@zintrust/core 0.4.15 → 0.4.17

package/src/cli/scaffolding/templates/env.scaffold.dotenv.tpl

@@ -0,0 +1,561 @@
+# ZinTrust — Project Environment (.env)
+#
+# Generated by: zin new / ProjectScaffolder
+#
+# Notes:
+# - No $VAR interpolation: compatible with standard Node dotenv behavior.
+# - Secrets are intentionally empty unless auto-generated (APP_KEY).
+# - For the complete key list (auto-generated), see: -envexample.generated
+
+# ============================================================================
+# APP
+# ============================================================================
+
+# Environment: development | production | testing
+NODE_ENV=development
+
+APP_NAME={{APP_NAME}}
+HOST=localhost
+PORT={{PORT}}
+BASE_URL={{BASE_URL}}
+
+# Runtime override (optional): auto | nodejs | cloudflare | deno | lambda
+RUNTIME=
+
+# Developer toggles
+DEBUG=true
+METRICS_ENABLED=false
+
+# Cloudflare Workers (TCP sockets) — set true if using TCP adapters on Workers.
+ENABLE_CLOUDFLARE_SOCKETS=false
+
+# CLI / tooling
+ZINTRUST_RUN_FROM_SOURCE=0
+ZINTRUST_VERSION_CHECK=true
+ZINTRUST_VERSION_CHECK_INTERVAL=24
+ZINTRUST_CLI_DEBUG_ARGS=0
+
+# Optional debug output (local only)
+ZIN_DEBUG_VALIDATION_BODY=false
+ZIN_DEBUG_BODY_PARSING=false
+ZIN_DEBUG_FILE_UPLOAD=false
+
+
+# ============================================================================
+# STARTUP (boot-time checks)
+# ============================================================================
+
+STARTUP_HEALTH_CHECKS=true
+STARTUP_VALIDATE_SECRETS=true
+
+# Strict required-env validation. Recommended for new projects.
+STARTUP_REQUIRE_ENV=true
+
+STARTUP_CHECK_DB=false
+STARTUP_CHECK_CACHE=false
+STARTUP_HEALTH_TIMEOUT_MS=2500
+STARTUP_CONTINUE_ON_FAILURE=false
+
+
+# ============================================================================
+# SECURITY (keys, auth, headers)
+# ============================================================================
+
+# Auto-generated secure APP_KEY for encryption interoperability (32 bytes, base64).
+APP_KEY={{APP_KEY}}
+
+# Optional: key rotation support (comma-separated OR JSON array of base64 keys)
+APP_PREVIOUS_KEYS=
+
+# Supported: aes-256-cbc | aes-256-gcm
+ENCRYPTION_CIPHER=aes-256-cbc
+
+JWT_ENABLED=true
+# If empty, JWT uses APP_KEY in dev. For production, set a dedicated JWT_SECRET.
+JWT_SECRET=
+
+# Bulletproof Auth signing secret (SignedRequest proof-of-possession).
+# If empty, ZinTrust will fallback to APP_KEY (convenient, but not recommended).
+# Strongly recommended: set a dedicated BULLETPROOF_SIGNING_SECRET.
+# Rotation: old secrets can be kept in BULLETPROOF_SIGNING_SECRET_BK as a JSON array.
+BULLETPROOF_SIGNING_SECRET=
+BULLETPROOF_SIGNING_SECRET_BK=[]
+JWT_ALGORITHM=HS256
+JWT_EXPIRES_IN=3600
+JWT_REFRESH_EXPIRES_IN=7d
+JWT_ISSUER=zintrust
+JWT_AUDIENCE=zintrust-api
+
+# JWT revocation (token invalidation)
+# Options: database | redis | kv | kv-remote | memory
+JWT_REVOCATION_DRIVER=database
+JWT_REVOCATION_DB_CONNECTION=default
+JWT_REVOCATION_DB_TABLE=zintrust_jwt_revocations
+JWT_REVOCATION_REDIS_DB=0
+JWT_REVOCATION_REDIS_PREFIX=zt:jwt:revoked:
+JWT_REVOCATION_KV_BINDING=CACHE
+JWT_REVOCATION_KV_PREFIX=zt:jwt:revoked:
+
+API_KEY_ENABLED=false
+API_KEY_HEADER=x-api-key
+API_KEY_SECRET=
+
+CSRF_ENABLED=true
+CSRF_HEADER_NAME=x-csrf-token
+CSRF_TOKEN_NAME=_csrf
+CSRF_COOKIE_NAME=XSRF-TOKEN
+
+# Local dev often uses http; set true in production.
+CSRF_COOKIE_SECURE=false
+CSRF_COOKIE_HTTP_ONLY=true
+CSRF_COOKIE_SAME_SITE=lax
+
+# Comma-separated path globs that skip CSRF checks.
+CSRF_SKIP_PATHS=/api/*,/queue-monitor/*,/api/_sys/queue/*,/api/_sys/schedule/*
+
+CORS_ENABLED=true
+CORS_ORIGINS=*
+CORS_METHODS=GET,POST,PUT,PATCH,DELETE
+CORS_ALLOWED_HEADERS=Content-Type,Authorization
+CORS_EXPOSED_HEADERS=
+CORS_CREDENTIALS=false
+CORS_MAX_AGE=86400
+
+RATE_LIMIT_ENABLED=true
+RATE_LIMIT_WINDOW_MS=900000
+RATE_LIMIT_MAX_REQUESTS=100
+RATE_LIMIT_MESSAGE=Too many requests, please try again later
+
+HELMET_ENABLED=true
+CSP_ENABLED=false
+HSTS_ENABLED=false
+HSTS_MAX_AGE=31536000
+HSTS_INCLUDE_SUBDOMAINS=true
+XSS_ENABLED=true
+XSS_REPORT_URI=
+
+SESSION_NAME=zintrust_session
+SESSION_SECRET=
+SESSION_EXPIRES_IN=1800000
+SESSION_SECURE=false
+SESSION_HTTP_ONLY=true
+SESSION_SAME_SITE=lax
+
+PASSWORD_MIN_LENGTH=8
+PASSWORD_REQUIRE_UPPERCASE=true
+PASSWORD_REQUIRE_NUMBERS=true
+PASSWORD_REQUIRE_SPECIAL_CHARS=true
+BCRYPT_ROUNDS=10
+
+
+# ============================================================================
+# DEPLOYMENT / LIMITS
+# ============================================================================
+
+ENVIRONMENT=development
+REQUEST_TIMEOUT=30000
+APP_TIMEZONE=UTC
+MAX_BODY_SIZE=10485760
+SHUTDOWN_TIMEOUT=10000
+
+
+# ============================================================================
+# DATABASE
+# ============================================================================
+
+# Options: sqlite | postgresql | mysql | sqlserver | d1 | d1-remote
+DB_CONNECTION={{DB_CONNECTION}}
+
+# SQLite (recommended for local dev)
+DB_PATH={{SQLITE_DB_PATH}}
+
+# Generic SQL defaults (used by some adapters)
+DB_HOST=localhost
+DB_PORT=5432
+DB_DATABASE=
+DB_USERNAME=postgres
+DB_PASSWORD=
+DB_READ_HOSTS=
+
+# PostgreSQL (optional)
+DB_PORT_POSTGRESQL=5432
+DB_DATABASE_POSTGRESQL=postgres
+DB_USERNAME_POSTGRESQL=postgres
+DB_PASSWORD_POSTGRESQL=
+DB_READ_HOSTS_POSTGRESQL=
+
+# SQL Server (MSSQL) (optional)
+DB_HOST_MSSQL=localhost
+DB_PORT_MSSQL=1433
+DB_DATABASE_MSSQL=zintrust
+DB_USERNAME_MSSQL=sa
+DB_PASSWORD_MSSQL=
+DB_READ_HOSTS_MSSQL=
+
+# Pooling / logging (optional)
+DB_POOLING=true
+DB_POOL_MIN=5
+DB_POOL_MAX=20
+DB_IDLE_TIMEOUT=30000
+DB_CONNECTION_TIMEOUT=10000
+DB_SSL=false
+DB_LOG_QUERIES=false
+DB_LOG_LEVEL=info
+DB_MIGRATION_EXT=ts
+
+# Database overrides (generated by scaffolder)
+{{DB_LINES}}
+
+
+# ============================================================================
+# CLOUDFLARE (D1 / KV)
+# ============================================================================
+
+D1_DATABASE_ID=
+KV_NAMESPACE_ID=
+
+# Remote D1 (outside Cloudflare) via proxy
+D1_REMOTE_URL=
+D1_REMOTE_KEY_ID=
+D1_REMOTE_SECRET=
+D1_REMOTE_MODE=registry
+
+# Remote KV (outside Cloudflare) via proxy
+KV_REMOTE_URL=
+KV_REMOTE_KEY_ID=
+KV_REMOTE_SECRET=
+KV_REMOTE_NAMESPACE=
+
+# Cloudflare API (only needed for CLI provisioning)
+CLOUDFLARE_ACCOUNT_ID=
+CLOUDFLARE_API_TOKEN=
+CLOUDFLARE_KV_NAMESPACE_ID=
+
+
+# ============================================================================
+# HTTP PROXIES (for Workers compatibility)
+# ============================================================================
+
+ZT_PROXY_TIMEOUT_MS=30000
+ZT_PROXY_SIGNING_WINDOW_MS=60000
+
+USE_MYSQL_PROXY=false
+MYSQL_PROXY_URL=
+MYSQL_PROXY_HOST=127.0.0.1
+MYSQL_PROXY_PORT=8789
+MYSQL_PROXY_MAX_BODY_BYTES=131072
+MYSQL_PROXY_POOL_LIMIT=10
+MYSQL_PROXY_KEY_ID=
+MYSQL_PROXY_SECRET=
+MYSQL_PROXY_TIMEOUT_MS=30000
+MYSQL_PROXY_REQUIRE_SIGNING=true
+MYSQL_PROXY_SIGNING_WINDOW_MS=60000
+
+USE_POSTGRES_PROXY=false
+POSTGRES_PROXY_URL=
+POSTGRES_PROXY_HOST=127.0.0.1
+POSTGRES_PROXY_PORT=8790
+POSTGRES_PROXY_MAX_BODY_BYTES=131072
+POSTGRES_PROXY_POOL_LIMIT=10
+POSTGRES_PROXY_KEY_ID=
+POSTGRES_PROXY_SECRET=
+POSTGRES_PROXY_TIMEOUT_MS=30000
+POSTGRES_PROXY_REQUIRE_SIGNING=true
+POSTGRES_PROXY_SIGNING_WINDOW_MS=60000
+
+USE_REDIS_PROXY=false
+REDIS_PROXY_URL=
+REDIS_PROXY_HOST=127.0.0.1
+REDIS_PROXY_PORT=8791
+REDIS_PROXY_MAX_BODY_BYTES=131072
+REDIS_PROXY_KEY_ID=
+REDIS_PROXY_SECRET=
+REDIS_PROXY_TIMEOUT_MS=30000
+REDIS_PROXY_REQUIRE_SIGNING=true
+REDIS_PROXY_SIGNING_WINDOW_MS=60000
+
+USE_SMTP_PROXY=false
+SMTP_PROXY_URL=
+SMTP_PROXY_HOST=127.0.0.1
+SMTP_PROXY_PORT=8794
+SMTP_PROXY_MAX_BODY_BYTES=131072
+SMTP_PROXY_KEY_ID=
+SMTP_PROXY_SECRET=
+SMTP_PROXY_TIMEOUT_MS=30000
+SMTP_PROXY_REQUIRE_SIGNING=true
+SMTP_PROXY_SIGNING_WINDOW_MS=60000
+
+USE_MONGODB_PROXY=false
+MONGODB_PROXY_URL=
+MONGODB_PROXY_HOST=127.0.0.1
+MONGODB_PROXY_PORT=8792
+MONGODB_PROXY_MAX_BODY_BYTES=131072
+MONGODB_PROXY_KEY_ID=
+MONGODB_PROXY_SECRET=
+MONGODB_PROXY_TIMEOUT_MS=30000
+MONGODB_PROXY_REQUIRE_SIGNING=true
+MONGODB_PROXY_SIGNING_WINDOW_MS=60000
+
+USE_SQLSERVER_PROXY=false
+SQLSERVER_PROXY_URL=
+SQLSERVER_PROXY_HOST=127.0.0.1
+SQLSERVER_PROXY_PORT=8793
+SQLSERVER_PROXY_MAX_BODY_BYTES=131072
+SQLSERVER_PROXY_POOL_LIMIT=10
+SQLSERVER_PROXY_KEY_ID=
+SQLSERVER_PROXY_SECRET=
+SQLSERVER_PROXY_TIMEOUT_MS=30000
+SQLSERVER_PROXY_REQUIRE_SIGNING=true
+SQLSERVER_PROXY_SIGNING_WINDOW_MS=60000
+
+
+# ============================================================================
+# CACHE / REDIS
+# ============================================================================
+
+CACHE_DRIVER=memory
+CACHE_CONNECTION=
+CACHE_KEY_PREFIX=zintrust:
+
+CACHE_MEMORY_TTL=3600
+CACHE_REDIS_TTL=3600
+CACHE_MONGO_TTL=3600
+CACHE_KV_TTL=3600
+
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_PASSWORD=
+REDIS_DB=0
+REDIS_QUEUE_DB=1
+REDIS_URL=
+
+REDIS_HTTPS_ENDPOINT=
+REDIS_HTTPS_TOKEN=
+
+MONGO_URI=
+MONGO_DB=zintrust_cache
+
+
+# ============================================================================
+# QUEUE
+# ============================================================================
+
+# Options: sync | memory | database | redis | rabbitmq | sqs
+QUEUE_DRIVER=sync
+QUEUE_CONNECTION=
+
+QUEUE_TABLE=jobs
+QUEUE_DB_CONNECTION=default
+
+FAILED_JOBS_DB_CONNECTION=default
+FAILED_JOBS_TABLE=failed_jobs
+
+QUEUE_JOB_TIMEOUT=60
+QUEUE_JOB_RETRIES=3
+QUEUE_JOB_BACKOFF=0
+QUEUE_WORKERS=1
+QUEUE_MEMORY_TTL=3600000
+
+QUEUE_MONITOR_ENABLED=false
+QUEUE_MONITOR_BASE_PATH=/queue-monitor
+QUEUE_MONITOR_MIDDLEWARE=
+QUEUE_MONITOR_AUTO_REFRESH=true
+QUEUE_MONITOR_REFRESH_MS=5000
+
+QUEUE_HTTP_PROXY_ENABLED=false
+QUEUE_HTTP_PROXY_GATEWAY_ENABLED=true
+QUEUE_HTTP_PROXY_URL=
+QUEUE_HTTP_PROXY_PATH=/api/_sys/queue/rpc
+QUEUE_HTTP_PROXY_KEY_ID=
+QUEUE_HTTP_PROXY_KEY=
+QUEUE_HTTP_PROXY_TIMEOUT_MS=30000
+QUEUE_HTTP_PROXY_MAX_SKEW_MS=60000
+QUEUE_HTTP_PROXY_NONCE_TTL_MS=120000
+QUEUE_HTTP_PROXY_MIDDLEWARE=
+
+
+# ============================================================================
+# WORKERS / SCHEDULER
+# ============================================================================
+
+WORKER_ENABLED=true
+WORKER_AUTO_START=false
+WORKER_CONCURRENCY=5
+WORKER_TIMEOUT=60
+WORKER_RETRIES=3
+WORKER_PRIORITY=1
+WORKER_HEALTH_CHECK_INTERVAL=60
+WORKER_CLUSTER_MODE=true
+WORKER_REGION=us-east-1
+
+WORKER_PERSISTENCE_DRIVER=memory
+WORKER_PERSISTENCE_TABLE=zintrust_workers
+WORKER_PERSISTENCE_DB_CONNECTION=default
+WORKER_PERSISTENCE_REDIS_DB=
+WORKER_PERSISTENCE_REDIS_KEY_PREFIX=
+
+WORKER_SHUTDOWN_ON_APP_EXIT=true
+
+SCHEDULES_ENABLED=false
+SCHEDULE_SHUTDOWN_TIMEOUT_MS=30000
+
+SCHEDULE_OVERLAP_LOCK_TTL_MS=300000
+SCHEDULE_OVERLAP_LOCK_ACQUIRE_TIMEOUT_MS=2000
+
+SCHEDULE_LEADER_ENABLED=false
+SCHEDULE_LEADER_LOCK_PROVIDER=memory
+SCHEDULE_LEADER_LOCK_KEY=scheduler:leader
+SCHEDULE_LEADER_LOCK_TTL_MS=30000
+SCHEDULE_LEADER_LOCK_RENEW_MS=15000
+SCHEDULE_LEADER_LOCK_RETRY_MS=5000
+SCHEDULE_LEADER_LOCK_ACQUIRE_TIMEOUT_MS=2000
+
+SCHEDULE_HTTP_PROXY_PATH=/api/_sys/schedule/rpc
+SCHEDULE_HTTP_PROXY_KEY_ID=
+SCHEDULE_HTTP_PROXY_KEY=
+SCHEDULE_HTTP_PROXY_MAX_SKEW_MS=60000
+SCHEDULE_HTTP_PROXY_NONCE_TTL_MS=120000
+SCHEDULE_HTTP_PROXY_MIDDLEWARE=
+
+JOB_TRACKING_CLEANUP_ENABLED=false
+JOB_TRACKING_CLEANUP_INTERVAL_MS=21600000
+JOB_TRACKING_CLEANUP_RETENTION_DAYS=30
+JOB_TRACKING_CLEANUP_RETENTION_HOURS=
+JOB_TRACKING_CLEANUP_BATCH_SIZE=5000
+JOB_TRACKING_CLEANUP_MAX_BATCHES=1
+JOB_TRACKING_CLEANUP_LOCK_PROVIDER=memory
+
+
+# ============================================================================
+# SSE
+# ============================================================================
+
+SSE_HEARTBEAT_INTERVAL=15000
+SSE_SNAPSHOT_INTERVAL=5000
+
+
+# ============================================================================
+# LOGGING
+# ============================================================================
+
+LOG_LEVEL=debug
+LOG_FORMAT=text
+LOG_CHANNEL=file
+DISABLE_LOGGING=false
+LOG_HTTP_REQUEST=false
+LOG_TO_FILE=false
+LOG_ROTATION_SIZE=10485760
+LOG_ROTATION_DAYS=7
+DOCKER_WORKER=false
+
+
+# ============================================================================
+# MAIL
+# ============================================================================
+
+MAIL_DRIVER=disabled
+MAIL_CONNECTION=
+MAIL_FROM_ADDRESS=
+MAIL_FROM_NAME=
+MAIL_HOST=
+MAIL_PORT=587
+MAIL_USERNAME=
+MAIL_PASSWORD=
+MAIL_SECURE=starttls
+SENDGRID_API_KEY=
+MAILGUN_API_KEY=
+MAILGUN_DOMAIN=
+MAILGUN_BASE_URL=https://api.mailgun.net
+
+
+# ============================================================================
+# STORAGE
+# ============================================================================
+
+STORAGE_CONNECTION=local
+STORAGE_PATH=storage
+STORAGE_URL=/storage
+STORAGE_VISIBILITY=private
+TEMP_PATH=storage/temp
+TEMP_FILE_MAX_AGE=86400
+MAX_UPLOAD_SIZE=100mb
+ALLOWED_UPLOAD_MIMES=jpg,jpeg,png,pdf,doc,docx
+UPLOADS_PATH=storage/uploads
+BACKUP_DRIVER=s3
+BACKUPS_PATH=storage/backups
+
+AWS_REGION=us-east-1
+AWS_DEFAULT_REGION=
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_SESSION_TOKEN=
+AWS_S3_BUCKET=
+AWS_S3_ENDPOINT=
+AWS_S3_URL=
+AWS_S3_USE_PATH_STYLE_URL=false
+AWS_SQS_QUEUE_URL=
+
+R2_ACCESS_KEY_ID=
+R2_SECRET_ACCESS_KEY=
+R2_REGION=
+R2_BUCKET=
+R2_ENDPOINT=
+R2_URL=
+R2_BINDING=
+
+GCS_PROJECT_ID=
+GCS_KEY_FILE=
+GCS_BUCKET=
+GCS_URL=
+
+
+# ============================================================================
+# BROADCAST
+# ============================================================================
+
+BROADCAST_CONNECTION=inmemory
+PUSHER_APP_ID=
+PUSHER_APP_KEY=
+PUSHER_APP_SECRET=
+PUSHER_APP_CLUSTER=
+PUSHER_USE_TLS=true
+BROADCAST_REDIS_HOST=
+BROADCAST_REDIS_PORT=
+BROADCAST_REDIS_PASSWORD=
+BROADCAST_CHANNEL_PREFIX=broadcast:
+
+
+# ============================================================================
+# NOTIFICATIONS
+# ============================================================================
+
+NOTIFICATION_CONNECTION=console
+TERMII_API_KEY=
+TERMII_SENDER=ZinTrust
+TERMII_ENDPOINT=https://api.termii.com/sms/send
+TWILIO_ACCOUNT_SID=
+TWILIO_AUTH_TOKEN=
+TWILIO_FROM_NUMBER=
+SLACK_WEBHOOK_URL=
+
+
+# ============================================================================
+# OBSERVABILITY (optional)
+# ============================================================================
+
+OTEL_ENABLED=false
+OTEL_EXPORTER_OTLP_ENDPOINT=
+TRACING_EXPORT_INTERVAL=
+JAEGER_AGENT_HOST=
+
+
+# ============================================================================
+# CI / SCANNING (optional)
+# ============================================================================
+
+SNYK_TOKEN=
+SONAR_ORGANIZATION=
+SONAR_PROJECT_ID=
+SONAR_HOST_URL=
+SONAR_TOKEN=
+CODECOV_TOKEN=