stellopay-backend/env.example at main · Stellopay/stellopay-backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
# Environment: development or production
# IMPORTANT: Set to "production" for production deployments
NODE_ENV=development

PORT=4000
# CORS_ORIGIN — allowed frontend origins for Cross-Origin Resource Sharing.
#
# ── Development (NODE_ENV=development) ───────────────────────────────────────
# When unset, defaults to "*" (permissive wildcard). A startup warning is
# logged. You may override with an explicit allowlist even in development:
#   CORS_ORIGIN=http://localhost:3000
#
# ── Non-development (staging, production, …) ─────────────────────────────────
# ⚠️  REQUIRED — there is NO default. The application will REFUSE TO START if
# this is absent, empty, or set to the wildcard "*".
# Set to an explicit comma-separated list of trusted frontend origins:
#   CORS_ORIGIN=https://app.stellopay.com
#   CORS_ORIGIN=https://app.stellopay.com,https://staging.stellopay.com
#
# ⚠️  SECURITY WARNING — wildcard "*" and credentials CANNOT be combined:
#   - Setting CORS_ORIGIN=* disables Access-Control-Allow-Credentials (cookies / auth headers
#     will NOT be forwarded by the browser).
#   - Never use CORS_ORIGIN=* in production for authenticated endpoints.
#   - Always use an explicit allowlist in production.
CORS_ORIGIN=http://localhost:3000

# Observability configuration
# Log level: trace, debug, info, warn, error, fatal (default "info")
LOG_LEVEL=info
# Log format: json or pretty (default "json")
LOG_FORMAT=json

# Starknet Sepolia RPC (v0_8)
STARKNET_RPC_URL=http://51.195.57.196:6062/v0_8

# No backend private key needed:
# users sign transactions client-side with their wallet/account.

# Deployed contract addresses (Sepolia)
PAYROLL_ESCROW_ADDRESS=0x06d3599196d6701a79eee56f8bba7a797431b100f6ab4df784514b14b04cb1d4
WORK_AGREEMENT_ADDRESS=0x067812025b96919b93ea9d63267522467d8b9fef1175a6cf9de84932b674dacd

# ABI sources - Contract class JSON file paths
#
# For LOCAL DEVELOPMENT (NODE_ENV=development):
# These files are located in the contracts/ directory
# You can use relative paths or leave these unset to use defaults:
ESCROW_CONTRACT_CLASS_JSON=./contracts/starknet_contracts_PayrollEscrow.contract_class.json
AGREEMENT_CONTRACT_CLASS_JSON=./contracts/starknet_contracts_WorkAgreement.contract_class.json
#
# For PRODUCTION (NODE_ENV=production):
# These paths MUST be explicitly set (absolute paths recommended)
# Example production paths:
# ESCROW_CONTRACT_CLASS_JSON=/app/contracts/starknet_contracts_PayrollEscrow.contract_class.json
# AGREEMENT_CONTRACT_CLASS_JSON=/app/contracts/starknet_contracts_WorkAgreement.contract_class.json
#
# NOTE: The application will fail to start in production if these paths are not set.

# Database configuration
# This must be set for startup; the app does not use a silent fallback DSN.
POSTGRES_CONNECTION_STRING=postgresql://postgres:postgres@localhost:5432/stellopay_indexer
# Optional pool tuning knobs
DB_POOL_MAX=10
DB_POOL_IDLE_TIMEOUT_MS=30000
DB_POOL_CONNECTION_TIMEOUT_MS=5000

# Token addresses (Starknet Sepolia)
TOKEN_STRK=0x04718f5a0fc34cc1af16a1cdee98ffb20c31f5cd61d6ab07201858f4287c938d
TOKEN_USDC=0x053b40a647cedfca6ca84f542a0fe36736031905a9639a7f19a3c1e66bfd5080
TOKEN_USDT=0x02ab8758891e84b968ff11361789070c6b1af2df618d6d2f4a78b0757573c6eb
# In-memory token metadata cache lifetime (milliseconds, default 300000 = 5 minutes)
TOKEN_METADATA_CACHE_TTL_MS=300000

# Email configuration for contact form (Gmail)
# For Gmail, you'll need to use an App Password: https://support.google.com/accounts/answer/185833
EMAIL_USER=your-email@gmail.com
EMAIL_PASSWORD=your-app-password
# Recipient address for contact-form submissions. Required to actually deliver
# contact emails; if unset, submissions are accepted in development and return
# 503 in production (no personal address is hardcoded in source).
CONTACT_RECIPIENT_EMAIL=team@stellopay.com

# Rate limiting configuration
# Global rate limit window (milliseconds, default 900000 = 15 minutes)
RATE_LIMIT_WINDOW_MS=900000
# Global rate limit max requests per window (default 100)
RATE_LIMIT_MAX=100
# Strict rate limit window for auth/contact endpoints (milliseconds, default 300000 = 5 minutes)
RATE_LIMIT_STRICT_WINDOW_MS=300000
# Strict rate limit max requests per window (default 10)
RATE_LIMIT_STRICT_MAX=10
# Contact form rate limit window (milliseconds, default 3600000 = 1 hour)
RATE_LIMIT_CONTACT_WINDOW_MS=3600000
# Contact form rate limit max requests per window (default 3)
RATE_LIMIT_CONTACT_MAX=3
# Trust proxy for correct client IP detection
# Set to number of proxies in front (e.g., 1 for single proxy/CDN) or "true" for direct connection
# Leave as "1" for most deployments behind a reverse proxy (nginx, Cloudflare, etc.)
TRUST_PROXY=1

# Session token lifetime in milliseconds (sliding expiry, default 86400000 = 24 hours)
SESSION_TTL_MS=86400000
# Maximum absolute session lifetime in milliseconds (default 604800000 = 7 days)
SESSION_MAX_TTL_MS=604800000

# Feature flag: billing profile API
# Set to "true" once the billing_profiles migration has been applied and the
# feature is ready to serve real data. When "false" (default) all /billing/*
# routes return 501 Not Implemented — no mock data is ever served.
BILLING_ENABLED=false

# Maximum allowed billing amount per request — default 1,000,000
# Requests exceeding this value are rejected with HTTP 400 before any
# business logic runs.
MAX_BILLING_AMOUNT=1000000

# Circuit Breaker configuration for Starknet RPC calls
# These settings control how the circuit breaker protects against unhealthy RPC endpoints
#
# Number of failures before circuit opens (default: 5)
CIRCUIT_BREAKER_FAILURE_THRESHOLD=5
# Number of consecutive successes needed to close circuit from HALF_OPEN (default: 2)
CIRCUIT_BREAKER_SUCCESS_THRESHOLD=2
# Cooldown period before attempting recovery (milliseconds, default: 30000 = 30 seconds)
CIRCUIT_BREAKER_COOLDOWN_MS=30000
# Rolling time window for counting failures (milliseconds, default: 60000 = 60 seconds)
CIRCUIT_BREAKER_WINDOW_MS=60000
# Graceful shutdown drain timeout in milliseconds (default 10000 = 10 seconds)
SHUTDOWN_DRAIN_TIMEOUT_MS=10000

# Comma-separated list of admin Starknet addresses
ADMIN_ADDRESSES=

# Indexed query response caching
# Cache-Control max-age for indexed read endpoints (seconds, default 12 ≈ one Starknet block).
# Increase in production to match your expected block time; set to 0 to disable caching.
INDEXED_CACHE_MAX_AGE_SECONDS=12

# Analytics aggregation in-process cache TTL (milliseconds, default 30000 = 30 s).
# Repeated identical requests to GET /analytics/:user_address within this window
# are served from the in-process cache without querying the database.
# - Lower values mean fresher data at the cost of more DB traffic.
# - Higher values reduce DB load but may serve data up to N ms stale.
# - The cache is keyed by (user_address, year) so different identities never
#   share cache entries.
ANALYTICS_CACHE_TTL_MS=30000