.env.example

# Veridex API — environment template (I-5). Copy to `.env` and fill in. NO REAL SECRETS here.
# Secrets are passed at run time (never baked into the image). D-1's Coolify stack maps these.

# --- Privy access-token auth boundary (POST /agents/deploy) ---------------------------------------
# Required in production (APP_ENV=production + AUTH_MODE=privy). The static SPKI/PEM ES256 key is
# copied from the Privy dashboard (no network/JWKS lookup).
PRIVY_APP_ID=
PRIVY_VERIFICATION_KEY=
# Deployment env gate: any value other than development/dev/test/local is treated as PRODUCTION
# (fail-closed), which HARD-REFUSES the AUTH_MODE=dev bypass and requires the two PRIVY_* values.
APP_ENV=development
# `privy` verifies a real Privy token on every deploy; `dev` is the local-dev bypass (refused in prod).
AUTH_MODE=dev

# --- Postgres (durable store) ---------------------------------------------------------------------
# Set to enable the durable PostgresStore. Set-but-UNREACHABLE fails closed at startup (never a
# silent InMemory fallback). Leave UNSET only for local-dev InMemory (state lost on restart).
DATABASE_URL=postgresql://user:password@host:5432/veridex
# Optional connection-pool tuning (psycopg_pool.AsyncConnectionPool).
DB_POOL_MIN_SIZE=1
DB_POOL_MAX_SIZE=10
# Startup reachability timeout (seconds): pool.wait raises past this ⇒ fail closed.
DB_CONNECT_TIMEOUT_S=10

# --- TxLINE (live odds feed / on-chain subscribe) -------------------------------------------------
# Guest-JWT + API token for the live TxLINE SSE feed (validated only when a live op is attempted).
JWT=
TXLINE_X_API_TOKEN=
# Program id for the on-chain subscribe() tx (secret-by-policy).
TXLINE_SUBSCRIBE_PROGRAM_ID=

# --- API serving (veridex.api.server) -------------------------------------------------------------
# REQUIRED to serve: comma-separated EXACT web origins allowed by CORS (no wildcard, no localhost
# default). A missing value refuses to start.
CORS_ORIGINS=https://your-web-app.example.com
# Bearer token required for control-plane writes (start non-paper / approve / kill-switch).
OPERATOR_TOKEN=
# Bind address / port for uvicorn (container binds all interfaces by default).
HOST=0.0.0.0
PORT=8000
# Persistent, MOUNTED spool dir for the I-4 WAL (must be a durable volume, not ephemeral disk).
WAL_DIR=/data/wal

# --- Web (apps/web, Next.js — NEXT_PUBLIC_* are exposed to the browser) ----------------------------
# Absolute API origin the web app fetches (REQUIRED for SSR — a relative URL cannot be fetched in
# Node; a missing value fails loud on the server). The Arena WS base is DERIVED from this by swapping
# the http(s) scheme for ws(s) (see hooks/useArenaStream.ts) — no separate WS env is read.
NEXT_PUBLIC_API_BASE=https://your-api.example.com

# --- D-1 Coolify compose stack (compose.coolify.yml) ----------------------------------------------
# ADDITIONAL keys the LOCAL/Coolify compose stack reads on top of the app vars above. LOCAL boot uses
# dummy values; in Coolify the operator sets real values (NEVER committed). Every secret is injected
# via a `${VAR:?...}` required-var guard in compose.coolify.yml, so a MISSING value FAILS the stack
# closed (never a silent localhost). REQUIRED (no safe default): DATABASE_URL, CORS_ORIGINS,
# OPERATOR_TOKEN, PRIVY_APP_ID, PRIVY_VERIFICATION_KEY (above) + POSTGRES_USER/POSTGRES_PASSWORD/
# POSTGRES_DB (below) + NEXT_PUBLIC_API_BASE (above).
#
# Postgres service credentials (bundled `postgres` service). DATABASE_URL above must point at the
# `postgres` service host, e.g. postgresql://<POSTGRES_USER>:<POSTGRES_PASSWORD>@postgres:5432/<POSTGRES_DB>
POSTGRES_USER=veridex
POSTGRES_PASSWORD=
POSTGRES_DB=veridex
# Curated ReplayPack seed catalog the /readyz check + demo/backtest surfaces resolve (mounted :ro).
REPLAY_PACK_ROOT=/var/lib/veridex/replay-packs/curated
# Host source dir bind-mounted at REPLAY_PACK_ROOT. Defaults to the pinned demo pack locally; the
# operator repoints this at the provisioned curated dir in production.
CURATED_PACKS_HOST=./scripts/fixtures/demo_pack_real
# Writable capture root the process rescans at startup (R-0b/R-2). MUST equal the compose
# `replay-capture` mount so a live-promoted pack survives a container restart (R-E durability).
REPLAY_CAPTURE_ROOT=/var/lib/veridex/replay-packs/capture
# Optional operator principal id (compared against a competition's operator_id for ownership).
OPERATOR_ID=
# Host ports published for the api / web services (Coolify/Traefik front public exposure in prod).
API_HOST_PORT=8000
WEB_HOST_PORT=3000