.env.example

NODE_ENV=development
PORT=4000
DATABASE_URL=postgresql://earnproof:earnproof@localhost:5432/earnproof
REDIS_URL=redis://localhost:6379

# Target for the PostgreSQL integration suite (npm run test:integration).
# Deliberately separate from DATABASE_URL, and refused unless the database name
# contains "test": the harness creates, truncates and drops databases derived
# from this name. The named database is never itself connected to — it supplies
# the prefix for <name>_template and <name>_w<worker>.
# See docs/integration-testing.md.
TEST_DATABASE_URL=postgresql://earnproof:earnproof@localhost:5432/earnproof_test
APP_URL=http://localhost:3000
API_URL=http://localhost:4000
STELLAR_NETWORK=testnet
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
STELLAR_NETWORK_PASSPHRASE=Test SDF Network ; September 2015
SESSION_SECRET=replace_me
# Optional cron expression for expired authentication-session cleanup.
# Defaults to midnight every day.
AUTH_SESSION_CLEANUP_CRON=0 0 * * *
# Optional cron expression for old challenge cleanup.
# Defaults to 2 AM every day.
AUTH_CHALLENGE_CLEANUP_CRON=0 2 * * *
# Optional cron expression for old auth audit event cleanup.
# Defaults to 3 AM every day.
AUTH_AUDIT_CLEANUP_CRON=0 3 * * *

# Authentication Rate Limits
# Configurable limits to prevent abuse of challenge creation and verification
# Limits are per hashed wallet identifier and hashed client metadata (no raw IP storage)
AUTH_RATE_LIMIT_MAX_CHALLENGE_CREATIONS=10
AUTH_RATE_LIMIT_CHALLENGE_CREATION_WINDOW_MS=900000
AUTH_RATE_LIMIT_MAX_VERIFICATIONS=5
AUTH_RATE_LIMIT_VERIFICATION_WINDOW_MS=900000
# Challenge retention: how long to keep used/expired challenges before cleanup
AUTH_CHALLENGE_RETENTION_DAYS=7
# Auth audit event retention: how long to keep auth audit events
AUTH_AUDIT_RETENTION_DAYS=90

CREDENTIAL_SIGNING_SECRET=replace_me
PAYMENT_ENCRYPTION_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=
CONTRACT_ANCHORING_ENABLED=false
CONTRACT_ANCHORING_REQUIRED=false
STELLAR_CLI_PATH=stellar
STELLAR_CLI_SOURCE=
PROOF_REGISTRY_CONTRACT_ID=
ISSUER_REGISTRY_ENABLED=false
ISSUER_REGISTRY_CONTRACT_ID=
EARNPROOF_ISSUER_ADDRESS=i
EARNPROOF_SCHEMA_VERSION=1

# Verification Event Privacy Configuration
# VERIFICATION_EVENT_RETENTION_DAYS: How long to retain privacy-safe verification events before deletion
# This controls the retention window for aggregate analytics on proof verification outcomes.
# All PII (IP, user agent, credentials) is redacted and replaced with non-identifying metadata hashes.
# Default: 90 days. Set to 0 to disable retention cleanup.
VERIFICATION_EVENT_RETENTION_DAYS=90

# Verification Event Hash Salt Rotation
# VERIFICATION_HASH_SALT_V*: Versioned salts for hashing verification metadata
# Salt rotates every 30 days (saltVersion = floor(daysSinceEpoch / 30))
# Different versions produce different hashes for same input, reducing long-term linkability
# Must be cryptographically strong random values (at least 32 characters)
# Configure multiple versions to support rolling salt rotation:
#   - VERIFICATION_HASH_SALT_V0=<old-salt>
#   - VERIFICATION_HASH_SALT_V1=<current-salt>
#   - VERIFICATION_HASH_SALT_V2=<next-salt>
# Example: VERIFICATION_HASH_SALT_V0=YourCryptographicallyRandomSaltV0xxx
VERIFICATION_HASH_SALT_V0=replace_me_with_cryptographic_random_value_32_chars_min

# ---------------------------------------------------------------------------
# Data retention
# ---------------------------------------------------------------------------
# Retention durations in days, per record class. See docs/data-retention.md for
# the full table: purpose, owner, and disposal behaviour for each class.
#
# Every class has a safe default, so leaving these unset never means "keep
# forever". An invalid or out-of-range value causes that class to fail rather
# than silently falling back to the default.
#
# Bounds: minimum 1 day, maximum 3650 days.
RETENTION_WALLET_CHALLENGE_DAYS=7
RETENTION_AUTH_SESSION_DAYS=30
RETENTION_WEBHOOK_DELIVERY_DAYS=30
RETENTION_AUDIT_LOG_DAYS=365
RETENTION_FAILED_ANCHORING_DAYS=90

# Cleanup schedule. Retention is measured in days, so running more often adds
# database contention without shortening anything.
RETENTION_CLEANUP_CRON=0 3 * * *

# Report what would be removed without deleting anything. Enable after changing
# a retention duration, read the counts, then disable.
RETENTION_DRY_RUN=false

# Proof credentials, revocation evidence, and anchoring state are preserved and
# have no override: they are never swept automatically. See docs/data-retention.md.