.env.example

# Auth
JWT_SECRET=

# Transport security (see docs/security/tls-and-pinning.md).
# Outside development/test, https + wss are the only accepted transports.
# ENFORCE_TLS overrides that decision in either direction.
ENFORCE_TLS=
# Trusted reverse-proxy hops for X-Forwarded-Proto. Set to 0 when the gateway
# is exposed directly, otherwise clients can forge the header.
TRUST_PROXY=1
HSTS_MAX_AGE=31536000
HSTS_PRELOAD=true
# Comma-separated origin allowlist for CORS and the WebSocket handshake.
ALLOWED_ORIGINS=

# Certificate pinning policy published at GET /security/transport-policy.
# Pins are sha256/<base64-SPKI>. Clients only hard-fail when a backup pin
# exists, so never populate the first without the second.
TLS_PINNED_HOSTS=
TLS_PINNED_SPKI_SHA256=
TLS_BACKUP_SPKI_SHA256=
TLS_PIN_MAX_AGE_SECONDS=5184000
TLS_PIN_REPORT_URI=

# Blockchain
RPC_URL=
TOKEN_TRANSFER_CONTRACT_ID=
GROUP_TREASURY_CONTRACT_ID=
PROPOSALS_CONTRACT_ID=

# Database
DATABASE_URL=

# Redis
REDIS_URL=

# Rate limits and quotas (see docs/security/rate-limits.md).
# Any bucket in apps/backend/src/config/rateLimits.ts can be overridden with
# RATE_LIMIT_<BUCKET>=<limit>[/<windowSeconds>]. Defaults apply when unset.
# RATE_LIMIT_KEY_BUNDLE=30/60
# RATE_LIMIT_KEY_BUNDLE_DAILY=200/86400
# RATE_LIMIT_UPLOAD_SLOT=20/60
# RATE_LIMIT_UPLOAD_BYTES_DAILY=2147483648
# RATE_LIMIT_SOCKET_SEND_MESSAGE=30/10
# Kill switch for load tests only — never set in production.
# RATE_LIMIT_DISABLED=false

# Object storage (S3-compatible). Defaults below target local MinIO from
# infra/docker-compose.yml. For AWS S3 or Cloudflare R2, swap endpoint,
# credentials, region, and set OBJECT_STORE_FORCE_PATH_STYLE=false.
OBJECT_STORE_ENDPOINT=http://localhost:9000
OBJECT_STORE_BUCKET=clicked
OBJECT_STORE_ACCESS_KEY=clicked
OBJECT_STORE_SECRET_KEY=clickedsecret
OBJECT_STORE_REGION=us-east-1
OBJECT_STORE_FORCE_PATH_STYLE=true

# AI Service
OPENAI_API_KEY=

# Messaging
XMTP_ENV=dev
# Seconds an eventId is remembered for replay/duplicate protection. Defaults to 86400 (24h).
IDEMPOTENCY_TTL_SECONDS=86400
# Milliseconds an offline transition is held before broadcasting user_offline,
# so a brief disconnect+reconnect blip produces no offline/online pair. Defaults to 5000 (5s).
PRESENCE_OFFLINE_GRACE_MS=5000

# Push Notifications (VAPID)
# The frontend fetches VAPID_PUBLIC_KEY from GET /push/vapid-public-key at
# runtime (#349) rather than a separate NEXT_PUBLIC_* build-time var, so the
# two can never drift out of sync.
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
VAPID_SUBJECT=mailto:admin@example.com