frontend/.env.local.example at main · Zenith-options/frontend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
# ---------------------------------------------------------------------------
# Zenith environment configuration (local development)
# Copy to `.env.local` and fill in real values. Never commit `.env.local`.
# ---------------------------------------------------------------------------

# Public base URL of the app (used for OAuth callbacks, anchor redirects, etc.)
NEXT_PUBLIC_APP_URL=http://localhost:3000

# Stellar network: "testnet" | "mainnet"
# Select the Stellar network used by the app: testnet or mainnet.
NEXT_PUBLIC_STELLAR_NETWORK=testnet

# Soroban RPC / Horizon endpoints
NEXT_PUBLIC_SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
NEXT_PUBLIC_HORIZON_URL=https://horizon-testnet.stellar.org

# ---------------------------------------------------------------------------
# Soroban RPC configuration (server-side only)
# ---------------------------------------------------------------------------
# Comma-separated list of Soroban RPC endpoints. The server-side RPC client
# tracks per-provider health, fails over automatically, and circuit-breaks
# providers that repeatedly error. Order is the failover preference order.
# Production builds fail fast if this is missing or empty.
SOROBAN_RPC_URLS=https://soroban-testnet.stellar.org

# Soroban network passphrase used to build/verify transactions.
SOROBAN_NETWORK_PASSPHRASE=Test SDF Network ; September 2015

# Bounded concurrency for batched vault list / multi-vault balance reads.
SOROBAN_RPC_MAX_CONCURRENCY=4

# Retry policy for read-only RPC calls (bounded attempts, exponential
# backoff with jitter). Signed transactions are never re-submitted.
SOROBAN_RPC_MAX_ATTEMPTS=3
SOROBAN_RPC_BASE_BACKOFF_MS=200
SOROBAN_RPC_MAX_BACKOFF_MS=2000

# Circuit breaker: consecutive errors before a provider is tripped, and how
# long (ms) it stays open before a half-open probe is allowed.
SOROBAN_RPC_CIRCUIT_THRESHOLD=5
SOROBAN_RPC_CIRCUIT_COOLDOWN_MS=30000

# Read-after-write: how long (ms) to wait for ledger inclusion and re-read
# affected state before responding with a 'pending confirmation' status.
SOROBAN_RPC_CONFIRMATION_TIMEOUT_MS=15000

# ---------------------------------------------------------------------------
# Fiat on-ramp / off-ramp (SEP-24 interactive, SEP-6 non-interactive)
#
# Anchor endpoints are configured per network. Leave a network's anchor URL
# blank to disable fiat on/off-ramp for that network — the "Fund from bank"
# and "Cash out" entry points are hidden when no anchor is configured.
#
# Anchor credentials are server-side only (used by the BFF proxy at
# /api/anchor/*). Do NOT prefix these with NEXT_PUBLIC_.
# ---------------------------------------------------------------------------

# --- Testnet anchor ---
ANCHOR_TESTNET_HOME_DOMAIN=
ANCHOR_TESTNET_SEP24_URL=
ANCHOR_TESTNET_SEP6_URL=
ANCHOR_TESTNET_SIGNING_KEY=

# --- Mainnet anchor ---
ANCHOR_MAINNET_HOME_DOMAIN=
ANCHOR_MAINNET_SEP24_URL=
ANCHOR_MAINNET_SEP6_URL=
ANCHOR_MAINNET_SIGNING_KEY=

# Assets the configured anchor supports for fiat on/off-ramp (comma-separated
# asset codes, e.g. "USDC"). Used to gate the entry points per selected asset.
ANCHOR_SUPPORTED_ASSETS=USDC

# Sentry error monitoring (Issue #106)
# Get your DSN from https://sentry.io → Project → Settings → Client Keys
NEXT_PUBLIC_SENTRY_DSN=
# CI-only — source map upload
SENTRY_AUTH_TOKEN=
SENTRY_ORG=
SENTRY_PROJECT=

# NODE_ENV is set by Next.js for dev/build/start and normally should not be overridden.

# Feature flags
# URL for the remote JSON config (optional — falls back to safe defaults)
# NEXT_PUBLIC_FLAGS_URL=https://your-cdn.example.com/flags/config.json
# FLAGS_CONFIG_URL=https://your-cdn.example.com/flags/config.json  # server-only (more secure)

# Vaults data source: "mock" (default, uses MOCK_VAULTS) or "live" (needs /api/v1/vaults on the backend)
# NEXT_PUBLIC_VAULTS=mock

# Enable the real paginated history endpoint (client adapter used when unset)
# NEXT_PUBLIC_HISTORY_PAGINATION=1

# Per-flag env overrides — set to "1" or "true" to force a flag on
# These outrank remote config and are baked in at build time. Leave
# NEXT_PUBLIC_FLAG_VAULTS unset in staging and production so the remote-config
# kill switch works. See docs/feature-flag-rollout.md.
# NEXT_PUBLIC_FLAG_SOROBAN_EXECUTION=1
# NEXT_PUBLIC_FLAG_GOVERNANCE=1
# NEXT_PUBLIC_FLAG_VAULTS=1
# NEXT_PUBLIC_FLAG_NEW_ORDER_TYPES=1
# NEXT_PUBLIC_FLAG_PORTFOLIO_SCENARIOS=1
# NEXT_PUBLIC_FLAG_ADVANCED_ANALYTICS=1

# Vault admin key custody (Issue #269)
# Privileged vault signing keys live in a managed KMS/HSM and are NEVER
# configured here. Only non-secret signer configuration belongs in env.
# The signer service exposes a narrow "sign this approved intent" API and
# enforces per-role policy (allowed contracts, entry points, amount ceilings)
# server-side before invoking KMS. See security/key-management-policy.md.
#
# Signer backend: "kms" (production, managed KMS/HSM) or "software"
# (local development only — clearly labeled, never for production).
VAULT_SIGNER_BACKEND=software
# Base URL of the KMS/HSM-backed signing service (server-only).
# VAULT_SIGNER_KMS_ENDPOINT=
# KMS key identifiers per role — these are key references, not key material.
# Each role is independently rotatable by swapping its key reference.
# VAULT_SIGNER_KEY_REF_ADMIN=
# VAULT_SIGNER_KEY_REF_PARAMETER=
# VAULT_SIGNER_KEY_REF_ORACLE=
# VAULT_SIGNER_KEY_REF_PAUSE=
# VAULT_SIGNER_KEY_REF_TREASURY=
# Path to the per-role policy file (allowed contracts/entry points/ceilings).
# VAULT_SIGNER_POLICY_PATH=./security/vault-signer-policy.json
# Administrative audit trail sink for privileged signature events.
# VAULT_SIGNER_AUDIT_LOG_PATH=./.audit/vault-signer.log

# ---------------------------------------------------------------------------
# Internal service-to-service trust (Issue #289)
# ---------------------------------------------------------------------------
# These values are REFERENCES into a managed secret store (Vault / AWS Secrets
# Manager / GCP Secret Manager), never the secret material itself. Do not paste
# real tokens, private keys, or certificates here. The backend resolves each
# reference at boot and fails closed if it cannot.
#
# Local dev bypass: set SERVICE_AUTH_DEV_BYPASS=true to skip mTLS and signed
# service tokens on localhost only. src/env.ts refuses to boot in production
# when this is enabled, so it cannot leak into a deployed environment.
SERVICE_AUTH_DEV_BYPASS=false

# Managed-store references for the mTLS material used between internal
# services (BFF, API, indexer, scheduler, keeper).
# SERVICE_MTLS_CA_REF=secret://vault-stack/internal-ca
# SERVICE_MTLS_CERT_REF=secret://vault-stack/bff-client-cert
# SERVICE_MTLS_KEY_REF=secret://vault-stack/bff-client-key

# Short-lived signed service tokens. Each service gets its own signing key
# reference and a narrow scope claim; tokens rotate and are never shared.
# SERVICE_TOKEN_TTL_SECONDS=300
# SERVICE_TOKEN_CLOCK_SKEW_SECONDS=30
# SERVICE_TOKEN_BFF_SIGNING_KEY_REF=secret://vault-stack/bff-token-key
# SERVICE_TOKEN_API_SIGNING_KEY_REF=secret://vault-stack/api-token-key
# SERVICE_TOKEN_INDEXER_SIGNING_KEY_REF=secret://vault-stack/indexer-token-key
# SERVICE_TOKEN_SCHEDULER_SIGNING_KEY_REF=secret://vault-stack/scheduler-token-key
# SERVICE_TOKEN_KEEPER_SIGNING_KEY_REF=secret://vault-stack/keeper-token-key

# Egress allowlist — outbound destinations internal services may reach.
# Anything not listed is denied and logged/alerted. Comma-separated hosts.
# EGRESS_ALLOWLIST=soroban-testnet.stellar.org,horizon-testnet.stellar.org,api.coingecko.com,api.resend.com