singlewindow/.env.compose.example at main · munisp/singlewindow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
# TradeGateway™ NGSWTP — Docker Compose Environment TEMPLATE (SW-S2-4)
#
# The committed .env.compose with real-shaped credentials was REMOVED in Phase-6.
# Secrets are env-only: copy this file to .env (git-ignored), fill in every
# REQUIRED value with a strong unique secret (openssl rand -hex 32), and never
# commit the result. Services refuse to boot when a REQUIRED secret is unset.
#
#   cp .env.compose.example .env   # then edit
#
# Lines marked REQUIRED have NO default anywhere in the codebase.

# ─── PostgreSQL ───────────────────────────────────────────────────────────────
POSTGRES_USER=tradegateway
POSTGRES_PASSWORD=REQUIRED__openssl_rand_hex_32
POSTGRES_DB=tradegateway
POSTGRES_PORT=5432

# ─── Redis ────────────────────────────────────────────────────────────────────
REDIS_PASSWORD=REQUIRED__openssl_rand_hex_32
REDIS_PORT=6379

# ─── Keycloak ─────────────────────────────────────────────────────────────────
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=REQUIRED__openssl_rand_hex_32
KEYCLOAK_REALM=tradegateway
KEYCLOAK_CLIENT_ID=tradegateway-api
KEYCLOAK_CLIENT_SECRET=REQUIRED__openssl_rand_hex_32
KEYCLOAK_WEBHOOK_SECRET=REQUIRED__openssl_rand_hex_32
# Audience + issuer enforced by every service middleware (SW-S2-6)
KEYCLOAK_EXPECTED_AUDIENCE=tradegateway-api

# ─── OpenSearch ───────────────────────────────────────────────────────────────
OPENSEARCH_PASSWORD=REQUIRED__openssl_rand_hex_32

# ─── Kafka ────────────────────────────────────────────────────────────────────
KAFKA_BROKERS=kafka:9092

# ─── Node API ─────────────────────────────────────────────────────────────────
NODE_ENV=development
APP_PORT=3000
JWT_SECRET=REQUIRED__openssl_rand_hex_32

# ─── Webhook secrets (boot-fatal unset/dev-valued in production, SW-MP10) ─────
OGA_WEBHOOK_SECRET=REQUIRED__openssl_rand_hex_32
CEP_WEBHOOK_SECRET=REQUIRED__openssl_rand_hex_32
SANCTIONS_WEBHOOK_SECRET=REQUIRED__openssl_rand_hex_32
MOJALOOP_WEBHOOK_SECRET=REQUIRED__openssl_rand_hex_32

# ─── rustfs-svc (SW-S2-5) ─────────────────────────────────────────────────────
RUSTFS_ACCESS_KEY=REQUIRED__openssl_rand_hex_16
RUSTFS_SECRET_KEY=REQUIRED__openssl_rand_hex_32
RUSTFS_SERVICE_TOKEN=REQUIRED__openssl_rand_hex_32

# ─── APISIX (SW-S2-4 — no default admin key anywhere) ─────────────────────────
APISIX_ADMIN_KEY=REQUIRED__openssl_rand_hex_32

# ─── Neo4j / FalkorDB graph stack (SW-S2-4) ───────────────────────────────────
NEO4J_PASSWORD=REQUIRED__openssl_rand_hex_32

# ─── MinIO lakehouse (SW-S2-4) ────────────────────────────────────────────────
MINIO_ACCESS_KEY=REQUIRED__openssl_rand_hex_16
MINIO_SECRET_KEY=REQUIRED__openssl_rand_hex_32

# ─── Wazuh (SW-S2-4) ──────────────────────────────────────────────────────────
WAZUH_PASSWORD=REQUIRED__openssl_rand_hex_32

# ─── Object storage (optional external S3) ────────────────────────────────────
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_REGION=us-east-1
S3_ENDPOINT=http://rustfs:9000
S3_BUCKET=tradegateway-docs

# ─── Temporal ─────────────────────────────────────────────────────────────────
TEMPORAL_HOST=temporal
TEMPORAL_PORT=7233
TEMPORAL_NAMESPACE=tradegateway

# ─── Grafana ──────────────────────────────────────────────────────────────────
GRAFANA_USER=admin
GRAFANA_PASSWORD=REQUIRED__openssl_rand_hex_32

# ─── Demo mode — DEV/CI ONLY. Production refuses to boot when true (SW-24) ────
DEMO_MODE=false

# ─── Analytics pipeline ───────────────────────────────────────────────────────
PIPELINE_MODE=dev

# ─── Phase-6 boot-fatal service tokens (SW-B; services refuse to boot unset) ──
MOJALOOP_CALLBACK_SECRET=REQUIRED__openssl_rand_hex_32
PAYMENT_SERVICE_TOKEN=REQUIRED__openssl_rand_hex_32
DECLARATION_SERVICE_TOKEN=REQUIRED__openssl_rand_hex_32
TRADE_FINANCE_SERVICE_TOKEN=REQUIRED__openssl_rand_hex_32
BANK_CALLBACK_SECRET=REQUIRED__openssl_rand_hex_32
DECLARATION_ENGINE_JWT_SECRET=REQUIRED__openssl_rand_hex_32

# ─── Sanctions list provenance (SW-B group2: no fabricated lists) ─────────────
# Either a local directory of signed list snapshots, or egress URLs to fetch
# the real OFAC SDN / UN consolidated lists. Boot fails if neither is set.
SANCTIONS_LIST_DIR=
OFAC_LIST_URL=https://www.treasury.gov/ofac/downloads/sdn.xml
UN_LIST_URL=https://scsanctions.un.org/resources/xml/en/consolidated.xml
SANCTIONS_MAX_AGE_HOURS=24

# ─── Internal CA bundle for service-to-service TLS verification ──────────────
INTERNAL_CA_BUNDLE_PATH=

# ─── Payment service tariff upstream + drawback four-eyes threshold ──────────
# PRA-100: consumed by server/_core/tariffClient.ts (declarations.assessDuty).
# Unset => tariff calls fail closed (explicit configuration error, never a
# fabricated rate). Production: required + non-local (validateProductionConfig).
TARIFF_SERVICE_URL=http://tariff-service:8080
# Bearer token the gateway presents to the tariff engine. In production this
# must be a Keycloak-verifiable service token (the engine verifies RS256);
# non-production engine profiles accept any bearer as the requester subject.
TARIFF_SERVICE_TOKEN=
DRAWBACK_FOUR_EYES_THRESHOLD_MINOR=5000000

# ─── Phase-6 migrations (drizzle/migrations) ─────────────────────────────────
# 0051_phase6_compliance.sql + 0052_phase6_rls.sql MUST be applied at deploy
# time. ALTER TYPE ... ADD VALUE statements must run OUTSIDE transaction
# blocks; the RLS migration requires a non-BYPASSRLS application role.
# See PRODUCTION-RUNBOOK.md.