.env.example

# ─── App ─────────────────────────────────────────────────────────────────────
# REQUIRED in production; defaults to 'development'
NODE_ENV=development

# REQUIRED in production; defaults to 3001
PORT=3001

# ─── Database ─────────────────────────────────────────────────────────────────
# REQUIRED — must be a valid PostgreSQL URL
DATABASE_URL=postgresql://postgres:password@localhost:5432/orbitstream

# ─── Redis ────────────────────────────────────────────────────────────────────
# REQUIRED — must be a valid Redis URL
REDIS_URL=redis://localhost:6379

# ─── Auth / JWT ───────────────────────────────────────────────────────────────
# REQUIRED — minimum 32 characters; generate with: openssl rand -base64 48
JWT_SECRET=change-me-to-a-random-32-char-string-minimum

# OPTIONAL — token lifetime; defaults to '7d'
JWT_EXPIRES_IN=7d

# OPTIONAL — previous JWT secret, accepted during key rotation window
JWT_SECRET_PREVIOUS=

# ─── Stellar ──────────────────────────────────────────────────────────────────
# REQUIRED — 'testnet' or 'mainnet'
STELLAR_NETWORK=testnet

# REQUIRED — Horizon API base URL
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org

# OPTIONAL — explicit network passphrase; derived from STELLAR_NETWORK if absent
STELLAR_NETWORK_PASSPHRASE=Test SDF Network ; September 2015

# ─── Stellar auth secrets (at least one required for auth to work) ─────────────
# Fallback secret key used when network-specific keys are absent
STELLAR_PLATFORM_SECRET_KEY=

# Network-specific overrides (take precedence over STELLAR_PLATFORM_SECRET_KEY)
TESTNET_AUTH_SECRET_KEY=
MAINNET_AUTH_SECRET_KEY=

# ─── Platform ─────────────────────────────────────────────────────────────────
# REQUIRED — Stellar public key (starts with G) that receives payments
PLATFORM_RECEIVING_ACCOUNT=G...

# REQUIRED in production; defaults to 'http://localhost:3000'
FRONTEND_URL=http://localhost:3000

# REQUIRED in production; defaults to 'http://localhost:3001'
PLATFORM_DOMAIN=http://localhost:3001

# ─── Checkout ─────────────────────────────────────────────────────────────────
# OPTIONAL — session TTL in minutes; defaults to 30
CHECKOUT_SESSION_TTL_MINUTES=30

# OPTIONAL — SEP-10 auth challenge TTL in seconds; defaults to 300
CHALLENGE_TTL_SECONDS=300

# ─── CORS ─────────────────────────────────────────────────────────────────────
# OPTIONAL — comma-separated list of allowed merchant origins
CORS_ALLOWED_ORIGINS=http://localhost:3000

# ─── Redis cursor ─────────────────────────────────────────────────────────────
# OPTIONAL — Horizon payment cursor TTL in Redis; defaults to 24h
REDIS_CURSOR_TTL_HOURS=24

# ─── Webhook worker ───────────────────────────────────────────────────────────
# OPTIONAL — poll interval in ms; defaults to 250
WEBHOOK_POLL_MS=250

# OPTIONAL — max concurrent deliveries; defaults to 100
WEBHOOK_MAX_CONCURRENCY=100

# OPTIONAL — set to 'true' to disable the webhook worker process
WEBHOOK_WORKER_DISABLED=false

# ─── Security ─────────────────────────────────────────────────────────────────
# OPTIONAL — override the default Content-Security-Policy header value
CONTENT_SECURITY_POLICY=