.env.example

# =============================================================================
# Swipely Backend — Environment Variable Reference
# =============================================================================
# Copy this file to .env and fill in the values for your environment.
# Lines starting with # are comments. All variables without a "required"
# comment have safe defaults for local development.
#
# ⚠  Never commit a populated .env file to version control.
# =============================================================================


# -----------------------------------------------------------------------------
# Application
# -----------------------------------------------------------------------------

NODE_ENV=development          # development | production | test | sandbox
PORT=3001                     # HTTP port the API server listens on
WS_PORT=3002                  # WebSocket server port

# Comma-separated list of allowed CORS origins (production only).
# Leave unset in development to allow all origins.
# CORS_ALLOWED_ORIGINS=https://app.example.com,https://admin.example.com


# -----------------------------------------------------------------------------
# Security  ★ required in production
# -----------------------------------------------------------------------------

# Minimum 32 characters. Used to sign download tokens in the export service.
# JWT_SECRET=change-me-to-a-random-32-char-or-longer-string

# Minimum 32 characters. Used to encrypt sensitive config values at rest.
# CONFIG_ENCRYPTION_KEY=change-me-to-a-random-32-char-or-longer-string


# -----------------------------------------------------------------------------
# PostgreSQL / TimescaleDB
# -----------------------------------------------------------------------------

POSTGRES_HOST=localhost
POSTGRES_PORT=5432
POSTGRES_DB=bridge_watch
POSTGRES_USER=bridge_watch
POSTGRES_PASSWORD=bridge_watch_dev   # ★ change in production


# -----------------------------------------------------------------------------
# Redis
# -----------------------------------------------------------------------------

REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=                      # leave empty if no auth
# Set to "true" in production to enable Redis Cluster mode
# REDIS_CLUSTER=true


# -----------------------------------------------------------------------------
# Stellar
# -----------------------------------------------------------------------------

STELLAR_NETWORK=testnet              # testnet | mainnet
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
# SOROBAN_MAINNET_RPC_URL=https://soroban-rpc.mainnet.stellar.org
# CIRCUIT_BREAKER_CONTRACT_ID=CXXXX...
# LIQUIDITY_CONTRACT_ADDRESS=CXXXX...


# -----------------------------------------------------------------------------
# Ethereum / EVM chains
# -----------------------------------------------------------------------------

# ETHEREUM_RPC_URL=https://mainnet.infura.io/v3/YOUR_PROJECT_ID
# ETHEREUM_RPC_WS_URL=wss://mainnet.infura.io/ws/v3/YOUR_PROJECT_ID
# ETHEREUM_RPC_FALLBACK_URL=https://eth-mainnet.alchemyapi.io/v2/YOUR_KEY
RPC_PROVIDER_TYPE=http               # http | ws

# USDC_BRIDGE_ADDRESS=0x...
# EURC_BRIDGE_ADDRESS=0x...
# USDC_TOKEN_ADDRESS=0x...
# EURC_TOKEN_ADDRESS=0x...

# POLYGON_RPC_URL=https://polygon-mainnet.infura.io/v3/YOUR_PROJECT_ID
# POLYGON_RPC_FALLBACK_URL=https://polygon-mainnet.alchemyapi.io/v2/YOUR_KEY

# BASE_RPC_URL=https://mainnet.base.org
# BASE_RPC_FALLBACK_URL=https://base-mainnet.g.alchemy.com/v2/YOUR_KEY


# -----------------------------------------------------------------------------
# External price / data APIs
# -----------------------------------------------------------------------------

# CIRCLE_API_KEY=your-circle-api-key
CIRCLE_API_URL=https://api.circle.com
CIRCLE_API_TIMEOUT_MS=5000
CIRCLE_CACHE_TTL_SEC=60
CIRCLE_RATE_LIMIT_MAX=30
CIRCLE_RATE_LIMIT_WINDOW_MS=60000

# COINBASE_API_KEY=your-coinbase-api-key
# COINBASE_API_SECRET=your-coinbase-api-secret

# ONEINCH_API_KEY=your-1inch-api-key
# COINMARKETCAP_API_KEY=your-cmc-api-key
# COINGECKO_API_KEY=your-coingecko-demo-api-key

# Bootstrap token used to seed the first admin API key (optional after first run)
# API_KEY_BOOTSTRAP_TOKEN=a-long-random-bootstrap-secret


# -----------------------------------------------------------------------------
# Logging
# -----------------------------------------------------------------------------

LOG_LEVEL=info                       # fatal | error | warn | info | debug | trace
# LOG_FILE=/var/log/swipely/app.log  # Write logs to a file (production)
LOG_MAX_FILE_SIZE=104857600          # 100 MB
LOG_MAX_FILES=10
LOG_RETENTION_DAYS=30
LOG_REQUEST_BODY=false               # Log incoming request bodies (verbose)
LOG_RESPONSE_BODY=false              # Log outgoing response bodies (verbose)
LOG_SENSITIVE_DATA=false             # Must remain false in production
REQUEST_SLOW_THRESHOLD_MS=1000       # Warn on requests slower than this


# -----------------------------------------------------------------------------
# Rate Limiting
# -----------------------------------------------------------------------------

RATE_LIMIT_MAX=100
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_BURST_MULTIPLIER=0.1
# RATE_LIMIT_WHITELIST_IPS=127.0.0.1,10.0.0.1
# RATE_LIMIT_WHITELIST_KEYS=internal-key-1,internal-key-2

RATE_LIMIT_ENABLE_DYNAMIC=true
RATE_LIMIT_GLOBAL_ALERT_THRESHOLD=0.9
RATE_LIMIT_BURST_ALERT_THRESHOLD=0.8
RATE_LIMIT_SUSTAINED_ALERT_THRESHOLD=0.7
RATE_LIMIT_STATS_RETENTION_HOURS=168
RATE_LIMIT_ENABLE_MONITORING=true
RATE_LIMIT_ADMIN_API_KEY_PREFIX=admin_

# Per-endpoint limits (requests per RATE_LIMIT_WINDOW_MS)
RATE_LIMIT_ENDPOINT_ASSETS=200
RATE_LIMIT_ENDPOINT_BRIDGES=150
RATE_LIMIT_ENDPOINT_ALERTS=50
RATE_LIMIT_ENDPOINT_ANALYTICS=100
RATE_LIMIT_ENDPOINT_CONFIG=30
RATE_LIMIT_ENDPOINT_HEALTH=1000


# -----------------------------------------------------------------------------
# Alert Thresholds
# -----------------------------------------------------------------------------

PRICE_DEVIATION_THRESHOLD=0.02       # 2% — triggers a price deviation alert
BRIDGE_SUPPLY_MISMATCH_THRESHOLD=0.1 # 10% — triggers a supply mismatch alert


# -----------------------------------------------------------------------------
# Verification & Retries
# -----------------------------------------------------------------------------

RETRY_MAX=3
BRIDGE_VERIFICATION_INTERVAL_MS=300000   # 5 minutes


# -----------------------------------------------------------------------------
# Price Aggregation / Cache
# -----------------------------------------------------------------------------

HORIZON_TIMEOUT_MS=500
REDIS_CACHE_TTL_SEC=30
REDIS_PRICE_CACHE_PREFIX=price:aggregated

# TTL (seconds) for per-provider last-known-good price fallback values.
PRICE_PROVIDER_CACHE_TTL_SEC=300

# Per-provider rate limits for price sources (requests per window).
# Each provider keeps an independent Redis counter.
SDEX_RATE_LIMIT_MAX=30
SDEX_RATE_LIMIT_WINDOW_MS=60000
AMM_RATE_LIMIT_MAX=30
AMM_RATE_LIMIT_WINDOW_MS=60000


# -----------------------------------------------------------------------------
# WebSocket
# -----------------------------------------------------------------------------

# Required for private channel authentication. Set to a strong random string.
# WS_AUTH_SECRET=change-me-to-a-random-secret


# -----------------------------------------------------------------------------
# Health Score Weights  (must sum to 1.0)
# -----------------------------------------------------------------------------

HEALTH_WEIGHT_LIQUIDITY=0.25
HEALTH_WEIGHT_PRICE=0.25
HEALTH_WEIGHT_BRIDGE=0.20
HEALTH_WEIGHT_RESERVES=0.20
HEALTH_WEIGHT_VOLUME=0.10


# -----------------------------------------------------------------------------
# Export Service
# -----------------------------------------------------------------------------

EXPORT_STORAGE_PATH=./exports
EXPORT_DOWNLOAD_URL_EXPIRY_HOURS=24
EXPORT_COMPRESSION_THRESHOLD_BYTES=1048576   # 1 MB
EXPORT_STREAMING_PAGE_SIZE=1000
EXPORT_QUEUE_CONCURRENCY=3
EXPORT_MAX_DATE_RANGE_DAYS=90


# -----------------------------------------------------------------------------
# Email (SMTP)
# -----------------------------------------------------------------------------

# SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_SECURE=false
# SMTP_USER=alerts@example.com
# SMTP_PASSWORD=your-smtp-password
SMTP_FROM_ADDRESS=noreply@bridgewatch.io
SMTP_FROM_NAME=Bridge Watch


# -----------------------------------------------------------------------------
# Discord Bot
# -----------------------------------------------------------------------------

# DISCORD_BOT_TOKEN=your-discord-bot-token
# DISCORD_CLIENT_ID=your-discord-application-id


# -----------------------------------------------------------------------------
# Telegram Bot
# -----------------------------------------------------------------------------

# TELEGRAM_BOT_TOKEN=your-telegram-bot-token
# TELEGRAM_WEBHOOK_URL=https://yourdomain.com/api/v1/telegram/webhook
# TELEGRAM_WEBHOOK_SECRET=a-strong-random-secret
TELEGRAM_RATE_LIMIT_OUTBOUND_GLOBAL_PER_SEC=30
TELEGRAM_RATE_LIMIT_OUTBOUND_PER_CHAT_PER_SEC=1
TELEGRAM_RATE_LIMIT_INBOUND_COMMANDS_PER_WINDOW=5
TELEGRAM_RATE_LIMIT_INBOUND_WINDOW_SEC=30
# TELEGRAM_ADMIN_CHAT_IDS=123456789,987654321
TELEGRAM_BOT_ENABLED=true


# -----------------------------------------------------------------------------
# Health Check Service
# -----------------------------------------------------------------------------

HEALTH_CHECK_TIMEOUT_MS=5000
HEALTH_CHECK_INTERVAL_MS=30000
HEALTH_CHECK_MEMORY_THRESHOLD=90    # % heap usage before degraded
HEALTH_CHECK_DISK_THRESHOLD=80      # % disk usage before degraded
HEALTH_CHECK_EXTERNAL_APIS=true
MAINTENANCE_MODE=false
MAINTENANCE_MESSAGE=
MAINTENANCE_SEVERITY=info           # info | warning | critical
# STATUS_PAGE_URL=https://status.example.com


# -----------------------------------------------------------------------------
# Data Validation
# -----------------------------------------------------------------------------

VALIDATION_STRICT_MODE=false
VALIDATION_ADMIN_BYPASS=true
VALIDATION_BATCH_SIZE=100
VALIDATION_MAX_BATCH_SIZE=1000
VALIDATION_DUPLICATE_CHECK=true
VALIDATION_NORMALIZATION=true
VALIDATION_CONSISTENCY_CHECKS=true
VALIDATION_ERROR_THRESHOLD=0.1      # 10% error rate threshold
VALIDATION_WARNING_THRESHOLD=0.3    # 30% warning threshold
VALIDATION_DATA_QUALITY_THRESHOLD=70


# -----------------------------------------------------------------------------
# Compliance Reports
# -----------------------------------------------------------------------------

REPORT_DIR=./reports
ARCHIVE_DIR=./archives
# REPORT_SIGNING_KEY_PATH=/secrets/report-signing-key.pem


# -----------------------------------------------------------------------------
# Correlation / Anomaly Detection
# -----------------------------------------------------------------------------

CORRELATION_THRESHOLD=0.6           # 0.0–1.0 similarity threshold


# -----------------------------------------------------------------------------
# Background Job Intervals
# -----------------------------------------------------------------------------

RECONCILIATION_INTERVAL_MS=600000            # 10 minutes
SOURCE_DECOMMISSION_CHECK_INTERVAL_MS=3600000 # 1 hour
PROVIDER_BREAKER_PROBE_INTERVAL_MS=30000     # 30 seconds


# -----------------------------------------------------------------------------
# BullMQ Queue Rate Limiting  (per priority level)
# -----------------------------------------------------------------------------

QUEUE_RATE_MAX_CRITICAL=1000
QUEUE_RATE_DURATION_MS_CRITICAL=1000
QUEUE_RATE_MAX_HIGH=1000
QUEUE_RATE_DURATION_MS_HIGH=1000
QUEUE_RATE_MAX_NORMAL=1000
QUEUE_RATE_DURATION_MS_NORMAL=1000
QUEUE_RATE_MAX_LOW=1000
QUEUE_RATE_DURATION_MS_LOW=1000