diff --git a/.env.example b/.env.example index bdfda40..0d58c77 100644 --- a/.env.example +++ b/.env.example @@ -54,6 +54,10 @@ VERIFIER_REDIS_TIMEOUT_MS=2000 # Service URLs (for Docker/production) VERIFIER_URL=http://127.0.0.1:3002 + +# Maximum allowed request body size in bytes for verifier +# Default: 1048576 (1MB) +MAX_REQUEST_BODY_BYTES=1048576 # Comma-separated frontend origins allowed by the gateway CORS middleware. # Use origins only, with no path/query/fragment. # Defaults to http://localhost:3001 when unset or blank. @@ -113,8 +117,12 @@ CACHE_ENABLED=false CACHE_TTL_SECONDS=3600 # Frontend (Next.js / web/) — all read at build time, prefixed NEXT_PUBLIC_ +# Verifier warm-up endpoint used by frontend banner +# Default: unset (set this to let the banner warm the verifier too) +# NEXT_PUBLIC_VERIFIER_URL=https://.onrender.com # Gateway URL the browser hits for /api/ai/summarize and /api/receipts/:id # NEXT_PUBLIC_GATEWAY_URL=http://localhost:3000 + # Chain ID the wallet widget expects (must match the gateway CHAIN_ID). # Default 84532 (Base Sepolia). # NEXT_PUBLIC_EXPECTED_CHAIN_ID=84532 diff --git a/README.md b/README.md index eed1f7b..7cf1233 100644 --- a/README.md +++ b/README.md @@ -242,7 +242,6 @@ Edit `.env` before starting the gateway. At minimum: - `SERVER_WALLET_PRIVATE_KEY`: required for signing receipts. Use an unfunded development key locally. - `RECIPIENT_ADDRESS`: recipient address embedded in payment contexts. - `CHAIN_ID` and `EXPECTED_CHAIN_ID`: must match. The default is `84532` for Base Sepolia. - The root `bun run stack` command starts the gateway with `RECEIPT_STORE=memory` and `CACHE_ENABLED=false` unless you exported different values in the shell. That means the normal quick start does not require Redis even though production-style receipt storage defaults to Redis. ### Run The Stack @@ -332,6 +331,8 @@ Core local variables live in [.env.example](.env.example). Production placeholde | `RECEIPT_STORE` | Gateway | `redis` by default, `memory` for tests/local experiments. | | `REDIS_URL` | Gateway/Verifier | Required when `RECEIPT_STORE=redis`, `CACHE_ENABLED=true`, or `VERIFIER_NONCE_STORE=redis`. | | `VERIFIER_URL` | Gateway | **Required.** Where the gateway calls `/verify` (e.g. `http://127.0.0.1:3002` for `bun run stack`, `https://.onrender.com` for Render). The gateway refuses to start if unset — no silent loopback fallback. | +| `NEXT_PUBLIC_VERIFIER_URL` | Web | Frontend verifier warm-up endpoint used by banner for pre-warming the verifier. | +| `MAX_REQUEST_BODY_BYTES` | Verifier | Maximum request body size in bytes for verifier. Must be a positive integer; values less than or equal to 0 or invalid values fall back to the default `1048576` (1MB). | | `CACHE_ENABLED` | Gateway | Optional response cache. Payment verification still runs on cache hits. | | `METRICS_ENABLED` | Gateway | Enables the Prometheus metrics endpoint by default. Set to `false` to disable. | | `METRICS_PATH` | Gateway | Gateway metrics path. Default `/metrics`; values without a leading slash are normalized. | diff --git a/docker-compose.yml b/docker-compose.yml index 4a2cd3a..f48cbeb 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -46,6 +46,7 @@ services: - EXPECTED_CHAIN_ID=${EXPECTED_CHAIN_ID:-${CHAIN_ID:-84532}} - SIGNATURE_EXPIRY_SECONDS=${SIGNATURE_EXPIRY_SECONDS:-300} - SIGNATURE_CLOCK_SKEW_SECONDS=${SIGNATURE_CLOCK_SKEW_SECONDS:-60} + - MAX_REQUEST_BODY_BYTES=${MAX_REQUEST_BODY_BYTES:-1048576} - VERIFIER_NONCE_STORE=${VERIFIER_NONCE_STORE:-redis} - VERIFIER_NONCE_KEY_PREFIX=${VERIFIER_NONCE_KEY_PREFIX:-microai:verifier:nonce:} - VERIFIER_REDIS_TIMEOUT_MS=${VERIFIER_REDIS_TIMEOUT_MS:-2000} @@ -100,6 +101,7 @@ services: # mainnet chain id and the wallet widget + stat bar will contradict # each other. NEXT_PUBLIC_GATEWAY_URL: ${NEXT_PUBLIC_GATEWAY_URL:-http://localhost:3000} + NEXT_PUBLIC_VERIFIER_URL: ${NEXT_PUBLIC_VERIFIER_URL:-} NEXT_PUBLIC_EXPECTED_CHAIN_ID: ${NEXT_PUBLIC_EXPECTED_CHAIN_ID:-${CHAIN_ID:-84532}} NEXT_PUBLIC_EXPECTED_CHAIN_NAME: ${NEXT_PUBLIC_EXPECTED_CHAIN_NAME:-Base Sepolia} NEXT_PUBLIC_PAYMENT_AMOUNT: ${NEXT_PUBLIC_PAYMENT_AMOUNT:-${PAYMENT_AMOUNT:-0.001}} diff --git a/web/Dockerfile b/web/Dockerfile index 98a0700..d70e5e1 100644 --- a/web/Dockerfile +++ b/web/Dockerfile @@ -10,6 +10,7 @@ WORKDIR /app # in docker-compose / CI; otherwise the container ships the source defaults # regardless of the gateway's CHAIN_ID / PAYMENT_AMOUNT config. ARG NEXT_PUBLIC_GATEWAY_URL=http://localhost:3000 +ARG NEXT_PUBLIC_VERIFIER_URL= ARG NEXT_PUBLIC_EXPECTED_CHAIN_ID=84532 ARG NEXT_PUBLIC_EXPECTED_CHAIN_NAME="Base Sepolia" ARG NEXT_PUBLIC_PAYMENT_AMOUNT=0.001 @@ -18,6 +19,7 @@ ARG NEXT_PUBLIC_POSTHOG_ENABLED=false ARG NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN= ARG NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com ENV NEXT_PUBLIC_GATEWAY_URL=$NEXT_PUBLIC_GATEWAY_URL +ENV NEXT_PUBLIC_VERIFIER_URL=$NEXT_PUBLIC_VERIFIER_URL ENV NEXT_PUBLIC_EXPECTED_CHAIN_ID=$NEXT_PUBLIC_EXPECTED_CHAIN_ID ENV NEXT_PUBLIC_EXPECTED_CHAIN_NAME=$NEXT_PUBLIC_EXPECTED_CHAIN_NAME ENV NEXT_PUBLIC_PAYMENT_AMOUNT=$NEXT_PUBLIC_PAYMENT_AMOUNT diff --git a/web/README.md b/web/README.md index c14d7c4..3af510a 100644 --- a/web/README.md +++ b/web/README.md @@ -20,6 +20,7 @@ The frontend reads these `NEXT_PUBLIC_*` environment variables at build time: | Variable | Default | Notes | | --- | --- | --- | | `NEXT_PUBLIC_GATEWAY_URL` | `http://localhost:3000` | Gateway base URL the browser fetches `/api/ai/summarize` and `/api/receipts/:id` from. | +| `NEXT_PUBLIC_VERIFIER_URL` | unset | Optional verifier endpoint used by the frontend warm-up banner to pre-warm the verifier and improve first-request UX. | | `NEXT_PUBLIC_EXPECTED_CHAIN_ID` | `84532` | Chain id the wallet widget expects. Must match the gateway's `CHAIN_ID`. Deployments on Base mainnet should set `8453` so the widget doesn't fight every payment context. | | `NEXT_PUBLIC_EXPECTED_CHAIN_NAME` | `Base Sepolia` | Display name used by the wallet widget's `Switch to ` button and the summarize form's placeholder copy. | | `NEXT_PUBLIC_PAYMENT_AMOUNT` | `0.001` | Pre-challenge fee label shown under the summarize form. **Informational only** — the actual signed amount is whatever the gateway embeds in the 402 payment context. |