clips-backend/.env.example at main · devmocrea/clips-backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
DATABASE_URL="postgresql://postgres:password@localhost:5432/clipscash?schema=public"

# Encryption
# Secret key for encrypting sensitive data (bank account info, etc.)
# Generate a strong random string (min 32 characters)
# Example: openssl rand -base64 32
ENCRYPTION_SECRET="your_encryption_secret_min_32_chars"

# JWT
JWT_SECRET="your_jwt_secret"
JWT_EXPIRES=3600
JWT_REFRESH_EXPIRES_DAYS=14

# Google OAuth
GOOGLE_CLIENT_ID="your_google_client_id"
GOOGLE_CLIENT_SECRET="your_google_client_secret"
GOOGLE_CALLBACK_URL="http://localhost:3000/auth/google/callback"

# Magic link / Email (SMTP)
APP_BASE_URL="http://localhost:3000"
SMTP_HOST="smtp.ethereal.email"
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER="your_smtp_user"
SMTP_PASS="your_smtp_pass"
SMTP_FROM='"Clips App" <noreply@clips.app>'

# CORS
ALLOWED_ORIGINS="http://localhost:3000,http://localhost:3001"

# Redis Configuration
REDIS_HOST="localhost"
REDIS_PORT=6379
REDIS_PASSWORD=""

# BullMQ Worker Configuration
# Controls how many jobs each queue processes concurrently
# Higher values = more parallel processing but more CPU/memory usage
# Recommended values by environment:
#   Development: 1-2 (easier debugging, lower resource usage)
#   Staging: 2-4 (balance between testing and resources)
#   Production: 5-10 (maximize throughput, adjust based on server capacity)

# Clip generation worker concurrency (video processing is CPU-intensive)
BULLMQ_CLIP_GENERATION_CONCURRENCY=2

# Email delivery worker concurrency (I/O-bound, can handle more)
BULLMQ_EMAIL_DELIVERY_CONCURRENCY=5

# Brute Force Protection
BRUTE_FORCE_MAX_ATTEMPTS=5
BRUTE_FORCE_LOCKOUT_DURATION=900
BRUTE_FORCE_WINDOW_DURATION=900

 # Rate Limiting
 # Comma-separated list of IP addresses to bypass rate limiting
 THROTTLER_WHITELIST=127.0.0.1,::1

# JWT Cookie Settings
# Set to 'true' to use httpOnly cookies instead of returning tokens in the response body.
# COOKIE_SECURE: set to 'false' only in local HTTP dev environments (defaults to true)
# COOKIE_SAME_SITE: 'lax' (recommended), 'strict', or 'none' (requires COOKIE_SECURE=true)
COOKIE_SECURE=true
COOKIE_SAME_SITE=lax

# Stellar Network
# Set to 'testnet' for development/staging or 'public' for mainnet.
# Defaults to 'testnet' if not set.
STELLAR_NETWORK=testnet

# Payout limits (per currency). Use either PAYOUT_LIMITS JSON or MIN/MAX_PAYOUT_{CURRENCY}.
# PAYOUT_LIMITS={"USD":{"min":5,"max":10000},"EUR":{"min":8,"max":5000}}
MIN_PAYOUT_USD=5
MAX_PAYOUT_USD=10000
# Legacy alias for MIN_PAYOUT_USD
MIN_STELLAR_PAYOUT=5

# Stellar NFT Royalties
PLATFORM_ROYALTY_BPS=100
PLATFORM_WALLET_ADDRESS="GDV76E6XN6A3Q3WXVZ4KPRQ7L6E6XN6A3Q3WXVZ4KPRQ7L6E6XN6"

# Soroban NFT Contract (REQUIRED)
# This contract implements NFT minting with royalty payments and platform fee tracking.
# The contract maintains a persistent 'total_platform_fees' variable that accumulates
# all platform fees (5% of each sale) from royalty payments.
# Query platform revenue via: GET /platform/revenue (public endpoint)
# DO NOT use placeholder values in production - the app will fail fast if this is missing
SOROBAN_NFT_CONTRACT_ID="your_soroban_nft_contract_id"

# IPFS / Pinata (required for NFT metadata upload)
PINATA_JWT="your_pinata_jwt_token"
# IPFS_API_URL="https://api.pinata.cloud/pinning/pinJSONToIPFS"  # default

# Leaderboard
# Set to 'true' to enable the public earnings leaderboard endpoint.
LEADERBOARD_ENABLED=false

# Webhook Security (required for Stellar payment webhooks)
# HMAC-SHA256 secret used to verify incoming webhook signatures
# This must match the secret configured in your Stellar webhook provider
WEBHOOK_SECRET="your_webhook_secret_min_32_chars_long"

# Platform Webhook Secrets
# Secrets for validating TikTok and YouTube webhooks
TIKTOK_WEBHOOK_SECRET="your_tiktok_webhook_secret"
YOUTUBE_WEBHOOK_SECRET="your_youtube_webhook_secret"

# Admin Configuration
# Comma-separated list of admin email addresses for anomaly notifications
ADMIN_EMAILS="admin@example.com,admin2@example.com"

# Anomaly Detection Configuration
# Threshold multiplier for detecting earnings anomalies (default: 3)
ANOMALY_THRESHOLD_MULTIPLIER=3
# Minimum earnings amount required for anomaly analysis (default: 10)
MIN_EARNINGS_FOR_ANALYSIS=10
# Lookback period in days for earnings history analysis (default: 30)
ANOMALY_LOOKBACK_DAYS=30