.env.production

# Production environment profile
# Loaded automatically when APP_ENV=production
# All sensitive values MUST be injected via secrets manager (Vault) or CI/CD secrets.
# Do NOT commit real credentials here.

APP_ENV=production

# Structured JSON logging for log aggregation pipelines
RUST_LOG=warn
LOG_FORMAT=json

# Strict rate limits
DEFAULT_RATE_LIMIT=100
WHITELIST_RATE_LIMIT=1000

# Short DB timeouts — fail fast in production
DB_TIMEOUT_READ_SECS=5
DB_TIMEOUT_WRITE_SECS=10
DB_STATEMENT_TIMEOUT_MS=30000

# These must be set via environment injection — do not hardcode
# DATABASE_URL must point to a role with NOBYPASSRLS (and NOT the database's
# bootstrap/superuser role) or every RLS policy in migrations/ is silently
# ignored — see scripts/db-init/01-create-app-role.sql for the role this
# repo expects and docs/postmortem-cross-tenant-leak.md for why this matters.
# The startup check in src/startup.rs::assert_no_bypassrls fails the process
# at boot if the connected role has BYPASSRLS, so a misconfigured production
# DATABASE_URL will not start rather than silently leaking cross-tenant data.
# DATABASE_URL=
# BACKUP_DATABASE_URL must point to a role that DOES bypass RLS (unlike
# DATABASE_URL above) — pg_dump refuses to dump FORCE ROW LEVEL SECURITY
# tables (transactions, settlements) under a NOBYPASSRLS role. Falls back to
# DATABASE_URL if unset, which will make backups fail loudly the first time
# one runs — see Config::backup_database_url.
# BACKUP_DATABASE_URL=
# REDIS_URL=
# STELLAR_HORIZON_URL=
# ANCHOR_WEBHOOK_SECRET=
# ADMIN_API_KEY=
# TENANT_SECRET_KEY=
# VAULT_ROLE_ID=
# VAULT_SECRET_ID=