.env.production.example

# Production env-var template for the gateway.
# Do not commit real production secrets, private keys, Redis URLs, or wallet material.
# See DEPLOY.md for the platform-by-platform walkthrough (Render + Vercel + Upstash).

OPENROUTER_API_KEY=<your-openrouter-api-key>
# Non-secret demo model selection; replace if needed.
OPENROUTER_MODEL=z-ai/glm-4.5-air:free

SERVER_WALLET_PRIVATE_KEY=<your-demo-server-wallet-private-key>
# Must be the EIP-55 canonical (mixed-case checksummed) form, otherwise
# browser wallets reject EIP-712 signing with "bad address checksum".
# The gateway normalizes this on startup, but storing it canonically up
# front avoids the warning log on every boot.
RECIPIENT_ADDRESS=<your-base-sepolia-recipient-address>
PAYMENT_AMOUNT=0.001

REDIS_URL=<your-upstash-redis-url>
# VERIFIER_URL must be reachable from the gateway over HTTPS in production.
# On Render this looks like https://<verifier-app>.onrender.com; on Fly
# you'd use the private 6PN hostname http://<verifier-app>.internal:3002.
# The gateway refuses to start if VERIFIER_URL is unset — no silent
# loopback fallback, because that masks misconfiguration in prod.
VERIFIER_URL=https://<verifier-app>.onrender.com
ALLOWED_ORIGINS=https://<your-vercel-app>.vercel.app
# Comma-separated CIDRs that Gin should trust as proxies when reading
# X-Forwarded-For (used by IP rate limiting + access logs). Critical:
# DO NOT set 0.0.0.0/0 if RATE_LIMIT_ENABLED=true — that trusts every
# remote peer's X-Forwarded-For, letting a caller rotate spoofed IPs to
# get fresh rate-limit buckets. Use the platform's documented proxy CIDR
# only (Fly publishes theirs; Render does not, but Render's edge rewrites
# X-Forwarded-For to the real client IP — for portfolio scope it's
# acceptable to leave this empty and rate-limit per Render-edge address).
TRUSTED_PROXIES=

CHAIN_ID=84532
EXPECTED_CHAIN_ID=84532
SIGNATURE_EXPIRY_SECONDS=300
SIGNATURE_CLOCK_SKEW_SECONDS=60
RECEIPT_STORE=redis
CACHE_ENABLED=false
# Maximum request body size in MB (default: 10, max: 100).
# MAX_REQUEST_BODY_MB=10
REQUEST_TIMEOUT_SECONDS=60
AI_REQUEST_TIMEOUT_SECONDS=30
# VERIFIER_TIMEOUT_SECONDS at the 2s default fails against Render free-tier
# verifier cold-starts; 60s gives the verifier room to wake during a signed
# request. Drop to 5–10s if your verifier is always-on.
VERIFIER_TIMEOUT_SECONDS=60
HEALTH_CHECK_TIMEOUT_SECONDS=2

# Metrics / Observability
# Prometheus metrics are disabled in this production template so the endpoint
# is not exposed accidentally. Set true only when protected by your platform,
# private network, or scrape allowlist.
METRICS_ENABLED=false
METRICS_PATH=/metrics

NEXT_PUBLIC_GATEWAY_URL=https://<gateway-app>.onrender.com
# Optional but recommended: lets the cold-start banner pre-warm the verifier
# in parallel with the gateway, so the first signed-request click is fast.
NEXT_PUBLIC_VERIFIER_URL=https://<verifier-app>.onrender.com
# Optional web-display overrides. These are inlined into the Next.js bundle
# at build time. If you change CHAIN_ID above (e.g. 8453 for Base mainnet),
# you MUST set the matching NEXT_PUBLIC_EXPECTED_CHAIN_NAME (e.g. "Base")
# or the wallet widget / stat bar / hero copy will contradict the gateway's
# payment context. Defaults: 84532 / "Base Sepolia" / 0.001 / USDC.
NEXT_PUBLIC_EXPECTED_CHAIN_ID=84532
NEXT_PUBLIC_EXPECTED_CHAIN_NAME=Base Sepolia
NEXT_PUBLIC_PAYMENT_AMOUNT=0.001
NEXT_PUBLIC_PAYMENT_TOKEN=USDC