.env.example

# Server Configuration
NODE_ENV=development
PORT=3000
API_PREFIX=/api/v1

# OpenAPI / Swagger
# Swagger UI (/api/docs) and JSON export are always active in development.
# In production they are disabled by default — set to "true" to opt in.
SWAGGER_ENABLED=false

# Database
DATABASE_URL=postgresql://user:password@localhost:5432/alianStructure.db

# JWT
JWT_SECRET=your_jwt_secret_key_here
JWT_EXPIRATION=24h

# RBAC bootstrap admin (optional)
# On startup, the account matching ONE of these is promoted to the ADMIN role
# (idempotent — no-op if already admin or if both are unset). Use to seed the
# first admin without a manual DB edit. Prefer the wallet address for wallet
# accounts, or the email for email/password accounts.
ADMIN_BOOTSTRAP_EMAIL=
ADMIN_BOOTSTRAP_WALLET=

# AI Services
OPENAI_API_KEY=your_openai_key
GROK_API_KEY=your_grok_key
LLAMA_API_BASE_URL=http://localhost:8000

# Blockchain
ETH_RPC_URL=https://mainnet.infura.io/v3/your-project-id
BSC_RPC_URL=https://bsc-dataseed.binance.org
CHAIN_ID=1

# Redis (for caching and WebSocket)
REDIS_URL=redis://localhost:6379

# Rate limiting tiers
# Free users: 100 req/min, paid users: 1000 req/min, enterprise users: 10000 req/min
RATE_LIMIT_FREE_PER_MINUTE=100
RATE_LIMIT_PAID_PER_MINUTE=1000
RATE_LIMIT_ENTERPRISE_PER_MINUTE=10000
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_BURST_MULTIPLIER=1.2

# ── Logging ────────────────────────────────────────────────────────────────
# Minimum log level emitted to all transports.
# Values: verbose | debug | info | warn | error | fatal
LOG_LEVEL=debug

# Human-readable service identifier included in every structured log record.
SERVICE_NAME=alian-structure-api

# Optional: write daily-rotating log files to this directory.
# Leave blank to disable file logging (console-only).
# LOG_FILE_DIR=/var/log/alian-structure

# ── CloudWatch (optional) ───────────────────────────────────────────────────
# Set CLOUDWATCH_GROUP_NAME and AWS_REGION to enable AWS CloudWatch shipping.
# CLOUDWATCH_GROUP_NAME=/alian-structure/api
# CLOUDWATCH_STREAM_NAME=api-server         # default: <hostname>-<pid>
# AWS_REGION=us-east-1
# AWS_ACCESS_KEY_ID=                        # optional; prefer IAM role
# AWS_SECRET_ACCESS_KEY=                    # optional; prefer IAM role
# CLOUDWATCH_UPLOAD_RATE_MS=2000            # flush interval (default: 2000ms)
# CLOUDWATCH_RETENTION_DAYS=30             # log retention (default: 30 days)
# CLOUDWATCH_LOG_LEVEL=info                # min level shipped to CloudWatch

# ── Elasticsearch / ELK (optional) ─────────────────────────────────────────
# Set ELASTICSEARCH_URL to enable ELK shipping.
# ELASTICSEARCH_URL=http://localhost:9200
# ELASTICSEARCH_INDEX_PREFIX=logs-alian-structure
# ELASTICSEARCH_USERNAME=
# ELASTICSEARCH_PASSWORD=
# ELASTICSEARCH_API_KEY=                   # base64-encoded id:api_key
# ELASTICSEARCH_CA_CERT=                   # path to CA cert file (for TLS)
# ELASTICSEARCH_LOG_LEVEL=info             # min level shipped to Elasticsearch

# Sentry Error Tracking
SENTRY_DSN=
SENTRY_ENVIRONMENT=development
SENTRY_RELEASE=0.1.0
SENTRY_TRACES_SAMPLE_RATE=0.1

# Observability — OpenTelemetry tracing + Prometheus metrics
# Master switch for distributed tracing. Set to "false" to skip starting the
# OpenTelemetry SDK entirely (metrics remain available regardless).
TRACING_ENABLED=true
# Head-based trace sampling ratio in [0,1]. 1 = sample every trace (dev),
# lower it in production to bound overhead, e.g. 0.1 = 10% of traces.
OTEL_TRACES_SAMPLER_RATIO=1.0
# OTLP HTTP endpoint traces are exported to (Jaeger/Tempo/OTel Collector).
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318/v1/traces
# Optional legacy Jaeger Thrift endpoint (only needed for pre-OTLP Jaeger).
# JAEGER_ENDPOINT=http://localhost:14268/api/traces
# Optional shared token protecting the Prometheus /metrics endpoint. When set,
# scrapers must send "Authorization: Bearer <token>" or "?token=<token>".
# Leave blank on a trusted/private network. Strongly recommended in production.
METRICS_AUTH_TOKEN=

# Email Service (Ethereal for testing, configure SMTP for production)
SMTP_HOST=smtp.ethereal.email
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=
SMTP_PASSWORD=
EMAIL_FROM=noreply@alian-structure.com
EMAIL_VERIFICATION_URL=http://localhost:3000/auth/verify-email
# Oracle Service Configuration
# Contract address for on-chain oracle (set to actual deployed contract)
ORACLE_CONTRACT_ADDRESS=0x0000000000000000000000000000000000000000

# Submitter wallet private key (for signing on-chain transactions)
# IMPORTANT: Store in secure KMS in production, never commit actual keys
SUBMITTER_PRIVATE_KEY=0x0000000000000000000000000000000000000000000000000000000000000000

# Oracle submission settings
SUBMITTER_MAX_RETRIES=3
SUBMITTER_RETRY_DELAY=5000
SUBMITTER_GAS_LIMIT_MULTIPLIER=1.2
# OpenAI Configuration
OPENAI_API_KEY=sk-your-api-key-here
OPENAI_BASE_URL=https://api.openai.com/v1
OPENAI_MAX_RETRIES=3
OPENAI_RETRY_DELAY=1000

# Compute Job Queue Configuration
COMPUTE_JOB_RETRY_POLICIES={"email-notification":{"maxAttempts":2,"backoff":{"type":"fixed","delay":1000}},"batch-operation":{"maxAttempts":5,"backoff":{"type":"exponential","delay":1000,"factor":1.5,"maxDelay":60000}},"data-processing":{"maxAttempts":3,"backoff":{"type":"linear","delay":2000,"maxDelay":10000}},"ai-computation":{"maxAttempts":4,"backoff":{"type":"exponential","delay":3000,"factor":2,"maxDelay":120000}}}

# Referral System Configuration
# Maximum referral codes a single user can create
REFERRAL_MAX_PER_USER=10
# Maximum claims allowed from the same IP address
REFERRAL_MAX_CLAIMS_PER_IP=5
# Maximum claims allowed from the same device fingerprint
REFERRAL_MAX_CLAIMS_PER_DEVICE=3
# Days until referral codes expire
REFERRAL_CODE_EXPIRY_DAYS=365
# Number of accounts from same IP to trigger warning
REFERRAL_SUSPICIOUS_IP_THRESHOLD=3
# Number of accounts from same device to trigger warning
REFERRAL_SUSPICIOUS_DEVICE_THRESHOLD=2
# Rate limit window in milliseconds (default: 1 hour)
REFERRAL_RATE_LIMIT_WINDOW_MS=3600000
# Maximum attempts within rate limit window
REFERRAL_RATE_LIMIT_MAX_ATTEMPTS=10
# Enable bot detection based on user agent
REFERRAL_ENABLE_BOT_DETECTION=true
# Enable VPN/Proxy detection (requires external service)
REFERRAL_ENABLE_VPN_DETECTION=false


# OAuth Configuration
AUTH_OAUTH_ENABLED=true
OAUTH_REDIRECT_URI=http://localhost:3000/auth/oauth/callback

# Google OAuth
OAUTH_GOOGLE_CLIENT_ID=your_google_client_id
OAUTH_GOOGLE_CLIENT_SECRET=your_google_client_secret

# GitHub OAuth
OAUTH_GITHUB_CLIENT_ID=your_github_client_id
OAUTH_GITHUB_CLIENT_SECRET=your_github_client_secret

# Twitter/X OAuth
OAUTH_TWITTER_CLIENT_ID=your_twitter_client_id
OAUTH_TWITTER_CLIENT_SECRET=your_twitter_client_secret