feat: enable automated RDS and Redis credential rotation

Author: madisonsc52-del

backend/.env.example

@@ -43,10 +43,28 @@ PGUSER=
 PGPASSWORD=
 # PostgreSQL database name | string | # Optional (default: empty)
 PGDATABASE=
+# AWS Secrets Manager ARN for RDS credentials; overrides static PG* credentials after hydration | ARN | # Optional (default: empty)
+DB_SECRET_ARN=
+# Alias for DB_SECRET_ARN | ARN | # Optional (default: empty)
+DATABASE_SECRET_ARN=
+# Alias for DB_SECRET_ARN | ARN | # Optional (default: empty)
+PG_SECRET_ARN=
+# Database secret refresh TTL | integer milliseconds | # Optional (default: 300000)
+DB_SECRET_CACHE_TTL_MS=300000
+# AWS region used by the Secrets Manager client in AWS/ECS deployments | AWS region | # Optional (default: SDK chain)
+AWS_REGION=
+# Alias region variable recognized by the AWS SDK | AWS region | # Optional (default: SDK chain)
+AWS_DEFAULT_REGION=
 # Maximum number of connections in the PostgreSQL pool | integer | # Optional (default: 10)
 DB_POOL_SIZE=10
 # CI marker used by tooling and env validation checks | string | # Optional (default: empty)
 CI=
+# Vitest runtime marker used by test-only Redis mocks | boolean | # Optional (default: empty)
+VITEST=
+# Public application URL used in notification links | URL | # Optional (default: empty)
+APP_URL=
+# Public API URL used in notification links | URL | # Optional (default: empty)
+API_URL=
 # SQLite database file path for local/test usage | filesystem path | # Optional (default: ./data/portfolio.db)
 DB_PATH=./data/portfolio.db
 
@@ -59,6 +77,10 @@ REFLECTOR_API_URL=
 PRICE_CACHE_DURATION=300000
 # Minimum interval between upstream price fetches | integer milliseconds | # Optional (default: 90000)
 MIN_REQUEST_INTERVAL=90000
+# Redis-backed oracle cache TTL | integer seconds | # Optional (default: 30)
+ORACLE_CACHE_TTL_SECONDS=30
+# Issuer metadata cache TTL | integer milliseconds | # Optional (default: 21600000)
+ISSUER_METADATA_TTL_MS=21600000
 
 # --- Auto-rebalancer ---
 # Enables queue-backed automatic rebalance checks | boolean | # Optional (default: false)
@@ -85,12 +107,24 @@ RATE_LIMIT_CRITICAL_MAX=3
 RATE_LIMIT_BURST_WINDOW_MS=10000
 # Max global requests in burst window | integer | # Optional (default: 20)
 RATE_LIMIT_BURST_MAX=20
+# Alias for RATE_LIMIT_MAX | integer | # Optional (default: 100)
+RATE_LIMIT_GLOBAL_MAX=100
+# Alias for RATE_LIMIT_WINDOW_MS | integer milliseconds | # Optional (default: 900000)
+RATE_LIMIT_GLOBAL_WINDOW_MS=900000
 # Max write requests in burst window | integer | # Optional (default: 3)
 RATE_LIMIT_WRITE_BURST_MAX=3
 
 # --- Queue and caching ---
 # Redis URL for BullMQ queues/workers | URL | # Optional (default: redis://localhost:6379)
 REDIS_URL=redis://localhost:6379
+# AWS Secrets Manager ARN for Redis endpoint/AUTH token JSON; dynamically builds REDIS_URL | ARN | # Optional (default: empty)
+REDIS_SECRET_ARN=
+# Alias for REDIS_SECRET_ARN | ARN | # Optional (default: empty)
+REDIS_AUTH_SECRET_ARN=
+# Redis secret refresh TTL | integer milliseconds | # Optional (default: 300000)
+REDIS_SECRET_CACHE_TTL_MS=300000
+# Redis availability probe cache TTL | integer milliseconds | # Optional (default: 30000)
+REDIS_AVAILABILITY_CACHE_TTL_MS=30000
 # Toggle in-memory portfolio cache for experiments | boolean | # Optional (default: false)
 USE_MEMORY_CACHE=false
 
@@ -133,6 +167,10 @@ SMTP_USER=your-email@gmail.com
 SMTP_PASS=your-app-password
 # Default sender email for notifications | email | # Optional (default: noreply@stellarportfolio.com)
 SMTP_FROM=noreply@stellarportfolio.com
+# Secret used to sign unsubscribe tokens | string | # Optional (default: SMTP_PASS fallback)
+UNSUBSCRIBE_SECRET=
+# Telegram bot token for notification delivery | string | # Optional (default: empty)
+TELEGRAM_BOT_TOKEN=
 # Comma-separated admin signer addresses for privileged routes | CSV of Stellar public keys | # Optional (default: empty)
 ADMIN_PUBLIC_KEYS=
 # Outbound webhook request timeout | integer milliseconds | # Optional (default: 5000)
@@ -195,6 +233,8 @@ RISK_CONCENTRATION_CRITICAL=80
 RISK_LIQUIDITY_LOW=1000
 # Critical-liquidity threshold | decimal USD | # Optional (default: 500)
 RISK_LIQUIDITY_CRITICAL=500
+# Base fee assumption for rebalance dry-run estimates | integer stroops | # Optional (default: 100)
+REBALANCE_DRY_RUN_BASE_FEE_STROOPS=100
 
 # --- Analytics ---
 # Background snapshot interval per portfolio | integer milliseconds | # Optional (default: 300000)
@@ -211,6 +251,8 @@ CONSENT_AUDIT_RETENTION_DAYS=365
 JWT_SECRET=
 # Access token expiry | integer seconds | # Optional (default: 900)
 JWT_ACCESS_EXPIRY_SEC=900
+# Allowed JWT clock skew | integer seconds | # Optional (default: 0)
+JWT_CLOCK_SKEW_SEC=0
 # Refresh token expiry | integer seconds | # Optional (default: 604800)
 JWT_REFRESH_EXPIRY_SEC=604800
 # Previous JWT secret used during key rotation grace period | string | # Optional (default: empty)
@@ -221,6 +263,8 @@ JWT_PREVIOUS_SECRET_GRACE_UNTIL=
 API_RATE_LIMIT_WINDOW=900000
 # API-level rate-limit max requests in window | integer | # Optional (default: 100)
 API_RATE_LIMIT_MAX_REQUESTS=100
+# Shared secret for trusted health/readiness probes | string | # Optional (default: empty)
+HEALTH_PROBE_SECRET=
 # Request timeout for outbound/internal operations | integer milliseconds | # Optional (default: 30000)
 REQUEST_TIMEOUT=30000
 # Enable request schema validation | boolean | # Optional (default: true)
@@ -263,11 +307,6 @@ SOROBAN_EVENT_INDEXER_MAX_PAGES=10
 # Declared contract event schema version to enforce compatibility | integer | # Optional (default: 1)
 CONTRACT_EVENT_SCHEMA_VERSION=1
 
-# --- Consent and readiness cache ---
-# Retention window for consent audit records | integer days | # Optional (default: 365)
-CONSENT_AUDIT_RETENTION_DAYS=365
-# Cache TTL for readiness checks | integer milliseconds | # Optional (default: 2000)
-READINESS_CACHE_TTL_MS=2000
 
 # --- Observability ---
 # Enable OpenTelemetry tracing | boolean | # Optional (default: false)