backend/.env.example at main · EuphoriaTheme/backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
# ------------------------------------------------------------
# Core server
# ------------------------------------------------------------
PORT=3000
HOST=0.0.0.0
# direct: no reverse proxy
# nginx: trust x-real-ip / x-forwarded-for from Nginx
# cloudflare: trust cf-connecting-ip / true-client-ip and forwarded chain
PROXY_MODE=direct

# Enable trusted proxy parsing for request.ip
TRUST_PROXY=false

# Number of proxy hops to trust when proxy mode is enabled
TRUST_PROXY_HOPS=1

# Max request body size in bytes (default: 1 MB)
REQUEST_BODY_LIMIT_BYTES=1048576

# Request lifecycle timeouts (milliseconds)
REQUEST_TIMEOUT_MS=15000
CONNECTION_TIMEOUT_MS=10000
KEEP_ALIVE_TIMEOUT_MS=5000

# Enable/disable JSONL request logging to logs/YYYY-MM-DD.log
REQUEST_LOGGING_ENABLED=false

# Fastify console logging controls
FASTIFY_LOG_LEVEL=info
FASTIFY_DISABLE_REQUEST_LOGGING=true

# CORS controls
# If your reverse proxy already adds CORS headers, set CORS_ENABLED=false
# to avoid duplicate Access-Control-Allow-Origin values (for example "*,*").
CORS_ENABLED=true
CORS_ORIGIN=*
CORS_METHODS=GET,POST,PUT,PATCH,DELETE,OPTIONS,HEAD

# Flush api_stats.json interval (milliseconds)
API_STATS_FLUSH_INTERVAL_MS=5000

# ------------------------------------------------------------
# License API integration
# ------------------------------------------------------------
LICENSE_API_V1_URL=https://license.euphoriadevelopment.uk/api/v1/validate
# OpenAPI-backed v2 endpoint used by current code
LICENSE_API_V2_URL=https://licensing.euphoriadevelopment.uk/api/licenses/validate
# Optional bearer token for protected v2 licensing endpoint
LICENSE_API_V2_TOKEN=
LICENSE_API_TIMEOUT_MS=10000
LICENSE_API_MAX_RETRIES=1

# ------------------------------------------------------------
# Translation API safeguards/cache
# ------------------------------------------------------------
MAX_TRANSLATION_ITEMS=250
MAX_TRANSLATION_TEXT_LENGTH=256
LANGUAGE_LIST_CACHE_TTL_MS=30000

# ------------------------------------------------------------
# Background sync: Blueprint extensions
# ------------------------------------------------------------
BLUEPRINT_EXTENSIONS_URL=https://api.blueprintframe.work/api/extensions
BLUEPRINT_EXTENSIONS_FALLBACK_URL=https://blueprint.zip/api/extensions
BLUEPRINT_SYNC_INTERVAL_MS=86400000
BLUEPRINT_SYNC_TIMEOUT_MS=20000
BLUEPRINT_SYNC_USER_AGENT=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
BLUEPRINT_SYNC_ORIGIN=https://blueprintframe.work
BLUEPRINT_SYNC_REFERER=https://blueprintframe.work/

# Set one of these if Cloudflare challenge blocks source fetches
BLUEPRINT_SYNC_CF_CLEARANCE=
BLUEPRINT_SYNC_COOKIE=

# ------------------------------------------------------------
# Background sync: Translations
# ------------------------------------------------------------
TRANSLATIONS_REPO_OWNER=EuphoriaTheme
TRANSLATIONS_REPO_NAME=blueprint-translations
TRANSLATIONS_REPO_REF=main
TRANSLATIONS_SYNC_INTERVAL_MS=86400000
TRANSLATIONS_SYNC_TIMEOUT_MS=20000
TRANSLATIONS_SYNC_GITHUB_TOKEN=

# Optional fallback token used by translation sync
GITHUB_TOKEN=

# ------------------------------------------------------------
# Legacy/optional values present in existing deployments
# ------------------------------------------------------------
# Not used by current Fastify runtime, but kept for compatibility.
SESSION_SECRET=change-this-to-a-long-random-string

# Security middleware variables from previous setup.
# Keep only if your deployment still uses external/security wrappers.
SECURITY_TRUST_PROXY_HEADERS=true
SECURITY_RATE_LIMIT_ENABLED=true
SECURITY_RATE_LIMIT_WINDOW_MS=60000
SECURITY_RATE_LIMIT_MAX_REQUESTS=120
SECURITY_RATE_LIMIT_BAN_MS=300000
SECURITY_RATE_LIMIT_EXEMPT_PATHS=/health
SECURITY_BANLIST_ENABLED=true
SECURITY_BANLIST_FILE=config/banlist.json
SECURITY_BANLIST_RELOAD_MS=5000