DATABASE_URL="postgresql://DB_USER:DB_PASSWORD@DB_HOST:5432/DB_NAME?schema=public"
NOVAPAY_PUBLIC_BASE_URL="http://localhost:3000"
NOVAPAY_DATA_ENCRYPTION_KEY="CHANGE_TO_A_32_BYTE_SECRET_KEY"
ADMIN_BOOTSTRAP_EMAIL="admin@example.com"
ADMIN_BOOTSTRAP_PASSWORD="CHANGE_ME"
ADMIN_BOOTSTRAP_NAME="Platform Administrator"
PAYMENT_EXPIRE_MINUTES="30"
CALLBACK_TIMEOUT_MS="10000"
CALLBACK_MAX_ATTEMPTS="6"
CALLBACK_RETRY_INTERVAL_SECONDS="60"
CALLBACK_WORKER_BATCH_SIZE="20"
CALLBACK_WORKER_INTERVAL_MS="5000"
FINANCE_WORKER_INTERVAL_MS="60000"
ONCHAIN_WORKER_INTERVAL_MS="15000"
SETTLEMENT_HOLD_DAYS="1"
MERCHANT_SIGNATURE_MAX_AGE_SECONDS="300"
USDT_RATE_PRIMARY_SOURCE="coingecko"
USDT_RATE_SECONDARY_SOURCE="coinpaprika"
USDT_RATE_FIXED_CNY="7.2"
USDT_RATE_MIN_CNY="6.0"
USDT_RATE_MAX_CNY="8.5"
USDT_QUOTE_TTL_SECONDS="900"
USDT_QUOTE_SPREAD_BPS="150"
USDT_TAIL_STEP="0.0001"
USDT_TAIL_MAX="0.0099"
USDT_TAIL_RELATIVE_MAX_BPS="30"
USDT_EVM_LOOKBACK_BLOCKS="180"
USDT_SOL_SIGNATURE_LIMIT="50"
USDT_BSC_RPC_URL=""
USDT_BSC_TOKEN_CONTRACT=""
USDT_BSC_CONFIRMATIONS="12"
# usdt.base 通道现已指向 Polygon (马蹄链)。变量名保留 BASE 仅为兼容历史 channelCode；
# 实际链由下方 RPC + 合约地址决定。Polygon USDT 合约: 0xc2132D05D31c914a87C6611C10748AEb04B58e8F
USDT_BASE_RPC_URL=""
USDT_BASE_TOKEN_CONTRACT=""
USDT_BASE_CONFIRMATIONS="12"
USDT_SOL_RPC_URL=""
USDT_SOL_MINT=""
USDT_SOL_CONFIRMATIONS="1"

# Merchant-owned channel credentials and upstream callback URLs are configured
# per channel instance in the merchant console, not in platform env vars.

# ── Security hardening (added 2026-07-26) ─────────────────────────────────────
# Auth token for internal endpoints (/api/internal/*). Set a long random value
# in production; server-to-server callers pass it as the `x-internal-token`
# header. When unset, those endpoints require an authenticated SUPER_ADMIN.
NOVAPAY_INTERNAL_API_TOKEN=""
# Trusted client-IP header that your edge always overwrites. The production
# compose/nginx config injects x-novapay-client-ip; never point this directly at
# a client-controlled header without an equivalent edge overwrite rule.
TRUSTED_CLIENT_IP_HEADER=""
# Number of trusted proxies in front of the app (picks the right X-Forwarded-For
# hop when no trusted header is set). Default 1.
TRUSTED_PROXY_COUNT="1"
# Successful notifications must include the paid amount outside development and
# test. Set to 0 only as a temporary compatibility exception for a legacy channel.
NOVAPAY_REQUIRE_NOTIFICATION_AMOUNT=""
# EasyPay requests require a fresh timestamp outside development and test.
# Set to 0 only while migrating a legacy caller that cannot send timestamps.
EASYPAY_REQUIRE_TIMESTAMP=""
# EASYPAY_TIMESTAMP_MAX_AGE_SECONDS="300"
# Set to 1 ONLY in a controlled env to allow installing plugin bundles from a
# registry source with no trust public key (unsigned). Default = refuse.
NOVAPAY_ALLOW_UNSIGNED_PLUGINS=""
# Third-party REMOTE_SIGNED runtime code is disabled by default. Official
# novapay.* entries always use the implementation built into the app image.
# Setting this to 1 executes third-party plugin code in the main process and is
# a temporary, unsafe compatibility escape hatch only.
NOVAPAY_ALLOW_UNSAFE_REMOTE_PLUGIN_RUNTIME=""