MS=30000 # transaction status reconciliation (default 30s)
# EXECUTION_QUEUE_INTERVAL_MS=10000 # execution queue polling (default 10s)
# SCHEDULER_INTERVAL_MS=60000 # schedule polling (default 60s)
# Logging
LOG_LEVEL=info
# Frontend (apps/web — Vite SPA)
# VITE_API_BASE is the base URL the dashboard calls for all API requests.
# If it is NOT set, apps/web/src/api.ts falls back to http://localhost:3000,
# which only works when the API server runs locally on that port.
#
# Development (API on localhost:3000): leave it unset, or set explicitly:
# VITE_API_BASE=http://localhost:3000
#
# Vercel / any deployed frontend: this MUST be set to the deployed API's
# public origin, otherwise every browser request goes to the visitor's own
# localhost and fails. Do not commit a real production URL here — set it in
# the Vercel project's Environment Variables (build-time, Vite inlines it):
# VITE_API_BASE=https://<your-api-host>
#
# Note: the /apps/web SPA rewrite in vercel.json intentionally does NOT proxy
# /api/* — the backend is a separate stateful Node service, not a Vercel
# function. Point VITE_API_BASE at that service's own host.
# ============================================================================
# USER AUTHENTICATION (browser sessions — separate from API_KEYS above)
# ============================================================================
# The dashboard logs in with Google OAuth, a Stellar wallet signature, or
# email+password. The API issues an HttpOnly SameSite session cookie; the
# browser never stores a token. API_KEYS (above) remain for machine clients.
# Origin of the browser app. Used for the Google OAuth redirect and as the
# credentialed CORS origin. No trailing slash.
# WEB_ORIGIN=http://localhost:5173
# WEB_ORIGIN=https://<your-frontend-host>
# Google OAuth (authorization-code flow). Create a Web client in Google Cloud
# Console and register the redirect URI below. Secrets are server-side only.
# GOOGLE_CLIENT_ID=<apps.googleusercontent.com>
# GOOGLE_CLIENT_SECRET=<secret>
# GOOGLE_REDIRECT_URI=http://localhost:3000/auth/google/callback
# Callback URL to register in the Google console (must match exactly):
# http://localhost:3000/auth/google/callback (local)
# https://<api-host>/auth/google/callback (deployed)
# Session cookie lifetime in seconds (default 86400 = 24h).
# SESSION_TTL_SECONDS=86400
# Cookie hardening. Defaults: Secure auto-detected (https / x-forwarded-proto),
# SameSite=Lax. Set COOKIE_SAMESITE=none only if you need cross-site cookies
# (requires Secure).
# COOKIE_SECURE=1
# COOKIE_SAMESITE=lax
# Domain string embedded in the Stellar wallet auth challenge (anti-replay
# across services). Defaults to the WEB_ORIGIN hostname.
# STELLAR_DOMAIN=localhost
# Open email registration. Set to 0 to disable the register endpoint
# (login-only after accounts exist).
# ALLOW_REGISTRATION=1