.env.example

# =============================================================================
# TalentTrust Backend — Environment Variables
# =============================================================================
# Copy this file to .env and fill in the values for your environment.
# See docs/backend/config.md for detailed documentation.
# =============================================================================

# Server
PORT=3001
NODE_ENV=development
API_BASE_URL=https://api.example.com
DEBUG=true

# Security
JWT_SECRET=your-secret-key-at-least-8-chars-long
# COMPLIANCE_AUDIT_SECRET must be a strong, random key of at least 32 characters.
# Example: openssl rand -hex 32
COMPLIANCE_AUDIT_SECRET=your-compliance-secret-key

# Admin API Authentication
# Optional API key for admin endpoints (DLQ, deploy).
# Must be set alongside ADMIN_API_KEY_HASH in production.
# ADMIN_API_KEY=your-admin-api-key-here
# ADMIN_API_KEY_HASH=<salt>:<hash> (generated via the API key utilities)

# Key rotation
# Set ROTATE_ADMIN_API_KEY=true to generate a new key on next boot (development only)
# ROTATE_ADMIN_API_KEY=false

# Database
DATABASE_URL=postgresql://localhost:5432/talenttrust

# CORS Configuration
# Comma-separated list of allowed origins for CORS requests
# Example: CORS_ALLOWED_ORIGINS=https://app.example.com,https://admin.example.com
# Note: Wildcard (*) is not allowed in production mode
# CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3001

# Stellar Network
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
STELLAR_NETWORK_PASSPHRASE=Test SDF Network ; September 2015

# Soroban Smart Contracts
SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
SOROBAN_CONTRACT_ID=

# Example: ROUTE_BODY_LIMITS=/api/upload:1048576,/api/data:2048
# ROUTE_BODY_LIMITS=

# Circuit Breaker Thresholds
# CB_FAILURE_THRESHOLD=5   # consecutive failures before opening (default: 5)
# CB_SUCCESS_THRESHOLD=1   # consecutive successes in HALF_OPEN before closing (default: 1)
# CB_TIMEOUT_MS=30000      # ms to wait in OPEN before probing again (default: 30000)

# Webhook Delivery Circuit Breaker
# Per-provider circuit breaker for outbound webhook delivery.
# Intentionally separate from CB_* so webhook and RPC failure modes can be tuned independently.
# WEBHOOK_CB_FAILURE_THRESHOLD=5    # consecutive failures before opening (1-100, default: 5)
# WEBHOOK_CB_SUCCESS_THRESHOLD=1    # consecutive successes in HALF_OPEN before closing (1-20, default: 1)
# WEBHOOK_CB_TIMEOUT_MS=60000       # cooldown ms before probing (1000-300000, default: 60000)
#                                   # Recommended: >= max retry backoff delay (default: 30000)

# Blue-Green Auto-Rollback (post-switch soak)
# After `npm run deploy:switch-green`, the deployer watches the HTTP 5xx
# error-rate metric for a soak window and automatically runs `rollback` if the
# threshold is breached.  See docs/backend/auto-rollback.md.
# AUTO_ROLLBACK_ENABLED=true            # master switch (default: true)
# ROLLBACK_ERROR_RATE_THRESHOLD=0.05    # 5xx fraction that triggers rollback (0..1, default: 0.05)
# ROLLBACK_SOAK_WINDOW_MS=30000         # total observation window (1000-600000, default: 30000)
# ROLLBACK_SAMPLE_INTERVAL_MS=5000      # time between samples (100-60000, default: 5000)
# ROLLBACK_MIN_REQUESTS=20              # min requests in window before acting (>=0, default: 20)

# Graceful Shutdown — Webhook Delivery Drain
# How long (ms) to wait for in-flight webhook deliveries to finish after SIGTERM
# before force-flushing them to the DLQ.  Set to a value that covers your p99
# delivery latency. During a blue/green switch the router stops sending traffic
# to the old color before SIGTERM arrives, so most deliveries will already be
# done by the time this timeout starts.
# WEBHOOK_DRAIN_TIMEOUT_MS=30000

# Idempotency Store TTL
# How long (ms) idempotency keys are retained before eviction.
# Default: 3600000 (1 hour). Re-submissions after expiry are processed fresh.
# IDEMPOTENCY_TTL_MS=3600000