-
Notifications
You must be signed in to change notification settings - Fork 4
Expand file tree
/
Copy path.env.production.example
More file actions
124 lines (96 loc) · 3.92 KB
/
Copy path.env.production.example
File metadata and controls
124 lines (96 loc) · 3.92 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
# Production Environment Variables
# NEVER commit actual values to git
# ============================================
# KMS Configuration (Choose one)
# ============================================
# AWS KMS
KMS_PROVIDER=aws
AWS_REGION=us-east-1
AWS_KMS_KEY_ID=arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012
# Azure Key Vault
# KMS_PROVIDER=azure
# AZURE_KEY_VAULT_URL=https://your-vault.vault.azure.net/
# AZURE_CLIENT_ID=your-client-id
# AZURE_CLIENT_SECRET=your-client-secret
# AZURE_TENANT_ID=your-tenant-id
# HashiCorp Vault
# KMS_PROVIDER=hashicorp
# VAULT_ADDR=https://vault.example.com
# VAULT_TOKEN=your-vault-token
# VAULT_NAMESPACE=your-namespace
# ============================================
# Encrypted Keys (stored in KMS)
# ============================================
# These should be encrypted references, not actual keys
ETHEREUM_DEPLOYER_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
BSC_DEPLOYER_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
SOLANA_DEPLOYER_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
# ============================================
# API Keys (encrypted)
# ============================================
ETHEREUM_RPC_API_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
BSC_RPC_API_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
SOLANA_RPC_API_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
COINGECKO_API_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
# ============================================
# Security Configuration
# ============================================
# Key rotation intervals (milliseconds)
KEY_ROTATION_INTERVAL_DEPLOYER=2592000000 # 30 days
KEY_ROTATION_INTERVAL_API=7776000000 # 90 days
KEY_ROTATION_INTERVAL_SIGNING=604800000 # 7 days
# Rate limiting
RATE_LIMIT_WINDOW_MS=60000 # 1 minute
RATE_LIMIT_MAX_REQUESTS=100
# Security headers
SECURITY_HEADERS_CSP="default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline';"
SECURITY_HEADERS_HSTS="max-age=31536000; includeSubDomains"
# ============================================
# Monitoring & Alerting
# ============================================
# Sentry
SENTRY_DSN=https://your-key@sentry.io/your-project
SENTRY_ENVIRONMENT=production
SENTRY_TRACES_SAMPLE_RATE=0.1
# DataDog
DATADOG_API_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
DATADOG_APP_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
# PagerDuty (for critical alerts)
PAGERDUTY_INTEGRATION_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
# ============================================
# Infrastructure
# ============================================
# CDN
CDN_URL=https://cdn.tokenforge.com
CDN_PURGE_KEY_ENCRYPTED=encrypted:base64encodedciphertext...
# Database (if using external)
DATABASE_URL_ENCRYPTED=encrypted:base64encodedciphertext...
DATABASE_REPLICA_URLS=replica1.example.com,replica2.example.com
# Redis (for distributed caching)
REDIS_URL_ENCRYPTED=encrypted:base64encodedciphertext...
REDIS_CLUSTER_NODES=redis1:6379,redis2:6379,redis3:6379
# ============================================
# Compliance & Audit
# ============================================
# Audit log retention (days)
AUDIT_LOG_RETENTION_DAYS=2555 # 7 years
# Data encryption at rest
ENCRYPTION_AT_REST_KEY_ID=your-kms-key-for-data-encryption
# Backup configuration
BACKUP_S3_BUCKET=tokenforge-backups-prod
BACKUP_ENCRYPTION_KEY_ID=your-kms-key-for-backups
BACKUP_RETENTION_DAYS=90
# ============================================
# Feature Flags
# ============================================
ENABLE_BONDING_CURVE=true
ENABLE_SOCIAL_SHARING=true
ENABLE_TESTNET_DEPLOYMENT=false
ENABLE_MAINNET_DEPLOYMENT=true
MAINTENANCE_MODE=false
# ============================================
# Emergency Contacts
# ============================================
EMERGENCY_CONTACT_EMAIL=security@tokenforge.com
EMERGENCY_CONTACT_PHONE=+1-xxx-xxx-xxxx
ON_CALL_WEBHOOK_ENCRYPTED=encrypted:base64encodedciphertext...