backend-core-kit/env.example at main · fikrilal/backend-core-kit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
# Copy to `.env` for local development.
#
# Notes:
# - Never commit `.env`.
# - `NODE_ENV=staging|production` requires DATABASE_URL, REDIS_URL, AUTH_*, OTEL_* (validated at startup).

# Runtime
NODE_ENV=development
HOST=127.0.0.1
PORT=4000
WORKER_HOST=127.0.0.1
WORKER_PORT=4001
SWAGGER_UI_ENABLED=true
# HTTP / proxies
# If running behind a reverse proxy/load balancer, set this to `true` so `req.ip` reflects the
# client IP from `X-Forwarded-For`. Only enable when traffic is guaranteed to come through trusted
# proxies; otherwise clients can spoof `X-Forwarded-*` headers.
#
# Required in staging/production (validated at startup).
HTTP_TRUST_PROXY=false
# HTTP reliability defaults (can be overridden per environment)
# Max time to receive the full request from client (protects against slowloris-style abuse)
HTTP_REQUEST_TIMEOUT_MS=30000
# Node server socket timeout for idle/incomplete connections
HTTP_CONNECTION_TIMEOUT_MS=10000
# Keep-alive timeout for persistent HTTP/1.1 connections
HTTP_KEEP_ALIVE_TIMEOUT_MS=72000
# Max request payload size in bytes (default: 1 MiB)
HTTP_BODY_LIMIT_BYTES=1048576
# Max plugin boot time before startup fails
HTTP_PLUGIN_TIMEOUT_MS=10000

# Database (required in staging/production)
DATABASE_URL=postgresql://postgres@127.0.0.1:54321/backend_core_kit?schema=public
# When `NODE_ENV=staging|production`, the app enables Postgres TLS by default. Some providers
# (e.g. Heroku Postgres) use a certificate chain that isn't in Node's default trust store.
# Set this to `false` to allow the TLS connection.
DATABASE_SSL_REJECT_UNAUTHORIZED=true

# Redis / BullMQ (required in staging/production)
REDIS_URL=redis://127.0.0.1:63790/0
# If you use `rediss://` (TLS) with a provider that has a self-signed chain (e.g. Heroku Redis),
# set this to `false` to allow the connection.
REDIS_TLS_REJECT_UNAUTHORIZED=true
# Redis reliability defaults (applies to platform Redis client and queue connections)
REDIS_CONNECT_TIMEOUT_MS=10000
REDIS_COMMAND_TIMEOUT_MS=5000
REDIS_MAX_RETRIES_PER_REQUEST=2
REDIS_RETRY_BASE_DELAY_MS=100
REDIS_RETRY_MAX_DELAY_MS=2000
# When false, commands fail fast while disconnected instead of queuing until reconnect.
REDIS_ENABLE_OFFLINE_QUEUE=true

# Auth (OIDC + first-party session tokens)
# Placeholders; values depend on your IdP and chosen issuer/audience strategy.
AUTH_ISSUER=https://api.example.com
AUTH_AUDIENCE=api.example.com
AUTH_ACCESS_TOKEN_TTL_SECONDS=900
AUTH_REFRESH_TOKEN_TTL_SECONDS=2592000
AUTH_EMAIL_VERIFICATION_TOKEN_TTL_SECONDS=86400
AUTH_EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS=60
# Email verification resend rate limit (by IP)
AUTH_EMAIL_VERIFICATION_RESEND_IP_MAX_ATTEMPTS=30
AUTH_EMAIL_VERIFICATION_RESEND_IP_WINDOW_SECONDS=300
AUTH_EMAIL_VERIFICATION_RESEND_IP_BLOCK_SECONDS=900
AUTH_PASSWORD_RESET_TOKEN_TTL_SECONDS=1800
AUTH_PASSWORD_RESET_REQUEST_COOLDOWN_SECONDS=60
# Password reset request rate limit (by IP)
AUTH_PASSWORD_RESET_REQUEST_IP_MAX_ATTEMPTS=20
AUTH_PASSWORD_RESET_REQUEST_IP_WINDOW_SECONDS=300
AUTH_PASSWORD_RESET_REQUEST_IP_BLOCK_SECONDS=900
AUTH_PASSWORD_MIN_LENGTH=10
# Login backoff (Redis-based). Tune per project risk profile.
AUTH_LOGIN_MAX_ATTEMPTS=10
AUTH_LOGIN_WINDOW_SECONDS=60
AUTH_LOGIN_BLOCK_SECONDS=900
AUTH_JWT_ALG=EdDSA
# Private JWK set JSON (current + previous keys) used for signing access tokens (never commit real keys).
AUTH_SIGNING_KEYS_JSON=[]
# Alternative (CI/Heroku-friendly): base64-encoded AUTH_SIGNING_KEYS_JSON to avoid quoting/newline issues.
AUTH_SIGNING_KEYS_JSON_BASE64=
# Google OIDC: comma-separated list of allowed client IDs (Android/iOS/Web).
AUTH_OIDC_GOOGLE_CLIENT_IDS=

# Public client URLs
PUBLIC_APP_URL=http://localhost:3000

# Users profile image upload rate limiting
USERS_PROFILE_IMAGE_UPLOAD_USER_MAX_ATTEMPTS=20
USERS_PROFILE_IMAGE_UPLOAD_USER_WINDOW_SECONDS=3600
USERS_PROFILE_IMAGE_UPLOAD_USER_BLOCK_SECONDS=900
USERS_PROFILE_IMAGE_UPLOAD_IP_MAX_ATTEMPTS=60
USERS_PROFILE_IMAGE_UPLOAD_IP_WINDOW_SECONDS=300
USERS_PROFILE_IMAGE_UPLOAD_IP_BLOCK_SECONDS=900
# Delay until the pending upload expires (the client never finishes upload)
USERS_PROFILE_IMAGE_UPLOAD_EXPIRE_DELAY_SECONDS=7200

# Observability (Grafana Cloud OTLP)
OTEL_SERVICE_NAME=backend-core-kit
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer <GRAFANA_CLOUD_OTLP_TOKEN>
LOG_LEVEL=debug
# Pretty logs are enabled by default in development; set false to force JSON.
LOG_PRETTY=true

# Email (Resend)
# Optional: set both variables to enable outbound email sending.
RESEND_API_KEY=re_...
EMAIL_FROM=onboarding@example.com
# Optional reply-to
EMAIL_REPLY_TO=support@example.com

# Push notifications (FCM)
# Optional: set PUSH_PROVIDER=FCM and the FCM_* variables to enable push sending.
# PUSH_PROVIDER=FCM
# FCM_PROJECT_ID=your-firebase-project-id
# Auth options (pick exactly one; leave the others false/empty):
# - ADC (recommended on GCP): set FCM_USE_APPLICATION_DEFAULT=true
# - Service account JSON path (recommended for production via mounted secret file)
# - Service account JSON base64 (recommended for Heroku/CI to avoid quoting/newline issues)
# - Inline service account JSON (convenient for local dev; avoid in production)
FCM_USE_APPLICATION_DEFAULT=false
FCM_SERVICE_ACCOUNT_JSON_PATH=
FCM_SERVICE_ACCOUNT_JSON_BASE64=
FCM_SERVICE_ACCOUNT_JSON=

# Object storage (S3-compatible; e.g. Cloudflare R2)
# Optional: set all variables to enable object storage.
# STORAGE_S3_ENDPOINT=https://example.r2.cloudflarestorage.com
# STORAGE_S3_REGION=auto
# STORAGE_S3_BUCKET=your-bucket
# STORAGE_S3_ACCESS_KEY_ID=your-access-key-id
# STORAGE_S3_SECRET_ACCESS_KEY=your-secret-access-key
# Some S3-compatible providers require path-style addressing; R2 typically does not.
STORAGE_S3_FORCE_PATH_STYLE=false