.env.example

# ============================================================
# HireSettle Backend — Environment Variables
# Copy to .env and fill in your values
# Never commit .env — only this .env.example with placeholder values.
# See docs/secrets.md for secret rotation and production injection.
# ============================================================

# Server
NODE_ENV=development
PORT=3000
API_PREFIX=api/v1
LOG_LEVEL=log

# Data retention / GDPR
# ---------------------------------------------------------------
# Legacy alias — kept for backward compatibility with existing
# deployments. New installs should use the per-category vars below.
# NOTIFICATION_RETENTION_DAYS is no longer read by any active cron.
NOTIFICATION_RETENTION_DAYS=90

# How many days after a user requests erasure (deletedAt) before
# PiiAnonymizationSchedulerService runs the full PII scrub. Default: 30
PII_ANONYMIZATION_WINDOW_DAYS=30

# Per-category retention windows for DataRetentionService (03:00 UTC daily).
# Set any value to -1 to disable that category entirely.
#
# Read notifications deleted after this many days (default: 90)
RETENTION_NOTIFICATIONS_DAYS=90
# Unread notifications deleted after this many days (default: 365)
RETENTION_NOTIFICATIONS_UNREAD_DAYS=365
# security_events rows deleted after this many days (default: 365)
RETENTION_SECURITY_EVENTS_DAYS=365
# Expired idempotency_keys rows purged using their per-row expiresAt.
# Set to -1 to disable. Any other value enables the purge (default: 0 = enabled)
RETENTION_IDEMPOTENCY_KEYS_DAYS=0
# Consumed / revoked / expired refresh_tokens older than this many days (default: 30)
RETENTION_REFRESH_TOKENS_DAYS=30
# Processed data_deletion_requests older than this many days (default: 365)
RETENTION_DATA_DELETION_REQS_DAYS=365

# Password complexity policy (enforced on registration and password reset)
# Defaults shown; override per environment as needed.
PASSWORD_MIN_LENGTH=8
PASSWORD_REQUIRE_UPPERCASE=true
PASSWORD_REQUIRE_LOWERCASE=true
PASSWORD_REQUIRE_NUMBER=true
PASSWORD_REQUIRE_SPECIAL=false

# JWT
# Must be a 256-bit random value (server refuses to start otherwise).
# Generate with: openssl rand -base64 32
JWT_SECRET=your-super-secret-jwt-key-change-in-production
JWT_ACCESS_EXPIRES_IN=15m
JWT_REFRESH_EXPIRES_IN=7d
JWT_REFRESH_EXPIRES_DAYS=7

# Google OAuth2 (optional — leave unset to disable Google login)
# Create credentials at https://console.cloud.google.com/apis/credentials
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
# Must match an authorized redirect URI in the Google console (include API prefix)
GOOGLE_CALLBACK_URL=http://localhost:3000/api/v1/auth/google/callback
# Optional: after callback, redirect the browser here with accessToken & refreshToken query params.
# If unset, the callback returns a JSON JWT pair instead.
GOOGLE_OAUTH_SUCCESS_REDIRECT=http://localhost:3001/auth/google/callback

# Database (PostgreSQL via Prisma)
DATABASE_URL=postgresql://hiresettle:password@localhost:5432/hiresettle_db

# Database connection pooling
# Configure Prisma connection pooling for production load
# Default values: min=2 connections, max=10 connections
DATABASE_POOL_MIN=2
DATABASE_POOL_MAX=10

# Stellar Network
# Set to testnet or mainnet. This selects the default Horizon URL and network passphrase.
STELLAR_NETWORK=testnet
# Optional RPC override; omit to use the STELLAR_NETWORK default.
STELLAR_RPC_URL=https://soroban-testnet.stellar.org

# Deployed contract IDs
HIRESETTLE_CONTRACT_ID=CXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
SOROBAN_CONTRACT_ADDRESS=CXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
# Allowed tokens: JSON array of token configs: [{"address": "...", "symbol": "...", "decimals": 7}]
ALLOWED_TOKENS=[{"address":"CBIELTK6YBZJU5UP2WWQEUCYKLPU6AUNZ2BQ4WWFEIE3USCIHMXQDAMA","symbol":"USDC","decimals":7}]

# Stellar account for reading contract events (read-only — does NOT hold user funds)
STELLAR_SECRET_KEY=SXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

# Email (Nodemailer)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=your-email@gmail.com
SMTP_PASS=your-app-password
EMAIL_FROM=noreply@hiresettle.com

# Rate limiting
THROTTLE_TTL=60
THROTTLE_LIMIT=100

# Event polling interval (ms) — how often to poll Stellar RPC for new events
EVENT_POLLING_INTERVAL_MS=5000

# Ledgers per day constant (used for retention timer calculation)
# Stellar produces ~1 ledger every 5 seconds → 86400 / 5 = 17280
LEDGERS_PER_DAY=17280

# Redis — required for Bull job queues; omit to use in-memory cache only
REDIS_URL=redis://localhost:6379

# CORS — allowed origins (comma-separated list)
ALLOWED_ORIGINS=http://localhost:3001

# OpenTelemetry tracing — set to enable; unset disables tracing entirely
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
OTEL_SERVICE_NAME=hiresettle-backend

# Prometheus metrics — comma-separated list of IPs allowed to scrape /metrics
# Leave empty to allow all (not recommended for production)
METRICS_ALLOWED_IPS=127.0.0.1,::1

# S3 Storage
S3_ACCESS_KEY_ID=your-access-key-id
S3_SECRET_ACCESS_KEY=your-secret-access-key
S3_REGION=us-east-1
S3_BUCKET=your-bucket-name
S3_ENDPOINT=https://s3.amazonaws.com  # for S3-compatible services

# S3 Presigned URL Configuration
# How long presigned URLs remain valid (in seconds). Default: 3600 (1 hour)
S3_PRESIGNED_URL_EXPIRY=3600

# S3 Cleanup Configuration
# Grace period (in hours) before orphaned uploads are deleted. Default: 24
S3_CLEANUP_GRACE_PERIOD_HOURS=24

# Stellar Circuit Breaker
# Max call duration (ms) before counting as timeout. Default: 10000 (10s)
STELLAR_BREAKER_TIMEOUT=10000
# % of failed calls in rolling window before tripping breaker. Default: 50
STELLAR_BREAKER_ERROR_THRESHOLD=50
# Cooldown period (ms) before trying recovery in half-open state. Default: 30000 (30s)
STELLAR_BREAKER_RESET_TIMEOUT=30000
# Rolling window duration (ms) for measuring error rate. Default: 10000 (10s)
STELLAR_BREAKER_ROLLING_COUNT_TIMEOUT=10000
# Number of buckets in the rolling window. Default: 10
STELLAR_BREAKER_ROLLING_COUNT_BUCKETS=10