Commitlabs-Frontend/.env.example at master · chi797/Commitlabs-Frontend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
# =============================================================================
# Commitlabs - Environment Variable Reference
# Copy this file to .env.local (git-ignored) and fill in your values.
#
# Validation:
# - Backend env vars: src/lib/backend/env.ts (Zod schema)
# - Client env vars (NEXT_PUBLIC_*): src/lib/clientEnv.ts (Zod schema)
# =============================================================================

# -----------------------------------------------------------------------------
# Client-Side Environment Variables (NEXT_PUBLIC_*)
# These variables are exposed to the browser and validated by src/lib/clientEnv.ts.
# Never include secrets in NEXT_PUBLIC_* variables.
# -----------------------------------------------------------------------------

# Soroban RPC endpoint (client-accessible)
# Used by the frontend for blockchain interactions.
# Must be a valid URL when provided.
NEXT_PUBLIC_SOROBAN_RPC_URL=https://soroban-testnet.stellar.org:443

# Stellar network passphrase (client-accessible)
# Defaults to testnet value when not set.
NEXT_PUBLIC_NETWORK_PASSPHRASE=Test SDF Network ; September 2015

# Contract addresses (client-accessible)
# These are the public contract addresses used by the frontend.
# For server-side routes, use the non-public variants (e.g., COMMITMENT_CORE_CONTRACT).
NEXT_PUBLIC_COMMITMENT_NFT_CONTRACT=
NEXT_PUBLIC_COMMITMENT_CORE_CONTRACT=
NEXT_PUBLIC_ATTESTATION_ENGINE_CONTRACT=

# Contract configuration (client-accessible)
# JSON blob defining multiple contract versions. See docs/config.md for structure.
# NEXT_PUBLIC_CONTRACTS_JSON={"v1":{"commitmentNFT":{"address":"C..."},"commitmentCore":{"address":"C..."}}}

# Active contract version (client-accessible)
# Selects which configured version to use (defaults to "v1").
NEXT_PUBLIC_ACTIVE_CONTRACT_VERSION=v1

# Mock mode flag (client-accessible)
# Set to "true" to use mock data instead of real blockchain interactions.
NEXT_PUBLIC_USE_MOCKS=true

# Application URLs (client-accessible)
# Used for CORS configuration and generating links.
NEXT_PUBLIC_APP_URL=http://localhost:3000
NEXT_PUBLIC_SITE_URL=http://localhost:3000

# Google Site Verification (client-accessible)
# Optional: Required for Google Search Console verification.
# Omit or leave empty to disable the meta tag.
NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION=

# -----------------------------------------------------------------------------
# Server-Side Environment Variables
# These variables are NOT exposed to the browser and validated by src/lib/backend/env.ts.
# Use these for secrets and server-only configuration.
# -----------------------------------------------------------------------------

# Soroban RPC endpoint (server-only)
# Use this for server-side routes. Takes precedence over NEXT_PUBLIC_SOROBAN_RPC_URL.
# SOROBAN_RPC_URL=https://soroban-testnet.stellar.org:443

# Stellar network passphrase (server-only)
# Defaults to testnet value when not set.
# SOROBAN_NETWORK_PASSPHRASE=Test SDF Network ; September 2015

# -----------------------------------------------------------------------------
# Contract addresses (server-only)
# Provide either the private or the NEXT_PUBLIC_ variant.
# Deployment note:
# - contracts/scripts/deploy-testnet.sh upserts the deployed id into .env.local.
# - Never commit a real deployer secret or signer credential.
# - If server-side routes submit writes, keep COMMITMENT_CORE_CONTRACT or
#   SOROBAN_COMMITMENT_CORE_CONTRACT aligned with the public contract id.
# -----------------------------------------------------------------------------
# COMMITMENT_NFT_CONTRACT=
# COMMITMENT_CORE_CONTRACT=
# ATTESTATION_ENGINE_CONTRACT=

# -----------------------------------------------------------------------------
# Signing credentials (server-side only - NEVER expose to the browser)
# SOROBAN_SERVER_SECRET_KEY is used for on-chain write operations.
# Values are ALWAYS redacted from error messages and logs.
# -----------------------------------------------------------------------------
# SOROBAN_SERVER_SECRET_KEY=S...
# SOROBAN_SOURCE_ACCOUNT=G...

# Enable on-chain writes (set to "true" to activate; default false)
# COMMITLABS_ENABLE_CHAIN_WRITES=false

# Per-call timeout (ms) for Soroban RPC interactions (default: 30000 = 30 s).
# When a call exceeds this limit an AbortController fires and the route returns
# HTTP 504 GATEWAY_TIMEOUT with retryable: true. Increase for high-latency
# testnets; decrease for strict latency budgets.
# SOROBAN_RPC_TIMEOUT_MS=30000

# -----------------------------------------------------------------------------
# Session secret (REQUIRED in production)
# Used to sign session tokens. Generate with: openssl rand -hex 32
# Must be at least 32 characters. Value is ALWAYS redacted from error messages.
# -----------------------------------------------------------------------------
# SESSION_SECRET=

# -----------------------------------------------------------------------------
# Storage connection (optional; required if blob/DB storage is used)
# Value is ALWAYS redacted from error messages.
# -----------------------------------------------------------------------------
# STORAGE_CONNECTION=

# -----------------------------------------------------------------------------
# RPC URL allowlist (REQUIRED in production)
# Comma-separated list of permitted Soroban RPC endpoint URLs.
# The active SOROBAN_RPC_URL must be present in this list in production.
# Example:
# SOROBAN_RPC_URL_ALLOWLIST=https://soroban-testnet.stellar.org:443,https://rpc-mainnet.stellar.org
# -----------------------------------------------------------------------------
# SOROBAN_RPC_URL_ALLOWLIST=

# -----------------------------------------------------------------------------
# Feature flags (all default to false)
# Individual boolean strings or a single JSON override blob (JSON takes precedence).
# -----------------------------------------------------------------------------
COMMITLABS_FEATURE_ANALYTICS_USER=false
COMMITLABS_FEATURE_MARKETPLACE=false
# Example:
# COMMITLABS_FEATURE_FLAGS_JSON={"analyticsUser":true,"marketplace":false}

# -- Rate limiting -------------------------------------------------------------
# Controls the fixed-window rate limits applied to API routes.
# Write-heavy routes use the WRITE vars; all other routes use the DEFAULT vars.
# RATE_LIMIT_WRITE_MAX_REQUESTS=10
# RATE_LIMIT_WRITE_WINDOW_SECONDS=60
# RATE_LIMIT_DEFAULT_MAX_REQUESTS=20
# RATE_LIMIT_DEFAULT_WINDOW_SECONDS=60

# -- Cache layer ---------------------------------------------------------------
# CACHE_ADAPTER=memory
# REDIS_URL=redis://localhost:6379

# Examples:
# redis://localhost:6379
# redis://:mypassword@redis.example.com:6379/0
# rediss://:mypassword@redis.example.com:6380/0