.env.example

# ── Multi-Chain Sponsorship ───────────────────────────────────────────────
# EVM (EIP-4337 Paymaster)
EVM_PAYMASTER_ADDRESS=0x...
EVM_PAYMASTER_PRIVATE_KEY=your_private_key_here
EVM_RPC_URL=https://mainnet.infura.io/v3/your_project_id

# Solana (Fee Delegation)
SOLANA_FEE_PAYER_SECRET=your_base64_secret_here
SOLANA_RPC_URL=https://api.mainnet-beta.solana.com
SOLANA_NONCE_ACCOUNT=your_nonce_account_pubkey_here
# The chat ID to send alerts to (operator chat or group)
# Tip: message @userinfobot to get your chat ID
TELEGRAM_CHAT_ID=your_chat_id_here

# XLM balance threshold that triggers a low-balance alert (default: 10)
ALERT_LOW_BALANCE=10

# Base URL of your Fluid dashboard (used in inline button links)
DASHBOARD_URL=http://localhost:3000

# ── Chain Registry hot-reload (Phase 11 — Multi-Chain) ───────────────────────
# How often (ms) the server re-reads enabled chains from the database.
# Lower values give faster propagation; higher values reduce DB load.
# Default: 60000 (1 minute)
CHAIN_RELOAD_INTERVAL_MS=60000

# ── Intelligent Rate Limiting (Phase 10 — AI Features) ───────────────────────
# Enable/disable intelligent rate limit auto-adjustments
# Default: true
RATE_LIMIT_AUTO_ADJUST_ENABLED=true

# Minimum score threshold for automatic tier upgrades (0-100)
# Higher values make upgrades more selective
# Default: 80
RATE_LIMIT_UPGRADE_THRESHOLD=80

# Minimum violation-free days required for upgrade consideration
# Default: 14 days
RATE_LIMIT_MIN_VIOLATION_FREE_DAYS=14

# Daily scoring job schedule (cron expression)
# Default: "0 2 * * *" (2 AM UTC daily)
RATE_LIMIT_DAILY_SCHEDULE="0 2 * * *"

# ── PII Masking (Phase 12 — Compliance) ──────────────────────────────────────
# Enable/disable redaction of sensitive values in application logs
# Default: true
MASK_LOGS=true

# ── GDPR Tenant Erasure (Phase 12 — Compliance) ──────────────────────────────
# Number of days a tenant stays soft-deleted before permanent purge.
# Default: 30
GDPR_ERASURE_RETENTION_DAYS=30

# Enable or disable the scheduled purge worker.
# Default: true
GDPR_ERASURE_ENABLED=true

# Daily purge schedule for permanently erasing soft-deleted tenants.
# Default: "0 3 * * *" (3 AM server-local time)
GDPR_ERASURE_CRON_SCHEDULE="0 3 * * *"

# Email notifications for tier upgrades
# Configure SMTP settings for upgrade notifications
RATE_LIMIT_EMAIL_SMTP_HOST=smtp.gmail.com
RATE_LIMIT_EMAIL_SMTP_PORT=587
RATE_LIMIT_EMAIL_SMTP_SECURE=false
RATE_LIMIT_EMAIL_SMTP_USER=your_email@gmail.com
RATE_LIMIT_EMAIL_SMTP_PASS=your_app_password
RATE_LIMIT_EMAIL_FROM=noreply@yourdomain.com
RATE_LIMIT_EMAIL_FROM_NAME=Fluid Rate Limiting

# ── IP Access Control (Phase 12 — Compliance) ──────────────────────────────
# Comma-separated list of IPv4/IPv6 addresses or CIDR ranges.
# If IP_ALLOWLIST is provided, only requests from these IPs are permitted.
# Example: 192.168.1.0/24,10.0.0.5,2001:db8::/32
IP_ALLOWLIST=

# Comma-separated list of CIDR ranges or individual IP addresses to explicitly block.
IP_DENYLIST=

# How to trust proxy headers (like X-Forwarded-For).
# Set to 'true' if running behind a trusted reverse proxy (Nginx, LB, etc.)
# See: https://expressjs.com/en/guide/behind-proxies.html
TRUST_PROXY=false

# ── Multi-Region Active-Active (Phase 14 — Performance) ──────────────────────
# Logical region name for this instance.  Included in logs, metrics, and
# health responses so you can distinguish traffic from different regions.
# Example: us-east-1, eu-west-1
REGION_NAME=

# Redis connection string.  In a multi-region deployment each region has its
# own Redis cluster.  In local development this points to the docker-compose
# Redis container.
REDIS_URL=redis://localhost:6379

# ── Bloom Filter — blocklist address lookup (Phase 14 — Performance) ─────────
# Target false-positive rate for the Bloom filter used to pre-screen OFAC/blocklist
# addresses before hitting the in-memory Set.  Must be expressed as a decimal
# fraction.  Lower values consume more memory.  Default: 0.001 (0.1%)
BLOOM_FILTER_FP_RATE=0.001

# Minimum capacity seeded into the filter even when the blocklist is small.
# Default: 10000
BLOOM_FILTER_MIN_CAPACITY=10000

# OFAC SDN list refresh interval in milliseconds.  Default: 3600000 (1 hour)
OFAC_REFRESH_INTERVAL_MS=3600000

# Override the OFAC SDN CSV URL (useful for testing with a local fixture).
# Default: https://ofac.treasury.gov/downloads/sdn.csv
OFAC_SDN_URL=

# Comma-separated additional addresses to block regardless of the SDN list.
OFAC_BLOCKLIST=

# When true, allow transactions if the SDN list download fails.  Default: false
OFAC_SCREENING_FAIL_OPEN=false

# ── Circuit Breaker — Horizon downstream calls (Phase 14 — Performance) ─────
# Number of failures within the window required to trip the circuit breaker open.
# Default: 5
CIRCUIT_BREAKER_FAILURE_THRESHOLD=5

# Sliding window duration (ms) for counting failures.
# Default: 30000 (30 seconds)
CIRCUIT_BREAKER_WINDOW_MS=30000

# How long (ms) the breaker stays Open before attempting a Half-Open probe.
# Default: 10000 (10 seconds)
CIRCUIT_BREAKER_RECOVERY_TIMEOUT_MS=10000

# ── Database Read Replica (Phase 14 — Performance) ───────────────────────────
# Connection string for a PostgreSQL read replica (streaming or logical replication).
# When set, all heavy analytics/reporting SELECT queries are routed to this replica,
# offloading the primary database and reducing API latency under high write load.
# Falls back to DATABASE_URL when unset (development, staging without a replica).
# RDS read replica example:  postgresql://fluid:pass@replica.rds.amazonaws.com:5432/fluid_db
# Streaming replica example:  postgresql://fluid:pass@replica-host:5432/fluid_db?sslmode=require
DATABASE_REPLICA_URL=
# ── PgBouncer Connection Pooling (Phase 14 — Performance) ────────────────────
# When running the Node API behind PgBouncer, point DATABASE_URL at the pooler:
#
#   DATABASE_URL=postgresql://fluid:fluid_pass@pgbouncer:6432/fluid_db?pgbouncer=true
#
# The ?pgbouncer=true flag disables Prisma's prepared statements, which are
# incompatible with PgBouncer's transaction-mode pooling.
#
# For local development via docker-compose, PgBouncer exposes port 6432.
# For production (Vercel, ECS, etc.), use the PgBouncer host and port instead
# of the Postgres host. See server/docs/pgbouncer-deployment.md for details.
#
# PgBouncer admin credentials (used for SHOW POOLS; SHOW STATS; monitoring):
PGBOUNCER_ADMIN_USER=pgbouncer
PGBOUNCER_ADMIN_PASSWORD=pgbouncer_admin_pass
# ── CDN Edge Caching (Phase 14 — Performance) ────────────────────────────────
# Base URL of your CDN distribution (no trailing slash).
# When set, the admin-dashboard rewrites static asset and image URLs to load
# from the CDN edge, reducing dashboard load time by 80-90% for global users.
# Cloudflare example:  https://cdn.yourdomain.com
# CloudFront example:  https://d1234abcd.cloudfront.net
# Leave empty in local development.
NEXT_PUBLIC_CDN_URL=

# ── Horizontal Scaling (Phase 14 — Performance) ───────────────────────────────
# Set to 'true' to disable in-memory API-key and rate-limit fallbacks.
# When enabled, both the API key lookup and the GCRA leaky bucket use Redis
# exclusively. If Redis is unreachable the server returns 503 rather than
# falling back to per-instance in-memory state.
# Required when running more than one Node API replica behind a load balancer.
# Default: false
STATELESS_MODE=false

# Internal gRPC signer mTLS (Node API <-> Rust engine)
# Enable this by pointing the Node API at the Rust gRPC engine and providing
# a dedicated internal CA plus client certificate/key pair.
FLUID_GRPC_ENGINE_ADDRESS=127.0.0.1:50051
FLUID_GRPC_ENGINE_TLS_SERVER_NAME=fluid-grpc-engine.internal
FLUID_GRPC_ENGINE_CLIENT_CA_PATH=server/certs/dev/rootCA.pem
FLUID_GRPC_ENGINE_CLIENT_CERT_PATH=server/certs/dev/node-api.pem
FLUID_GRPC_ENGINE_CLIENT_KEY_PATH=server/certs/dev/node-api-key.pem
# Comma-separated SHA-256 fingerprints for the Rust engine server certificate.
# During rotation, include both the old and new fingerprints until all clients reconnect.
FLUID_GRPC_ENGINE_PINNED_SERVER_CERT_SHA256=

# Rust gRPC engine listener and mTLS trust settings.
FLUID_GRPC_ENGINE_LISTEN_ADDR=127.0.0.1:50051
FLUID_GRPC_ENGINE_TLS_CERT_PATH=server/certs/dev/rust-engine.pem
FLUID_GRPC_ENGINE_TLS_KEY_PATH=server/certs/dev/rust-engine-key.pem
FLUID_GRPC_ENGINE_TLS_CLIENT_CA_PATH=server/certs/dev/rootCA.pem
# Comma-separated SHA-256 fingerprints for allowed Node API client certificates.
# During rotation, include both current and next client fingerprints.
FLUID_GRPC_ENGINE_PINNED_CLIENT_CERT_SHA256=
# ── Nx Cloud Remote Caching (Phase 13 — Dev Experience) ──────────────────────
# Authentication token for Nx Cloud remote cache.
# Obtain from: https://cloud.nx.app → your workspace → Settings → Access Tokens
# Set as a GitHub Actions secret named NX_CLOUD_AUTH_TOKEN.
# When present, CI machines share build artifacts, dramatically reducing cold
# build times. Leave blank to fall back to local-only Nx cache.
NX_CLOUD_AUTH_TOKEN=your_nx_cloud_auth_token_here

# -- fluid-py SDK demo values --------------------------------------------------
# These values are used by fluid-py/examples/example_fee_bump.py.
# For issue #113 proof, run with mock server on localhost:3010.
FLUID_SERVER_URL=http://127.0.0.1:3010
STELLAR_NETWORK_PASSPHRASE=Test SDF Network ; September 2015
STELLAR_SOURCE_SECRET=SALKKNYYA3DQHZGGPDJKVSVMMQ6MYEZNGVUUGVNP6RSPYTNFX57EWGAO
STELLAR_DESTINATION=GDPVBHACK36UGXVKSWIGDNUZD3FQYZE6U63TGVYDMJTGEQYM6TAAKO6O
HORIZON_URL=https://horizon-testnet.stellar.org

# ── Security & Compliance (Phase 12) ─────────────────────────────────────────
# 32-byte base64 string for transparent data encryption (TDE) at rest
# In production, Fluid will refuse to start if this is missing.
# DATABASE_ENCRYPTION_KEY=

# Local Stellar Testnet (stellar/quickstart)
# Set STELLAR_ENV=local to use local Horizon (docker-compose up)
STELLAR_ENV=local

# Local Horizon URL - matches stellar-quickstart service port in docker-compose.yml
SANDBOX_HORIZON_URL=http://localhost:8000

# Friendbot for funding test accounts on local network
# GET $SANDBOX_HORIZON_URL/friendbot?addr=<PUBLIC_KEY>
FRIENDBOT_URL=http://localhost:8000/friendbot
# ── Hardware Security Module / KMS Integration (Phase 12) ────────────────────
# Select the provider for managed signer keys: 'local', 'aws-kms', or 'gcp-kms'
# Default: local
SIGNER_KMS_PROVIDER=local

# AWS KMS / CloudHSM Settings
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_KMS_KEY_ID=arn:aws:kms:us-east-1:123456789012:key/your-key-id-here

# Google Cloud KMS Settings
GCP_PROJECT_ID=your-gcp-project-id
GCP_KMS_LOCATION=global
GCP_KMS_KEY_RING=fluid-key-ring
GCP_KMS_CRYPTO_KEY=fluid-signer-key
GOOGLE_APPLICATION_CREDENTIALS=server/config/gcp-service-account.json

# ── M-of-N Signature for Sweeps (Phase 12) ───────────────────────────────────
# Number of required internal approvals/signatures (M) to authorize a treasury sweep.
# Default: 2
SWEEP_MIN_SIGNATURES=2

# Comma-separated list of authorized approver public keys or addresses (N).
SWEEP_APPROVER_PUBKEYS=
# ── Monthly Transparency Report (#256) ───────────────────────────────────────
# Postgres connection string used by the report generator script
REPORT_DATABASE_URL=

# Optional: base URL of a running Fluid server for Prometheus metrics fallback
REPORT_FLUID_METRICS_URL=http://localhost:3000

# Email delivery for report distribution (nodemailer)
REPORT_EMAIL_FROM=reports@example.com
REPORT_EMAIL_TO=subscriber1@example.com,subscriber2@example.com
REPORT_SMTP_HOST=smtp.example.com
REPORT_SMTP_PORT=587
REPORT_SMTP_USER=
REPORT_SMTP_PASS=