Amana/.env.staging.example at main · KingFRANKHOOD/Amana · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# .env.staging.example — copy to .env.staging and fill in real values
# NEVER commit .env.staging to version control

# ── Staging Compose Database ──────────────────────────────────────────────────
STAGING_POSTGRES_USER=postgres
STAGING_POSTGRES_PASSWORD=change-me-staging-db-password
STAGING_POSTGRES_DB=amana_staging
STAGING_POSTGRES_PORT=5434
STAGING_DATABASE_URL=postgresql://postgres:change-me-staging-db-password@localhost:5434/amana_staging

# ── Staging Compose Redis ─────────────────────────────────────────────────────
STAGING_REDIS_PASSWORD=change-me-staging-redis-password
STAGING_REDIS_PORT=6380
STAGING_REDIS_URL=redis://:change-me-staging-redis-password@localhost:6380/0

# ── Backend App Connections ───────────────────────────────────────────────────
DATABASE_URL=postgresql://postgres:change-me-staging-db-password@localhost:5434/amana_staging
REDIS_URL=redis://:change-me-staging-redis-password@localhost:6380/0

# ── App Runtime & Security ────────────────────────────────────────────────────
NODE_ENV=staging
PORT=4000
TRUST_PROXY=false

JWT_SECRET=change-me-staging-jwt-secret-minimum-32-chars
JWT_EXPIRES_IN=86400
JWT_ISSUER=amana
JWT_AUDIENCE=amana-api

CORS_ORIGINS=
API_PUBLIC_URL=

SUPABASE_URL=
SUPABASE_SERVICE_ROLE_KEY=

# ── Rate Limiting Fine-tuning ─────────────────────────────────────────────────
RATE_LIMIT_AUTH_WINDOW_MS=900000
RATE_LIMIT_AUTH_MAX=10
RATE_LIMIT_AUTH_REFRESH_WINDOW_MS=900000
RATE_LIMIT_AUTH_REFRESH_MAX=30
RATE_LIMIT_USER_WINDOW_MS=60000
RATE_LIMIT_USER_MAX=30
RATE_LIMIT_DISPUTE_WINDOW_MS=3600000
RATE_LIMIT_DISPUTE_MAX=5

# ── Stellar / Soroban ─────────────────────────────────────────────────────────
STELLAR_NETWORK=testnet
STELLAR_NETWORK_PASSPHRASE=
STELLAR_RPC_URL=https://soroban-testnet.stellar.org
SOROBAN_RPC_URL=
CONTRACT_ID=
AMANA_ESCROW_CONTRACT_ID=CCY3G5O6M7K8N9P0Q1R2S3T4U5V6W7X8Y9Z0A1B2C3
USDC_CONTRACT_ID=CYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
ADMIN_STELLAR_PUBKEYS=

# ── Pinata / IPFS ─────────────────────────────────────────────────────────────
PINATA_API_KEY=
PINATA_SECRET=
PINATA_JWT=
IPFS_GATEWAY_URL=https://gateway.pinata.cloud/ipfs
IPFS_GATEWAY_URLS=
IPFS_GATEWAY_ALLOWLIST=
IPFS_UPLOAD_TIMEOUT_MS=10000
IPFS_STREAM_TIMEOUT_MS=5000
IPFS_PINATA_CIRCUIT_FAILURE_THRESHOLD=3
IPFS_PINATA_CIRCUIT_COOLDOWN_MS=30000
IPFS_GATEWAY_CIRCUIT_FAILURE_THRESHOLD=3
IPFS_GATEWAY_CIRCUIT_COOLDOWN_MS=30000
IPFS_URL_SIGNING_SECRET=
IPFS_URL_TTL_SECONDS=300

# ── Evidence / Manifest ───────────────────────────────────────────────────────
EVIDENCE_MAX_BYTES=52428800
EVIDENCE_METADATA_RETENTION_DAYS=90
EVIDENCE_SCAN_REQUIRED=false
MANIFEST_PII_RETENTION_DAYS=30

# ── Soroban Event Listener ────────────────────────────────────────────────────
EVENT_POLL_INTERVAL_MS=10000
BACKOFF_INITIAL_MS=1000
BACKOFF_MAX_MS=30000
PROCESSED_LEDGERS_CACHE_SIZE=10000
EVENT_OUTBOX_MAX_ATTEMPTS=5

# ── Distributed Tracing & Observability (OTEL) ────────────────────────────────
JAEGER_ENDPOINT=
ZIPKIN_ENDPOINT=
PROMETHEUS_PORT=
OTEL_SERVICE_NAME=amana-backend-staging
OTEL_EXPORTER_JAEGER_AGENT_HOST=
OTEL_EXPORTER_JAEGER_AGENT_PORT=

# ── Audit Export Signing (Ed25519 PEM keys) ───────────────────────────────────
AUDIT_SIGNING_KEY_ID=amana-audit-key-staging-v1
AUDIT_SIGNING_PRIVATE_KEY_PEM=
AUDIT_SIGNING_PUBLIC_KEY_PEM=

# ── Webhooks ──────────────────────────────────────────────────────────────────
WEBHOOK_URL=
WEBHOOK_SECRET=

# Trade notes encryption (AES-256-GCM) — dedicated key, NOT derived from JWT_SECRET
# Generate with: openssl rand -base64 32
TRADE_NOTES_ENCRYPTION_KEY=

# Ops alert webhook (cache/DB failures; separate from trade webhooks)
ALERT_WEBHOOK_URL=
ALERT_WEBHOOK_SECRET=
ALERT_COOLDOWN_MS=300000

# ── PostgreSQL Connection Pool Tuning ──────────────────────────────
# Prisma pool size: controls max connections per backend instance.
# With N instances × pool_size connections, ensure N * pool_size <= PostgreSQL max_connections.
DATABASE_POOL_SIZE=15
DATABASE_POOL_TIMEOUT=10
DATABASE_MAX_OVERFLOW=5
DATABASE_IDLE_INACTIVE_SESSION_TIMEOUT=300000
DATABASE_CONNECTION_QUERY_TIMEOUT=5000

# PgBouncer (staging profile only, see docker-compose.yml)
PGBOUNCER_ENABLED=false
PGBOUNCER_POOL_MODE=transaction
PGBOUNCER_DEFAULT_POOL_SIZE=15
PGBOUNCER_RESERVE_POOL_SIZE=5
PGBOUNCER_RESERVE_POOL_TIMEOUT=10
PGBOUNCER_SERVER_IDLE_TIMEOUT=600
PGBOUNCER_SERVER_LIFETIME=3600
STAGING_PGBOUNCER_PORT=6432
STAGING_PGBOUNCER_USER=postgres
STAGING_PGBOUNCER_PASSWORD=change-me-staging-pgbouncer-password

# Pool saturation alerting (percentage of max pool size that triggers warning)
POOL_SATURATION_WARN_THRESHOLD=80
POOL_SATURATION_WARN_DURATION_MS=300000