.env.example

# LiquiFact API Environment Variables
# Copy to .env and fill required values

# App environment (required)
NODE_ENV=development
PORT=3001
# Helmet config
HELMET_CSP=false
# JWT secret (required, min 32 chars, generate securely)
JWT_SECRET=your-super-secure-jwt-secret-key-at-least-32-chars-long-here

# CORS origins (optional, comma-separated)
# CORS_ALLOWED_ORIGINS=https://yourapp.com,http://localhost:3000

# Optional Sentry observability
# SENTRY_DSN=https://publickey@o123456.ingest.sentry.io/67890
# SENTRY_RELEASE=liquifact-backend@1.0.0
# SENTRY_ENVIRONMENT=production

# Cache
ESCROW_CACHE_TTL_SECONDS=30
REDIS_ESCROW_CACHE_ENABLED=false
# REDIS_URL=redis://localhost:6379
# Strict TTL for cached escrow summaries. Value is clamped to [5, 300].
REDIS_ESCROW_CACHE_TTL_SECONDS=30
# Invalidate cached summary when |currentLedger - cachedLedger| exceeds this threshold.
REDIS_ESCROW_LEDGER_GAP_THRESHOLD=3

# Body Size Limits (optional)
# BODY_LIMIT_JSON=100kb
# BODY_LIMIT_URLENCODED=50kb
# BODY_LIMIT_RAW=1mb
# BODY_LIMIT_INVOICE=512kb

# Soroban escrow funding submission stub
# Defaults to delegated mode; live signing/submission is disabled in code.
ESCROW_SIGNING_MODE=delegated
SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
STELLAR_NETWORK_PASSPHRASE="Test SDF Network ; September 2015"
# LIQUIFACT_ESCROW_CONTRACT_ID=C...

# Custodial signing references only. Never store raw Stellar secret keys here.
ESCROW_CUSTODIAL_SIGNING_ENABLED=false
# ESCROW_CUSTODIAL_KMS_PROVIDER=aws-kms
# ESCROW_CUSTODIAL_KEY_ID=liquifact/escrow/fund/v1
# ESCROW_DOCUMENT_CUSTODIAL_KEY_ID=liquifact/docs/custody/v1

# DB (when added)
# DATABASE_URL=postgresql://user:pass@localhost:5432/liquifact

# -------------------------
# Prometheus Metrics Auth  |
# -------------------------
# Static bearer token required to scrape GET /metrics.
# If unset, only loopback (127.0.0.1, ::1) is allowed — suitable for
# private-network Prometheus scrapers. In production always set this.
# Generate with: openssl rand -hex 32
# METRICS_BEARER_TOKEN=replace-with-a-long-random-secret

# --------------------
# JWT Authentication |
# --------------------
# Secret used to sign and verify JSON Web Tokens.
# Must be a long, random string in production. Defaults to "test-secret" locally.
# JWT_SECRET=replace-with-a-long-random-secret

# ------------------------
# API Key Authentication |
# ------------------------
# Semicolon-separated list of API key entries, each a JSON object.
# Schema per entry:
#   key       (string, required) — must start with "lf_", min 10 chars
#   clientId  (string, required) — unique identifier for the service client
#   scopes    (array,  required) — non-empty list from: invoices:read, invoices:write, escrow:read
#   revoked   (bool,   optional) — set to true to disable the key without removing it
#
# Example (two entries — one active, one revoked):
# API_KEYS={"key":"lf_prod_service_a_key","clientId":"billing-service","scopes":["invoices:read","invoices:write"]};{"key":"lf_old_service_b_key","clientId":"legacy-service","scopes":["invoices:read"],"revoked":true}
#
# Key rotation: add the new key entry, deploy, then set "revoked": true on the
# old entry and redeploy. The old key is rejected immediately; the new key works
# from the first deploy.
# API_KEYS=

# --------------------
# Rate Limiting |
# --------------------
# Per-IP and per-API key rate limiting for public endpoints.
# Global limiter settings:
# RATE_LIMIT_WINDOW_MS=900000          # Time window in ms (default: 15 min = 900000)
# RATE_LIMIT_MAX_REQUESTS=100          # Max requests per window (default: 100)
# Sensitive endpoints (invoices, escrow):
# RATE_LIMIT_SENSITIVE_WINDOW_MS=3600000  # Time window in ms (default: 1 hour = 3600000)
# RATE_LIMIT_SENSITIVE_MAX=40           # Max requests per window (default: 40)
# API key specific limits:
# RATE_LIMIT_API_KEY_WINDOW_MS=900000   # Time window in ms (default: 15 min = 900000)
# RATE_LIMIT_API_KEY_MAX=1000          # Max requests per window (default: 1000)