.env.example

#================================================================================================
# TelemetryFlow Core - ENVIRONMENT CONFIGURATION
#================================================================================================
#
# Sources:
#   - Backend  (NestJS API)
#   - Frontend (Vue 3 / Vite)
#   - Docker Compose (Infrastructure)
#
# SECURITY NOTICE:
#   This file contains DEFAULT VALUES suitable for DEVELOPMENT ONLY.
#   DO NOT use these values in production environments.
#
# Before deploying to production:
#   1. Generate secure secrets: pnpm run generate:secrets
#   2. Change all default passwords and credentials
#   3. Configure CORS_ORIGIN with specific trusted domains
#
# Quick Start: README.md
# Documentation: docs/
#
#================================================================================================


#================================================================================================
# [1] APPLICATION CONFIGURATION
#================================================================================================
APP_NAME=TelemetryFlow
NODE_ENV=development

# Backend API Port (NestJS)
PORT=3000

# Frontend Dev Server Port (Vite) — only used in local dev, not Docker
FRONTEND_PORT=3101

# Log level: debug | info | warn | error
LOG_LEVEL=info

# Timezone
TZ=UTC

# CORS Configuration
# Development: * allows all origins
# Production: MUST specify comma-separated list of trusted origins (no wildcards)
CORS_ORIGIN=*

# Domain Configuration
MAIN_DOMAIN=telemetryflow.id
DEMO_DOMAIN=demo.telemetryflow.id

# Version
VERSION=1.4.0


#================================================================================================
# [2] FRONTEND — APPLICATION SETTINGS
#================================================================================================
TELEMETRYFLOW_BASE_URL=/
TELEMETRYFLOW_APP_TITLE="TELEMETRYFLOW"
TELEMETRYFLOW_APP_CODE="TFO-Viz"

# Enable mock data for development
TELEMETRYFLOW_USE_MOCK=false

# Default refresh interval (ms)
TELEMETRYFLOW_REFRESH_INTERVAL=5000

# Enable frontend caching
TELEMETRYFLOW_ENABLE_CACHE=true
TELEMETRYFLOW_CACHE_TTL=300000


#================================================================================================
# [3] FRONTEND — API ENDPOINTS
#================================================================================================
# Core API endpoint
TELEMETRYFLOW_API_URL=http://localhost:3000
TELEMETRYFLOW_IAM_API_URL=http://localhost:3000

# API base URL for frontend → backend
TELEMETRYFLOW_API_BASE_URL=http://localhost:3000

# Frontend datatable configuration
DATATABLE_MAX_ROWS=5000
TELEMETRYFLOW_LIMIT_DATA=5000
TELEMETRYFLOW_LIMIT_DATA_MAX=100000
TELEMETRYFLOW_SCAN_LIMIT_DATA=5000000

# GitHub repository URL
GITHUB_REPOSITORY_URL=https://github.com/telemetryflow/telemetryflow-core


#================================================================================================
# [4] FRONTEND — AUTHENTICATION & SSO
#================================================================================================
TELEMETRYFLOW_API_KEY_ID=
TELEMETRYFLOW_API_KEY_SECRET=
TELEMETRYFLOW_API_KEY_HEADER=x-api-key

# Login credentials (admin dashboard)
TELEMETRYFLOW_VIZ_USERNAME=demo.telemetryflow
TELEMETRYFLOW_VIZ_EMAIL=demo.telemetryflow@telemetryflow.id
TELEMETRYFLOW_VIZ_PASSWORD=

# SSO Authentication Providers
TELEMETRYFLOW_SSO_GOOGLE=false
TELEMETRYFLOW_SSO_MICROSOFT=false
TELEMETRYFLOW_SSO_APPLE=false
TELEMETRYFLOW_SSO_SLACK=false
TELEMETRYFLOW_SSO_COGNITO=false
TELEMETRYFLOW_SSO_GITHUB=false

# reCAPTCHA v3
TELEMETRYFLOW_RECAPTCHA_SITE_KEY=
RECAPTCHA_SECRET_KEY=
RECAPTCHA_MIN_SCORE=0.5


#================================================================================================
# [5] FRONTEND — WHITE LABEL / BRANDING
#================================================================================================
TELEMETRYFLOW_BRAND_NAME="TelemetryFlow Core"
TELEMETRYFLOW_BRAND_TAGLINE="IAM, AI Assistant & Audit Platform"

TELEMETRYFLOW_DOMAIN=demo.telemetryflow.id
TELEMETRYFLOW_GITHUB_URL=https://github.com/telemetryflow/telemetryflow-core

# Logo Paths (relative to src/assets)
TELEMETRYFLOW_LOGO_LIGHT=src/assets/tfo-logo-light.svg
TELEMETRYFLOW_LOGO_DARK=src/assets/tfo-logo-dark.svg
TELEMETRYFLOW_LOGO_ICON=src/assets/favicon.svg
TELEMETRYFLOW_LOGO_WIDTH=180px
TELEMETRYFLOW_LOGO_HEIGHT=auto

TELEMETRYFLOW_COPYRIGHT_COMPANY=TelemetryFlow
TELEMETRYFLOW_COPYRIGHT_YEAR=2026
TELEMETRYFLOW_SHOW_POWERED_BY=false

TELEMETRYFLOW_LINK_WEBSITE=https://telemetryflow.id
TELEMETRYFLOW_LINK_DOCS=https://docs.telemetryflow.id
TELEMETRYFLOW_LINK_SUPPORT=https://support.telemetryflow.id


#================================================================================================
# [6] BACKEND — LOGGING CONFIGURATION
#================================================================================================
# Choose logging implementation:
#   nestjs  — Native NestJS Logger (console only)
#   winston — Winston Logger with multiple transports
LOGGER_TYPE=winston

LOG_PRETTY_PRINT=false
LOG_FORMAT=json
LOG_COLORIZE=false
LOG_SKIP_PATHS=/health,/metrics,/healthz,/ready

#------------------------------------------------------------------------------------------------
# OpenTelemetry Log Transport
#------------------------------------------------------------------------------------------------
OTEL_LOGS_ENABLED=true

#------------------------------------------------------------------------------------------------
# File Transport (Daily Rotation)
#------------------------------------------------------------------------------------------------
LOG_FILE_ENABLED=false
LOG_FILE_DIRNAME=logs
LOG_FILE_FILENAME=app-%DATE%.log
LOG_FILE_DATE_PATTERN=YYYY-MM-DD
LOG_FILE_ZIPPED=true
LOG_FILE_MAX_SIZE=20m
LOG_FILE_MAX_FILES=14d
LOG_FILE_JSON=true

#------------------------------------------------------------------------------------------------
# ClickHouse Log Transport
#------------------------------------------------------------------------------------------------
CLICKHOUSE_LOGS_ENABLED=false
CLICKHOUSE_LOGS_TABLE=logs
CLICKHOUSE_FLUSH_INTERVAL=5000
CLICKHOUSE_BUFFER_LIMIT=2000
CLICKHOUSE_REQUEST_TIMEOUT=120


#================================================================================================
# [7] BACKEND — OPENTELEMETRY CONFIGURATION
#================================================================================================
OTEL_ENABLED=true

OTEL_SERVICE_NAME=telemetryflow-core
SERVICE_VERSION=1.4.0
SERVICE_NAMESPACE=telemetryflow
SERVICE_TEAM=core

# OTEL Exporter endpoint
# Development: http://localhost:4318 | Docker: http://otel-collector:4318
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318


#================================================================================================
# [8] BACKEND — POSTGRESQL CONFIGURATION
#================================================================================================
# Note: Docker containers get POSTGRES_HOST=postgres override from docker-compose.yml
POSTGRES_HOST=localhost
POSTGRES_PORT=5432
POSTGRES_DB=telemetryflow_db
POSTGRES_USER=tfo_admin
POSTGRES_USERNAME=tfo_admin
POSTGRES_PASSWORD=

# TypeORM aliases
DATABASE_HOST=localhost
DATABASE_PORT=5432
DATABASE_NAME=telemetryflow_db
DATABASE_USERNAME=tfo_admin
DATABASE_SSL=false
DATABASE_POOL_SIZE=10
DATABASE_LOGGING=false


#================================================================================================
# [9] BACKEND — CLICKHOUSE CONFIGURATION
#================================================================================================
# Note: Docker containers get CLICKHOUSE_HOST override from docker-compose.yml
CLICKHOUSE_HOST=localhost
CLICKHOUSE_PORT=8123
CLICKHOUSE_HTTP_PORT=8123
CLICKHOUSE_NATIVE_PORT=9000
CLICKHOUSE_DB=telemetryflow_db
CLICKHOUSE_USER=tfo_admin
CLICKHOUSE_PASSWORD=


#================================================================================================
# [10] BACKEND — REDIS CONFIGURATION
#================================================================================================
# Redis is used for: L2 Cache, BullMQ Queues, Sessions
# Note: Docker containers get REDIS_HOST override from docker-compose.yml
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=
REDIS_MAX_MEMORY=1024mb

# Redis Database Separation
REDIS_DB=0
REDIS_SESSION_DB=0
REDIS_CACHE_DB=0
REDIS_QUEUE_DB=1


#================================================================================================
# [11] BACKEND — NATS CONFIGURATION (Event Streaming)
#================================================================================================
# Note: Docker containers get NATS_URL override from docker-compose.yml
NATS_URL=nats://localhost:4222
NATS_CLUSTER_ID=telemetryflow-cluster


#================================================================================================
# [12] BACKEND — CACHE CONFIGURATION (Multi-Level L1/L2)
#================================================================================================
CACHE_L1_ENABLED=true
CACHE_L1_TTL=60
CACHE_L1_MAX_SIZE=5000

CACHE_L2_ENABLED=true
CACHE_L2_TTL=3600
CACHE_KEY_PREFIX=tf:cache:

CACHE_ENABLED=true
CACHE_DEBUG=false


#================================================================================================
# [13] BACKEND — BULLMQ QUEUE CONFIGURATION
#================================================================================================
ENABLE_BULLMQ=true

#------------------------------------------------------------------------------------------------
# Queue Worker Concurrency
#------------------------------------------------------------------------------------------------
QUEUE_EVENTS_CONCURRENCY=3
QUEUE_ALERTS_CONCURRENCY=2
QUEUE_NOTIFICATIONS_CONCURRENCY=1
QUEUE_CLEANUP_CONCURRENCY=1

#------------------------------------------------------------------------------------------------
# Queue Rate Limits (jobs per second)
#------------------------------------------------------------------------------------------------
QUEUE_ALERT_RATE_LIMIT=100

#------------------------------------------------------------------------------------------------
# Queue Retry Configuration
#------------------------------------------------------------------------------------------------
QUEUE_MAX_ATTEMPTS=5
QUEUE_BACKOFF_DELAY=2000

#------------------------------------------------------------------------------------------------
# Queue Job Cleanup
#------------------------------------------------------------------------------------------------
QUEUE_KEEP_COMPLETED=1000
QUEUE_KEEP_FAILED=5000
QUEUE_COMPLETED_AGE=86400
QUEUE_FAILED_AGE=604800

QUEUE_ENABLED=true
QUEUE_DEBUG=false


#================================================================================================
# [14] BACKEND — API KEYS, JWT & SESSION
#================================================================================================
# SECURITY CRITICAL: These secrets MUST be changed in production
# Generate: pnpm run generate:secrets

JWT_SECRET=
JWT_REFRESH_SECRET=

JWT_ACCESS_EXPIRY=24h
JWT_REFRESH_EXPIRY=30d
JWT_EXPIRES_IN=24h

SESSION_SECRET=
ENCRYPTION_KEY=
MFA_ENCRYPTION_KEY=
LLM_ENCRYPTION_KEY=


#================================================================================================
# [15] BACKEND — EMAIL / SMTP CONFIGURATION
#================================================================================================
SMTP_ENABLED=false
SMTP_HOST=smtp.telemetryflow.id
SMTP_PORT=587
SMTP_SECURE=true
SMTP_USER=
SMTP_PASSWORD=

SMTP_FROM="TelemetryFlow Core <noreply@telemetryflow.id>"
SMTP_FROM_ADDRESS=noreply@telemetryflow.id
SMTP_FROM_NAME=TelemetryFlow Core
SMTP_REPLY_TO=support@telemetryflow.id

APP_URL=http://localhost:3000


#================================================================================================
# [16] BACKEND — RATE LIMITING CONFIGURATION
#================================================================================================
THROTTLE_TTL=60000
THROTTLE_LIMIT=500


#================================================================================================
# [17] BACKEND — DEFAULT CONFIGURATION
#================================================================================================
# Default Organization ID for alert rule evaluation
DEFAULT_ORGANIZATION_ID=

HOSTNAME=localhost


#================================================================================================
# [18] DOCKER-COMPOSE CONFIGURATION
#================================================================================================
# Usage:
#   Core services only:  docker-compose --profile core up -d
#   Core + monitoring:   docker-compose --profile core --profile monitoring up -d
#   All services:        docker-compose --profile all up -d
#
# Profiles:
#   - core       : postgres, clickhouse, redis, nats, backend, frontend
#   - monitoring : Jaeger
#   - tools      : Portainer
#   - all        : All services

#------------------------------------------------------------------------------------------------
# Volume Configuration
#------------------------------------------------------------------------------------------------
VOLUMES_BASE_PATH=/opt/data/docker/telemetryflow-core
VOLUMES_DRIVER=local

#------------------------------------------------------------------------------------------------
# Data Paths (for bind mounts)
#------------------------------------------------------------------------------------------------
DATA_POSTGRESQL=/opt/data/docker/telemetryflow-core/postgresql
DATA_CLICKHOUSE=/opt/data/docker/telemetryflow-core/clickhouse
DATA_REDIS=/opt/data/docker/telemetryflow-core/redis
DATA_NATS=/opt/data/docker/telemetryflow-core/nats
DATA_PORTAINER=/opt/data/docker/telemetryflow-core/portainer

#------------------------------------------------------------------------------------------------
# Configuration File Paths
#------------------------------------------------------------------------------------------------
CONFIG_POSTGRESQL=./config/postgresql/postgresql.conf
CONFIG_CLICKHOUSE=./config/clickhouse/config.xml


#================================================================================================
# [19] SERVICE VERSIONS
#================================================================================================
NODE_VERSION=22
POSTGRES_VERSION=16-alpine
CLICKHOUSE_VERSION=latest
REDIS_VERSION=7-alpine
NATS_VERSION=2-alpine
PORTAINER_VERSION=latest


#================================================================================================
# [20] CONTAINER NAMES
#================================================================================================
CONTAINER_BACKEND=telemetryflow_core_backend
CONTAINER_FRONTEND=telemetryflow_core_frontend
CONTAINER_POSTGRES=telemetryflow_core_postgres
CONTAINER_CLICKHOUSE=telemetryflow_core_clickhouse
CONTAINER_REDIS=telemetryflow_core_redis
CONTAINER_NATS=telemetryflow_core_nats
CONTAINER_PORTAINER=telemetryflow_core_portainer


#================================================================================================
# [21] PORT MAPPINGS
#================================================================================================
PORT_BACKEND=3000
PORT_FRONTEND=8080
PORT_POSTGRES=5432
PORT_CLICKHOUSE_HTTP=8123
PORT_CLICKHOUSE_NATIVE=9000
PORT_REDIS=6379
PORT_NATS_CLIENT=4222
PORT_NATS_MONITOR=8222
PORT_PORTAINER=9100
PORT_PORTAINER_HTTPS=9443


#================================================================================================
# [22] STATIC IP ADDRESSES (Docker internal networking)
#================================================================================================
# Network Subnet: 172.154.0.0/16

CONTAINER_IP_BACKEND=172.154.154.10
CONTAINER_IP_FRONTEND=172.154.154.80
CONTAINER_IP_POSTGRES=172.154.154.20
CONTAINER_IP_REDIS=172.154.154.30
CONTAINER_IP_NATS=172.154.154.35
CONTAINER_IP_CLICKHOUSE=172.154.154.40
CONTAINER_IP_PORTAINER=172.154.154.5


#================================================================================================
# PRODUCTION DEPLOYMENT SECURITY CHECKLIST
#================================================================================================
#
# [ ] JWT_SECRET changed to 32+ character random string
# [ ] JWT_REFRESH_SECRET changed to 32+ character random string
# [ ] SESSION_SECRET changed to 32+ character random string (different from JWT)
# [ ] ENCRYPTION_KEY changed to 32+ character random string
# [ ] MFA_ENCRYPTION_KEY changed to 32+ character random string
# [ ] LLM_ENCRYPTION_KEY changed to 32+ character random string
# [ ] CORS_ORIGIN set to specific trusted domains (no wildcard)
# [ ] POSTGRES_PASSWORD changed from default
# [ ] CLICKHOUSE_PASSWORD changed from default
# [ ] REDIS_PASSWORD set to a strong password
# [ ] All database users have restricted permissions (least privilege)
# [ ] HTTPS/TLS enabled at reverse proxy (nginx/traefik)
# [ ] SMTP_ENABLED=true with production SMTP server
# [ ] NODE_ENV=production
# [ ] Environment variables stored securely (secrets manager, not in git)
# [ ] Backup and disaster recovery plan in place
#
# Generate Secure Secrets:
#   pnpm run generate:secrets
#
#================================================================================================