.env.example

# =============================================================================
# Bridge Watch — Environment Variables
# Copy this file to .env and fill in your values.
#   cp .env.example .env
# =============================================================================

# -----------------------------------------------------------------------------
# Application
# -----------------------------------------------------------------------------
NODE_ENV=development
PORT=3001
WS_PORT=3002

# -----------------------------------------------------------------------------
# PostgreSQL + TimescaleDB
# -----------------------------------------------------------------------------
POSTGRES_HOST=localhost
POSTGRES_PORT=5432
POSTGRES_DB=bridge_watch
POSTGRES_USER=bridge_watch
POSTGRES_PASSWORD=${POSTGRES_PASSWORD_PLACEHOLDER}   # [SENSITIVE] DO NOT COMMIT REAL VALUES

# -----------------------------------------------------------------------------
# Redis
# -----------------------------------------------------------------------------
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=${REDIS_PASSWORD_PLACEHOLDER}   # [SENSITIVE] DO NOT COMMIT REAL VALUES
REDIS_CACHE_TTL_SEC=300

# -----------------------------------------------------------------------------
# Stellar Network
# -----------------------------------------------------------------------------
STELLAR_NETWORK=testnet
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
SOROBAN_MAINNET_RPC_URL=https://soroban-rpc.stellar.org
HORIZON_TIMEOUT_MS=30000

# Soroban contract IDs
CIRCUIT_BREAKER_CONTRACT_ID=
LIQUIDITY_CONTRACT_ADDRESS=

# -----------------------------------------------------------------------------
# Ethereum / EVM Chains
# -----------------------------------------------------------------------------
RPC_PROVIDER_TYPE=http

# Ethereum Mainnet
ETHEREUM_RPC_URL=${ETHEREUM_RPC_URL_PLACEHOLDER}   # [SENSITIVE] e.g. https://mainnet.infura.io/v3/<KEY>
ETHEREUM_RPC_WS_URL=${ETHEREUM_RPC_WS_URL_PLACEHOLDER}   # [SENSITIVE]
ETHEREUM_RPC_FALLBACK_URL=${ETHEREUM_RPC_FALLBACK_URL_PLACEHOLDER}   # [SENSITIVE]

# Polygon
POLYGON_RPC_URL=${POLYGON_RPC_URL_PLACEHOLDER}   # [SENSITIVE]
POLYGON_RPC_FALLBACK_URL=${POLYGON_RPC_FALLBACK_URL_PLACEHOLDER}   # [SENSITIVE]

# Base
BASE_RPC_URL=${BASE_RPC_URL_PLACEHOLDER}   # [SENSITIVE]
BASE_RPC_FALLBACK_URL=${BASE_RPC_FALLBACK_URL_PLACEHOLDER}   # [SENSITIVE]

# -----------------------------------------------------------------------------
# Bridge & Token Addresses (Ethereum Mainnet)
# -----------------------------------------------------------------------------
USDC_TOKEN_ADDRESS=0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48
USDC_BRIDGE_ADDRESS=0x55fe002a30Ad2d2D0cf70001042185dE33543204
EURC_TOKEN_ADDRESS=0x1aBaEA1f7df457398a0d4E980050846c85198C54
EURC_BRIDGE_ADDRESS=0xC138b627702652A0665D73D219f8090240596959

# -----------------------------------------------------------------------------
# External APIs
# -----------------------------------------------------------------------------
# Circle API
CIRCLE_API_KEY=${CIRCLE_API_KEY_PLACEHOLDER}   # [SENSITIVE]
CIRCLE_API_URL=https://api.circle.com/v1
CIRCLE_API_TIMEOUT_MS=10000
CIRCLE_CACHE_TTL_SEC=60
CIRCLE_RATE_LIMIT_MAX=100
CIRCLE_RATE_LIMIT_WINDOW_MS=60000

# Coinbase Advanced Trade API
COINBASE_API_KEY=${COINBASE_API_KEY_PLACEHOLDER}   # [SENSITIVE]
COINBASE_API_SECRET=${COINBASE_API_SECRET_PLACEHOLDER}   # [SENSITIVE]

# -----------------------------------------------------------------------------
# Rate Limiting
# -----------------------------------------------------------------------------
RATE_LIMIT_MAX=100
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_BURST_MULTIPLIER=2
# Comma-separated IPs to bypass rate limiting
RATE_LIMIT_WHITELIST_IPS=
# Comma-separated API keys to bypass rate limiting
RATE_LIMIT_WHITELIST_KEYS=

# -----------------------------------------------------------------------------
# Monitoring Thresholds
# -----------------------------------------------------------------------------
PRICE_DEVIATION_THRESHOLD=0.02
BRIDGE_SUPPLY_MISMATCH_THRESHOLD=0.1

# -----------------------------------------------------------------------------
# Background Jobs & Retries
# -----------------------------------------------------------------------------
RETRY_MAX=3
BRIDGE_VERIFICATION_INTERVAL_MS=300000

# -----------------------------------------------------------------------------
# Health Score Weights (must sum to 1.0)
# -----------------------------------------------------------------------------
HEALTH_WEIGHT_LIQUIDITY=0.25
HEALTH_WEIGHT_PRICE=0.25
HEALTH_WEIGHT_BRIDGE=0.20
HEALTH_WEIGHT_RESERVES=0.20
HEALTH_WEIGHT_VOLUME=0.10

# -----------------------------------------------------------------------------
# Export Service
# -----------------------------------------------------------------------------
EXPORT_STORAGE_PATH=./exports
EXPORT_DOWNLOAD_URL_EXPIRY_HOURS=24
EXPORT_COMPRESSION_THRESHOLD_BYTES=1048576
EXPORT_STREAMING_PAGE_SIZE=1000
EXPORT_QUEUE_CONCURRENCY=3
EXPORT_MAX_DATE_RANGE_DAYS=90

# -----------------------------------------------------------------------------
# Email Configuration (SMTP)
# -----------------------------------------------------------------------------
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=${SMTP_USER_PLACEHOLDER}   # [SENSITIVE]
SMTP_PASSWORD=${SMTP_PASSWORD_PLACEHOLDER}   # [SENSITIVE]
SMTP_FROM_ADDRESS=noreply@bridgewatch.io
SMTP_FROM_NAME=Bridge Watch

# -----------------------------------------------------------------------------
# Logging
# -----------------------------------------------------------------------------
LOG_LEVEL=info

# -----------------------------------------------------------------------------
# Docker Dev Tools (used by docker-compose.dev.yml only)
# -----------------------------------------------------------------------------
FRONTEND_PORT=5173
PGADMIN_EMAIL=admin@bridgewatch.dev
PGADMIN_PASSWORD=${PGADMIN_PASSWORD_PLACEHOLDER}   # [SENSITIVE] DO NOT COMMIT REAL VALUES
PGADMIN_PORT=5050
REDIS_COMMANDER_USER=admin
REDIS_COMMANDER_PASSWORD=${REDIS_COMMANDER_PASSWORD_PLACEHOLDER}   # [SENSITIVE]
REDIS_COMMANDER_PORT=8081

# =============================================================================
# Telegram Bot Integration (Issue #161)
# =============================================================================
# Telegram bot token from BotFather (@BotFather on Telegram)
# Obtain: Send /newbot to @BotFather, follow prompts
TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN_PLACEHOLDER}   # [SENSITIVE]

# Webhook URL for Telegram updates (production only)
# Must be HTTPS. Example: https://your-domain.com/api/v1/telegram/webhook
# Leave empty to use polling mode (development only)
TELEGRAM_WEBHOOK_URL=

# Webhook secret for HMAC signature verification
# Generate: openssl rand -hex 32
# Required if TELEGRAM_WEBHOOK_URL is set
TELEGRAM_WEBHOOK_SECRET=${TELEGRAM_WEBHOOK_SECRET_PLACEHOLDER}   # [SENSITIVE]

# Outbound message rate limits (Telegram API limits)
TELEGRAM_RATE_LIMIT_OUTBOUND_GLOBAL_PER_SEC=30
TELEGRAM_RATE_LIMIT_OUTBOUND_PER_CHAT_PER_SEC=1

# Inbound command rate limits (Bridge-Watch policy)
TELEGRAM_RATE_LIMIT_INBOUND_COMMANDS_PER_WINDOW=5
TELEGRAM_RATE_LIMIT_INBOUND_WINDOW_SEC=30

# Admin chat IDs for bootstrap (comma-separated)
# Used before users link Telegram accounts to app roles
# Leave empty to use AdminRotationService roles only
TELEGRAM_ADMIN_CHAT_IDS=

# Enable/disable Telegram bot entirely
TELEGRAM_BOT_ENABLED=true

# -----------------------------------------------------------------------------
# Security & CORS
# -----------------------------------------------------------------------------
# Comma-separated list of allowed origins in production (e.g. https://app.bridgewatch.io)
CORS_ALLOWED_ORIGINS=
# Bootstrap token for API keys administration
API_KEY_BOOTSTRAP_TOKEN=

# -----------------------------------------------------------------------------
# Advanced Logging
# -----------------------------------------------------------------------------
# File path to write logs to (if not set, writes to stdout)
LOG_FILE=
# Maximum log file size before rotation in bytes (default 100MB)
LOG_MAX_FILE_SIZE=104857600
# Maximum log files to retain
LOG_MAX_FILES=10
# Number of days to retain rotated logs
LOG_RETENTION_DAYS=30
# Log the full request bodies (warning: high volume/noise)
LOG_REQUEST_BODY=false
# Log the full response bodies
LOG_RESPONSE_BODY=false
# Allow logging sensitive data
LOG_SENSITIVE_DATA=false
# Threshold in milliseconds to count a request as slow (default 1s)
REQUEST_SLOW_THRESHOLD_MS=1000

# -----------------------------------------------------------------------------
# Enhanced Rate Limiting
# -----------------------------------------------------------------------------
RATE_LIMIT_ENABLE_DYNAMIC=true
RATE_LIMIT_GLOBAL_ALERT_THRESHOLD=0.9
RATE_LIMIT_BURST_ALERT_THRESHOLD=0.8
RATE_LIMIT_SUSTAINED_ALERT_THRESHOLD=0.7
RATE_LIMIT_STATS_RETENTION_HOURS=168
RATE_LIMIT_ENABLE_MONITORING=true
RATE_LIMIT_ADMIN_API_KEY_PREFIX=admin_

# Per-endpoint rate limits (requests per window)
RATE_LIMIT_ENDPOINT_ASSETS=200
RATE_LIMIT_ENDPOINT_BRIDGES=150
RATE_LIMIT_ENDPOINT_ALERTS=50
RATE_LIMIT_ENDPOINT_ANALYTICS=100
RATE_LIMIT_ENDPOINT_CONFIG=30
RATE_LIMIT_ENDPOINT_HEALTH=1000

# -----------------------------------------------------------------------------
# Price Caching & WebSocket
# -----------------------------------------------------------------------------
REDIS_PRICE_CACHE_PREFIX=price:aggregated
# Secret token required to subscribe to private WebSocket channels (e.g. "alerts")
WS_AUTH_SECRET=${WS_AUTH_SECRET_PLACEHOLDER}   # [SENSITIVE]

# -----------------------------------------------------------------------------
# Discord Bot Integration
# -----------------------------------------------------------------------------
DISCORD_BOT_TOKEN=${DISCORD_BOT_TOKEN_PLACEHOLDER}   # [SENSITIVE]
DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID_PLACEHOLDER}

# -----------------------------------------------------------------------------
# Health Check Configuration
# -----------------------------------------------------------------------------
HEALTH_CHECK_TIMEOUT_MS=5000
HEALTH_CHECK_INTERVAL_MS=30000
HEALTH_CHECK_MEMORY_THRESHOLD=90
HEALTH_CHECK_DISK_THRESHOLD=80
HEALTH_CHECK_EXTERNAL_APIS=true

# -----------------------------------------------------------------------------
# Maintenance Mode
# -----------------------------------------------------------------------------
MAINTENANCE_MODE=false
MAINTENANCE_MESSAGE=System is under maintenance
MAINTENANCE_SEVERITY=warning
STATUS_PAGE_URL=

# -----------------------------------------------------------------------------
# Data Validation
# -----------------------------------------------------------------------------
VALIDATION_STRICT_MODE=false
VALIDATION_ADMIN_BYPASS=true
VALIDATION_BATCH_SIZE=100
VALIDATION_MAX_BATCH_SIZE=1000
VALIDATION_DUPLICATE_CHECK=true
VALIDATION_NORMALIZATION=true
VALIDATION_CONSISTENCY_CHECKS=true
VALIDATION_ERROR_THRESHOLD=0.1
VALIDATION_WARNING_THRESHOLD=0.3
VALIDATION_DATA_QUALITY_THRESHOLD=70