forked from determined-001/Quay
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
169 lines (151 loc) · 8.34 KB
/
Copy path.env.example
File metadata and controls
169 lines (151 loc) · 8.34 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
# ---- API ----
# Stellar network: "testnet" or "public"
STELLAR_NETWORK=testnet
# Horizon endpoint (override if self-hosting). Defaults per network if unset.
# HORIZON_URL=https://horizon-testnet.stellar.org
# Optional standby Horizon endpoint. The watcher switches to it after several
# consecutive failures on the primary (see docs/API.md#get-health), and back
# on the next successful call.
# HORIZON_URL_FALLBACK=
# Consecutive Horizon failures (after retries) before /health reports degraded
# and (if HORIZON_URL_FALLBACK is set) the watcher switches to it.
# HORIZON_DEGRADED_THRESHOLD=3
# USDC asset issuer for the selected network.
# IMPORTANT: verify the current Circle USDC issuer for your network before going live.
# Testnet USDC issuer (Circle test issuer) — VERIFY before relying on it:
USDC_ISSUER_TESTNET=GBBD47IF6LWK7P7MDEVSCWR7DPUWV3NY3DTQEVFL4NAT4AQH3ZLLFLA5
# Public/mainnet USDC issuer (Circle):
USDC_ISSUER_PUBLIC=GA5ZSEJYB37JRC5AVCIA5MOP4RHTM335X2KGX3IHOJAPP5RE34K4KZVN
# Ledger poll interval (ms), used when WATCH_MODE=poll
WATCH_POLL_MS=6000
# Horizon page size per fetch, and how many pages the watcher will drain per
# account in a single tick before the rest waits for the next poll (issue
# 2.2). If WATCH_MAX_PAGES_PER_TICK is routinely maxed out (watch the logs
# for "hit maxPagesPerTick"), that's the signal to move to a streaming
# watcher (issue 2.1), not to keep raising this.
# WATCH_PAGE_LIMIT=200
# WATCH_MAX_PAGES_PER_TICK=10
# "poll" (default) or "stream" (Horizon SSE payments feed; opt-in until proven)
WATCH_MODE=poll
# "memo" (default) or "muxed" (SEP-23 M-address correlation; no memo needed,
# but some older wallets refuse M... destinations — opt-in until measured)
CORRELATION=memo
# libSQL / SQLite file (local dev). Swap for a Turso/Postgres URL in prod.
DATABASE_URL=file:./local.db
API_PORT=8787
# Comma-separated allowed CORS origins for the web app
CORS_ORIGINS=http://localhost:3000
# Per-IP fixed-window rate limit. Set RATE_LIMIT_MAX=0 to disable.
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_MAX=120
# Log verbosity: trace|debug|info|warn|error|fatal. Default "info".
# Logs are emitted as JSON lines on stdout for grep/jq on Render.
LOG_LEVEL=info
# Off-ramp adapter: "mock" (default, offline-safe, fake FX rates) or "testanchor"
# (real SEP-10 + SEP-38 + SEP-6 flow against https://testanchor.stellar.org).
# Off-ramp adapter:
# mock - offline simulation. Settles itself after 8s and pays out
# nothing. Refused outright when STELLAR_NETWORK=public.
# testanchor - real SEP-10/12/38/6 flow against the SDF testnet sandbox at
# https://testanchor.stellar.org. Also refused on public.
# anchor - the same adapter pointed at a production anchor. Requires
# ANCHOR_URL and ANCHOR_HOME_DOMAIN below. This is the only
# valid setting on mainnet.
OFFRAMP=mock
# Required when OFFRAMP=anchor. There is deliberately no default: a default
# would mean "the testnet sandbox", which on mainnet settles nothing.
# ANCHOR_URL must be https:// on public network.
# ANCHOR_URL=https://anchor.example.com
# ANCHOR_HOME_DOMAIN=anchor.example.com
# Preferred SEP-6 withdrawal type (e.g. bank_account). Leave unset and the
# adapter reads /sep6/info and uses the single enabled type, or refuses with
# the list when the anchor offers more than one.
# OFFRAMP_TYPE=bank_account
# The secret key matching DEFAULT_SELLER_WALLET. Required whenever a real
# anchor is configured (SEP-10 needs the seller's secret key to sign the auth
# challenge), AND required by `pnpm demo:seed` / `pnpm demo:reset` so the demo
# scripts can log in as the configured demo seller (all /links routes are
# seller-authenticated since #79). Leave unset on testnet with no
# DEFAULT_SELLER_WALLET to use the auto-generated keypair.
# DEFAULT_SELLER_SECRET=
# Required whenever OFFRAMP is not "mock": AES-256-GCM key (32 bytes, hex) encrypting
# the seller's SEP-12 KYC field values at rest. Generate with:
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# KYC_ENCRYPTION_KEY=
# Optional: Turso auth token. Unused for local file: DATABASE_URL.
# DATABASE_AUTH_TOKEN=
# AES-256-GCM key (32 bytes) used to encrypt webhook signing secrets at rest.
# 64 hex chars, or base64 of 32 bytes. Generate with:
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# Required in production; falls back to an insecure fixed dev key if unset
# elsewhere (a warning is logged).
# WEBHOOK_SECRET_ENCRYPTION_KEY=
# ---- Backups (pnpm db:backup / pnpm db:restore - see docs/RUNBOOK.md) ----
# Required. 64-char hex (32 bytes) AES-256-GCM key. Generate with:
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# BACKUP_ENCRYPTION_KEY=
# Optional. PUT target for the encrypted dump (e.g. a presigned S3/R2/B2 URL).
# Unset means the backup is written locally only - never silently "uploaded".
# BACKUP_UPLOAD_URL=
# Optional. A single "Name: value" header added to the upload PUT, e.g. an
# auth token for a non-presigned endpoint.
# BACKUP_UPLOAD_AUTH_HEADER=
# Where local backup files are written. Defaults to ./backups.
# BACKUP_OUT_DIR=backups
# How many days of local backup files to keep. Defaults to 30.
# BACKUP_RETENTION_DAYS=30
# Bearer token required to read GET /metrics (Authorization: Bearer <token>, or
# ?token=). Auto-generates an ephemeral one (printed once at boot) if unset —
# set this explicitly to scrape metrics across restarts.
# METRICS_TOKEN=
# Bearer token gating the operator-only off-ramp telemetry endpoints
# (GET /telemetry/summary and /telemetry/export.csv). When unset the routes
# return 404 — an unconfigured dataset is not advertised.
# TELEMETRY_TOKEN=
# ---- Wallet-native login (SEP-10 server) ----
# Domain this service identifies as in SEP-10 challenges + stellar.toml. Must
# match where the API is actually reachable in production.
# Derived automatically from the platform (Render sets RENDER_EXTERNAL_HOSTNAME).
# Set this ONLY when a custom domain or proxy sits in front, so the host wallets
# fetch stellar.toml from differs from the host the platform knows about.
# HOME_DOMAIN=
# Defaults to HOME_DOMAIN if unset.
# WEB_AUTH_DOMAIN=localhost:8787
# Secret key of the server's SEP-10 signing identity (distinct from any seller
# wallet). Auto-generates a throwaway testnet keypair if unset. REQUIRED on
# public network — a login server's signing key must be stable across restarts.
# SERVER_SIGNING_SECRET=
# Symmetric secret for session JWTs minted after a SEP-10 login. Auto-generates
# an ephemeral one on testnet if unset (sessions won't survive a restart).
# REQUIRED on public network.
# JWT_SECRET=
# Whether the session cookie gets `Secure` (HTTPS-only). Defaults on. Set to
# "false" for plain-http local dev, where a Secure cookie is otherwise silently
# never sent at all.
# COOKIE_SECURE=true
# ---- On-chain settlement attestation (optional) ----
# Deployed `quay-attest` contract id — see contracts/README.md. Leave unset and
# settlements are simply never attested; receipts say so rather than pretending.
# The attester is the SERVER_SIGNING_SECRET identity above, which MUST be funded
# to pay invocation fees. An unfunded attester fails attestation only — it never
# affects settlement, which is proven by the classic ledger.
# ATTESTATION_CONTRACT_ID=CD6AFLZTNUKC6CWXWLAVOEH3FY4ZN47SVX6DPYQBZBTPBBSN6LEFIFZ3
# Soroban RPC. Defaults to https://soroban-testnet.stellar.org on testnet; must
# be set explicitly on public network.
# SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
# How often to retry links that settled while the registry was unreachable.
# ATTESTATION_SWEEP_MS=60000
# ---- Web ----
# MUST match the API's STELLAR_NETWORK. The browser signs with the passphrase
# this selects, so a mismatch means every wallet signature is rejected by the
# network the API is actually watching — with no error that names the cause.
NEXT_PUBLIC_STELLAR_NETWORK=testnet
NEXT_PUBLIC_API_URL=http://localhost:8787
API_URL=http://localhost:8787
# Target currency for the "Cash out" button. testanchor's SEP-38 sandbox only
# quotes USDC against USD/CAD, so set this to USD when OFFRAMP=testanchor.
NEXT_PUBLIC_OFFRAMP_CURRENCY=NGN
# Mirrors the API's OFFRAMP setting so the dashboard can label the cash-out
# button honestly. Keep these two in sync when you change OFFRAMP above.
NEXT_PUBLIC_OFFRAMP_MODE=mock
# For a full mainnet configuration, see .env.public.example and docs/MAINNET.md.