.env.example

# Bazaar API runtime configuration
# Copy this file to .env for local development and replace every placeholder secret.

# Runtime mode
# development allows bounded in-memory fallback. production always requires Redis.
APP_ENV=development

# Server
BIND_ADDR=127.0.0.1:22417

# MongoDB
MONGODB_URI=mongodb://localhost:27017
MONGODB_DB=skyblock

# Admin authentication
# Required for /admin and /api/v2/admin/*.
ADMIN_API_KEY=change-this-admin-key

# User API key hashing
# Use a long random value. Rotating this value requires reissuing or migrating API keys.
API_KEY_HASH_PEPPER=change-this-api-key-hash-pepper

# Redis shared security store
# Required for production/multi-instance deployments. All API servers must use the same Redis.
REDIS_URL=
# Set true in development when you want to test fail-closed Redis behavior.
REQUIRE_REDIS=false

# CORS
# Comma-separated public API origins. Empty means allow any origin only in development.
CORS_ALLOWED_ORIGINS=

# Proxy/IP handling
# TRUST_PROXY only trusts X-Forwarded-For from peers inside TRUSTED_PROXY_CIDRS.
TRUST_PROXY=false
TRUSTED_PROXY_CIDRS=

# Admin cookie
# Defaults to true in production and false in development if unset.
ADMIN_COOKIE_SECURE=false

# Local fallback limits
CACHE_MAX_ENTRIES=10000
RATE_LIMIT_MAX_KEYS=50000
# API-key/anonymous rate limits and daily quotas are synced to Redis in local batches
# (anonymous batches are capped at 16 per IP). 1 disables batching. Batches refill in the
# background before they run out, so requests do not wait on Redis round trips.
# Batching favors users on failure: unsynced local requests may be extra allowance, never early loss.
RATE_LIMIT_RESERVATION_SIZE=128
ADMIN_JSON_LIMIT_BYTES=16384

# Hot path middleware
# Defaults: request logging/compression on in development, off in production.
# If Cloudflare or another edge handles gzip, keep app compression off in production.
REQUEST_LOGGING=
RESPONSE_COMPRESSION=