.env.example

# Example environment variables
PORT=3000
NODE_ENV=development

# CORS Configuration
# Comma-separated list of allowed origins for production
CORS_ALLOWED_ORIGINS=https://app.currentdao.com,https://www.currentdao.com

# Development-specific CORS origins (optional)
CORS_DEV_ORIGINS=http://localhost:4200,http://localhost:8080

# Staging-specific CORS origins (optional)
CORS_STAGING_ORIGINS=https://staging.currentdao.com

# Security Configuration
# API rate limiting (requests per minute)
RATE_LIMIT_TTL=60
RATE_LIMIT_MAX=100

# Advanced Rate Limiting Configuration
# Redis configuration for rate limiting
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=
REDIS_DB=0

# Rate limiting performance settings
RATE_LIMIT_SLIDING_WINDOW_SIZE=60000
RATE_LIMIT_MAX_REQUESTS_PER_SECOND=100000
RATE_LIMIT_PROCESSING_TIMEOUT_MS=1

# Tiered rate limits (requests per minute)
RATE_LIMIT_FREE_TIER=10
RATE_LIMIT_BASIC_TIER=30
RATE_LIMIT_PREMIUM_TIER=100
RATE_LIMIT_ENTERPRISE_TIER=500
RATE_LIMIT_ULTIMATE_TIER=1000

# DDoS protection settings
DDOS_DETECTION_WINDOW_MS=60000
DDOS_MAX_REQUESTS_PER_SECOND=100
DDOS_MAX_REQUESTS_PER_MINUTE=1000
DDOS_BLOCK_DURATION_MS=300000
DDOS_SUSPICIOUS_THRESHOLD=50
DDOS_PATTERN_DETECTION_ENABLED=true

# Rate limit monitoring and alerts
RATE_LIMIT_WARNING_THRESHOLD=80
RATE_LIMIT_CRITICAL_THRESHOLD=95
RATE_LIMIT_ANALYTICS_RETENTION_HOURS=24
RATE_LIMIT_CLEANUP_INTERVAL_MINUTES=5

# Burst capacity settings
BURST_CAPACITY_MULTIPLIER=2
BURST_WINDOW_MS=10000

# Custom endpoint limits
CUSTOM_ENDPOINT_LIMITS_ENABLED=true
MAX_CUSTOM_ENDPOINTS_FREE=0
MAX_CUSTOM_ENDPOINTS_BASIC=5
MAX_CUSTOM_ENDPOINTS_PREMIUM=20
MAX_CUSTOM_ENDPOINTS_ENTERPRISE=100
MAX_CUSTOM_ENDPOINTS_ULTIMATE=-1

# Session configuration
SESSION_SECRET=your-super-secret-session-key-change-in-production

# Helmet security (automatically configured based on NODE_ENV)
# HSTS max-age in seconds (default: 31536000 for production)
HSTS_MAX_AGE=31536000

# Content Security Policy report URI
CSP_REPORT_URI=/api/csp-report