Skip to content

docs: cover missing environment settings and safe examples #187

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
isaacsamual994-lang wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: cover missing environment settings and safe examples #187

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 35 additions & 1 deletion ENVIRONMENT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,41 @@ sensitive values are never committed or leaked to the browser.
| `NEXT_PUBLIC_HORIZON_URL` | Yes | Horizon HTTP base URL for account reads |
| `NEXT_PUBLIC_SOROBAN_RPC_URL` | Yes | Optional Soroban RPC URL (future contract calls) |
| `NEXT_PUBLIC_CONTRACT_ID` | Yes | Optional deployed contract ID (`C...`) |
| `NODE_ENV` | Yes | Set by Next.js / Node — do not override with secrets |
| `NEXT_PUBLIC_SEED_DEMO_DATA` | Yes | Optional; `false` by default. Set `true` to seed in-memory demo data on the first local task API read; ignored when `NODE_ENV=production` |
| `NODE_ENV` | Yes | Set automatically by Next.js / Node (`development`, `test`, or `production`) |

## Optional server-side API rate limiting

These variables are read by `frontend/src/lib/rate-limit.ts` on the server;
they are **not** `NEXT_PUBLIC_*` variables and must not be copied into
browser-side configuration.

| Variable | Example | Default | Purpose |
|----------|---------|---------|---------|
| `API_RATE_LIMIT_ENABLED` | `true` | Disabled | Explicit opt-in to API rate-limit enforcement; only the literal string `true` enables it |
| `API_RATE_LIMIT_MAX_REQUESTS` | `60` | `60` | Maximum requests allowed per window |
| `API_RATE_LIMIT_WINDOW_MS` | `60000` | `60000` | Window duration in milliseconds |

Set these in the server deployment environment rather than committing a
populated `.env` file. The in-memory limiter is per runtime instance; it
does not provide global cross-instance enforcement.

### Quick reference for a local frontend

```dotenv
# Browser-visible; use TESTNET for local wallet experiments
NEXT_PUBLIC_STELLAR_NETWORK=TESTNET
NEXT_PUBLIC_HORIZON_URL=https://horizon-testnet.stellar.org
# Optional; leave empty unless configured
NEXT_PUBLIC_SOROBAN_RPC_URL=
NEXT_PUBLIC_CONTRACT_ID=
NEXT_PUBLIC_SEED_DEMO_DATA=false

# Server-only; optional
API_RATE_LIMIT_ENABLED=false
API_RATE_LIMIT_MAX_REQUESTS=60
API_RATE_LIMIT_WINDOW_MS=60000
```

Server-only secrets (if introduced later) must:

Expand Down
6 changes: 6 additions & 0 deletions frontend/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,3 +32,9 @@ NEXT_PUBLIC_CONTRACT_ID=
# Set to true to auto-seed the in-memory demo data when the local task API is first read.
# This is ignored in production.
NEXT_PUBLIC_SEED_DEMO_DATA=false

# Optional server-side API rate limiting (never prefix these with NEXT_PUBLIC_).
# Enforcement is disabled unless API_RATE_LIMIT_ENABLED=true.
# API_RATE_LIMIT_ENABLED=false
# API_RATE_LIMIT_MAX_REQUESTS=60
# API_RATE_LIMIT_WINDOW_MS=60000