.env.example

# Neo4j Configuration
NEO4J_URI=bolt://localhost:7687
NEO4J_USER=neo4j
NEO4J_PASSWORD=your-neo4j-password

PUBLIC_EVAULT_SERVER_URI=http://localhost:4000

# Rate limiting (requests per minute). These are the defaults; limits set from
# the control panel's Rate Limits page override them without a restart.
RATE_LIMIT_PER_PLATFORM=250
RATE_LIMIT_PER_IP=500
# Shared by evault-core and the control panel to manage rate limit rules. The
# admin API is disabled while this is empty. Use a long random value.
RATE_LIMIT_ADMIN_SECRET=""
# Leave empty when clients reach evault-core directly. Behind a reverse proxy,
# set the proxies' addresses (e.g. "10.0.0.5" or "10.0.0.0/8"), or every client
# is rate limited as the proxy's IP. A hop count (e.g. 1) also works, but only
# if evault-core cannot be reached except through the proxy.
EVAULT_TRUST_PROXY=""

REGISTRY_ENTROPY_KEY_JWK='{"kty":"EC","use":"sig","alg":"ES256","kid":"entropy-key-1","crv":"P-256","x":"your-x-value","y":"your-y-value","d":"your-d-value"}'
ENCRYPTION_PASSWORD="your-encryption-password"
W3ID="@your-w3id"

REGISTRY_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/registry

REGISTRY_SHARED_SECRET="your-registry-shared-secret"
PROVISIONER_DATABASE_URL="postgres://postgres:postgres@localhost:5432/provisioner"
PUBLIC_VERIFF_KEY="your-veriff-key"
VERIFF_HMAC_KEY="your-veriff-hmac-key"

# Didit KYC
DIDIT_API_KEY="your-didit-api-key"
DIDIT_WORKFLOW_ID="your-didit-workflow-id"
DIDIT_WEBHOOK_SECRET="your-didit-webhook-secret"

# Provisioner signing key (32-byte hex seed for ed25519)
PROVISIONER_SIGNING_SEED="your-32-byte-hex-seed"
PROVISIONER_KID="provisioner-1"

# set this to allow or deny
DUPLICATES_POLICY="DENY"
IP_ADDR="localhost"

PICTIQUE_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/pictique

PICTIQUE_MAPPING_DB_PATH=/path/to/pictique/mapping/db
BLABSY_MAPPING_DB_PATH="/path/to/blabsy/mapping/db"
DREAMSYNC_MAPPING_DB_PATH="/path/to/dreamsync/mapping/db"
GROUP_CHARTER_MAPPING_DB_PATH=/path/to/charter/mapping/db
CERBERUS_MAPPING_DB_PATH=/path/to/cerberus/mapping/db

GOOGLE_APPLICATION_CREDENTIALS="/Users/sosweetham/projs/metastate/prototype/secrets/eid-w-firebase-adminsdk.json"

# Notification Trigger (APNS/FCM toy platform)
NOTIFICATION_TRIGGER_PORT=3998
# Full URL for control panel proxy (optional; defaults to http://localhost:NOTIFICATION_TRIGGER_PORT)
NOTIFICATION_TRIGGER_URL=http://localhost:3998
# APNS (iOS) - from Apple Developer
APNS_KEY_PATH="/Users/sosweetham/projs/metastate/prototype/secrets/AuthKey_A3BBXD9YR3.p8"
APNS_KEY_ID="A3BBXD9YR3"
APNS_TEAM_ID="M49C8XS835"
APNS_BUNDLE_ID="com.example.app"
APNS_PRODUCTION=false
# Broadcast push (Live Activities) - base64 channel ID
APNS_BROADCAST_CHANNEL_ID=znbhuBJCEfEAAMIJbS9xUw==

#PUBLIC_REGISTRY_URL="https://registry.w3ds.metastate.foundation"
#PUBLIC_PROVISIONER_URL="https://provisioner.w3ds.metastate.foundation"

#PUBLIC_REGISTRY_URL="https://registry.staging.metastate.foundation"
#PUBLIC_PROVISIONER_URL="https://provisioner.staging.metastate.foundation"

PUBLIC_REGISTRY_URL="http://localhost:4321"
PUBLIC_PROVISIONER_URL="http://localhost:3001"

PUBLIC_PICTIQUE_URL="http://localhost:5173"
PUBLIC_PICTIQUE_BASE_URL="http://localhost:1111"
PUBLIC_BLABSY_URL="http://localhost:8080"
PUBLIC_BLABSY_BASE_URL="http://localhost:4444"

PUBLIC_GROUP_CHARTER_BASE_URL="http://localhost:5555"
GROUP_CHARTER_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/group_charter_manager

CERBERUS_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/cerberus
PUBLIC_CERBERUS_BASE_URL="http://localhost:6666"

EVOTING_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/evoting

EVOTING_MAPPING_DB_PATH="/path/to/evoting/mapping/db"

OPENAI_API_KEY=sk-your-openai-api-key

PUBLIC_EVOTING_BASE_URL="http://localhost:7777"
PUBLIC_EVOTING_URL="http://localhost:3001"

# Translation corrections served to the wallet at runtime, so wording fixes
# ship without an app store release. Leave empty to use only the strings
# compiled into the build. Release builds want the docs site, which serves the
# catalog `pnpm translations:build` generates.
#PUBLIC_TRANSLATIONS_URL="https://docs.w3ds.metastate.foundation/translations.json"
PUBLIC_TRANSLATIONS_URL=""

PUBLIC_APP_STORE_EID_WALLET=""
PUBLIC_PLAY_STORE_EID_WALLET=""
NOTIFICATION_SHARED_SECRET=your-notification-secret-key

# Shared secret between eid-wallet frontend and evault-core provisioner
# Backend reads PROVISIONER_SHARED_SECRET, wallet reads PUBLIC_PROVISIONER_SHARED_SECRET
PROVISIONER_SHARED_SECRET="your-provisioner-shared-secret"
PUBLIC_PROVISIONER_SHARED_SECRET="your-provisioner-shared-secret"

PUBLIC_ESIGNER_BASE_URL="http://localhost:3004"
PUBLIC_FILE_MANAGER_BASE_URL="http://localhost:3005"
PUBLIC_PROFILE_EDITOR_BASE_URL=http://localhost:3007

DREAMSYNC_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/dreamsync
VITE_DREAMSYNC_BASE_URL="http://localhost:8888"

EREPUTATION_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/ereputation
EREPUTATION_MAPPING_DB_PATH="/path/to/erep/mapping/db"
VITE_EREPUTATION_BASE_URL=http://localhost:8765
PUBLIC_EREPUTATION_BASE_URL=http://localhost:8765

LOAD_TEST_USER_COUNT=6

PUBLIC_EID_WALLET_TOKEN=obtained-from-post-registry-service-/platforms/certification

LOKI_URL=http://localhost:3100
LOKI_USERNAME=admin
LOKI_PASSWORD=admin

# Control Panel
PUBLIC_CONTROL_PANEL_URL=http://localhost:5173
CONTROL_PANEL_JWT_SECRET=replace-with-a-strong-secret
CONTROL_PANEL_ADMIN_ENAMES_FILE=config/admin-enames.json
VISUALIZER_API_KEY=

DREAMSYNC_JWT_SECRET="secret"
ECURRENCY_JWT_SECRET="secret"
EREPUTATION_JWT_SECRET="secret"
ESIGNER_JWT_SECRET="secret"
EMOVER_JWT_SECRET="secret"
FILE_MANAGER_JWT_SECRET="secret"
CHARTER_JWT_SECRET="secret"
PICTIQUE_JWT_SECRET="secret"


# Awareness as a Service (AaaS)
# Connection string for the AaaS Postgres database
AWARENESS_DATABASE_URL="postgres://postgres:postgres@localhost:5432/awareness"
AWARENESS_API_PORT=4100
# Public base URL of the AaaS API (used to build W3DS auth callbacks)
AWARENESS_PUBLIC_URL="http://localhost:4100"
# Shared secret evault-core must present on POST /ingest
AWARENESS_INGEST_SECRET="replace-with-a-strong-secret"
# Where evault-core forwards every awareness packet
AWARENESS_SERVICE_URL="http://localhost:4100"
# Comma-separated eNames allowed to act as AaaS portal admins
AAAS_ADMIN_ENAMES=""

# DigitalOcean Spaces object storage (S3-compatible) — used by eVault core to
# store file blobs and expose public URIs for the w3ds://file URI scheme.
DO_SPACES_ENDPOINT="https://nyc3.digitaloceanspaces.com"
DO_SPACES_REGION="nyc3"
DO_SPACES_KEY="your-spaces-access-key"
DO_SPACES_SECRET="your-spaces-secret-key"
DO_SPACES_BUCKET="your-spaces-bucket"
# Optional public/CDN base URL; defaults to the bucket sub-domain on the endpoint
DO_SPACES_CDN_URL=""
# Secret used to sign AaaS portal session JWTs
AAAS_JWT_SECRET="replace-with-a-strong-secret"
# Webhook delivery worker runs in the same AaaS process as the HTTP API.
AWARENESS_DELIVERY_POLL_MS=2000
AWARENESS_DELIVERY_LEASE_MS=30000
AWARENESS_DELIVERY_BATCH_TIMEOUT_MS=25000
# Retry downstream webhooks for 24 hours before dead-lettering.
AWARENESS_DELIVERY_RETRY_WINDOW_MS=86400000
AWARENESS_WORKER_HEARTBEAT_MS=10000
AWARENESS_WORKER_STALE_MS=30000
# Bound every Postgres operation so one poisoned connection cannot wedge AaaS.
AWARENESS_DB_STATEMENT_TIMEOUT_MS=10000
AWARENESS_DB_QUERY_TIMEOUT_MS=12000
AWARENESS_DB_LOCK_TIMEOUT_MS=5000
# Durable eVault -> AaaS outbox tuning. Ingest retries never expire.
AWARENESS_OUTBOX_POLL_MS=1000
AWARENESS_OUTBOX_LEASE_MS=30000
AWARENESS_OUTBOX_DB_TIMEOUT_MS=10000
AWARENESS_OUTBOX_RETENTION_MS=604800000
# Claiming reads candidates a page at a time and keeps paging while the batch is
# short, so events blocked behind an unfinished predecessor cannot starve the
# ones behind them. Page size x page cap bounds the work one cycle can do.
AWARENESS_OUTBOX_CANDIDATE_PAGE=500
AWARENESS_OUTBOX_MAX_CLAIM_PAGES=10
# The one-time Neo4j backfill reuses the standard NEO4J_URI / NEO4J_USER /
# NEO4J_PASSWORD vars at the top of this file - it reads evault-core's graph
# directly, so there are no AaaS-specific Neo4j vars.
# Portal -> API base URL
PUBLIC_AWARENESS_API_URL="http://localhost:4100"
# Consumer API key (aaas_...) issued from the AaaS portal, used by platforms
# that read the packet history (marketplace, profile-editor, ppa)
AWARENESS_API_KEY=""

# ---------------------------------------------------------------------------
# Post Platforms Association (PPA) - services/ppa
# Admin app where whitelisted reviewers issue signed L1-L5 access decisions on
# platforms that publish a profile with `inSubmission: true`.
# ---------------------------------------------------------------------------
# Public base URL: the w3ds://auth callback target and the `iss` of every
# signed statement. Must match where the app is actually reachable.
PPA_PUBLIC_URL="http://localhost:4210"
# Signs the admin session cookie
PPA_JWT_SECRET="replace-with-a-strong-secret"
# ES256 private JWK signing every accreditation; generate with:
#   pnpm --filter ppa generate-jwk
# Left unset in dev an ephemeral key is used and statements stop verifying
# after a restart.
PPA_SIGNING_JWK=""
# Admin whitelist. The JSON file is authoritative and hot-reloads; the csv is
# merged in for deployments where mounting a file is awkward.
PPA_ADMIN_ENAMES_FILE="config/admin-enames.json"
PPA_ADMIN_ENAMES=""
# AaaS consumer key used to read platform submissions; falls back to
# AWARENESS_API_KEY when unset.
PPA_AWARENESS_API_KEY=""
# The messenger platform is discovered on the network by its platformName.
# How to link into it comes from the handles that platform publishes, so there
# is no path to configure here.
# Forge hosting submitted repositories. The signed release statement carries
# owner/name but no host, so without this the repository is shown as plain text.
PPA_REPOSITORY_BASE_URL=""
PPA_MESSENGER_PLATFORM_NAME="meshenger"
# Path that opens a conversation with one person. Only used when the messenger
# publishes no handle for the User ontology; a declared handle always wins.
PPA_MESSENGER_CONTACT_PATH="/contacts/{ename}"

# W3DS OIDC Connector (services/w3ds-oidc-connector)
# Public origin of the connector: no path, https in production
# (hosted at https://oidc.w3ds.metastate.foundation)
W3DS_OIDC_ISSUER="http://localhost:4200"
W3DS_OIDC_PORT=4200
W3DS_OIDC_PLATFORM_NAME="W3DS Login"
# ES256 private JWK; generate with `pnpm --filter w3ds-oidc-connector generate-jwk`.
# Leave empty in dev for an ephemeral key. Required in production.
W3DS_OIDC_SIGNING_KEY_JWK=
# Postgres database holding the self-service OIDC clients.
# Apply migrations with `pnpm --filter w3ds-oidc-connector migrate`.
W3DS_OIDC_DATABASE_URL="postgresql://postgres:postgres@localhost:5432/w3ds_oidc"
# Signs developer portal sessions (at least 32 characters). Leave empty in dev
# for an ephemeral key. Required in production.
W3DS_OIDC_PORTAL_SECRET=
# How many clients one eName may create per hour
W3DS_OIDC_CLIENT_CREATE_LIMIT=10
# Where the developer portal links for documentation and provider guides
W3DS_OIDC_DOCS_URL="https://docs.w3ds.metastate.foundation/docs/Services"
W3DS_OIDC_SESSION_TTL_SECONDS=300
W3DS_OIDC_CODE_TTL_SECONDS=60
W3DS_OIDC_TOKEN_TTL_SECONDS=300
W3DS_OIDC_UPSTREAM_TIMEOUT_MS=5000
W3DS_OIDC_TRUST_PROXY=