openvibers/openvibe.trade .env.example
.env.example
| 1 | # ═══════════════════════════════════════════════════════════════ |
| 2 | # openvibe.trade — environment configuration (names only; never commit values) |
| 3 | # Copy to .env for development. Production: /etc/openvibe/trade.env (0600). |
| 4 | # Information only: there is no payment, brokerage or custody configuration, by design (ADR-025). |
| 5 | # ═══════════════════════════════════════════════════════════════ |
| 6 | |
| 7 | # Server |
| 8 | PORT=4860 |
| 9 | HOST=127.0.0.1 |
| 10 | NODE_ENV=development |
| 11 | # Public origin: canonical URLs, feeds, sitemaps and JSON-LD are built from it |
| 12 | BASE_URL=http://localhost:4860 |
| 13 | # Proxy hops that set X-Forwarded-For (Cloudflare → nginx → Node = 2) |
| 14 | TRUST_PROXY=2 |
| 15 | # Per-actor limits (server/http/actor-limits.js): API reads one caller (a signed-in person, an app, |
| 16 | # else an address) may make per minute and per hour; past them 429 rate_limited with Retry-After. |
| 17 | # Signed-out reads keep the per-address limit only. Writes have their own numbers (README). The |
| 18 | # per-address limits stay. |
| 19 | #TRADE_LIMITS_MINUTE=120 |
| 20 | #TRADE_LIMITS_HOUR=3000 |
| 21 | |
| 22 | # PostgreSQL (ADR-035), written by OpenVibe.Host roles/data/add-service.sh trade: the runtime role through PgBouncer, |
| 23 | # the owner on a direct connection (migrations), and Valkey (shared limit counters). |
| 24 | # Without DATABASE_URL, development uses an embedded PGlite database in data/pglite. |
| 25 | DATABASE_URL= |
| 26 | DATABASE_DIRECT_URL= |
| 27 | # Overrides the embedded PGlite directory used when DATABASE_URL is empty (tests use one of their own) |
| 28 | #TRADE_PGLITE_DIR= |
| 29 | VALKEY_URL= |
| 30 | VALKEY_PREFIX= |
| 31 | |
| 32 | # OpenVibe.Network — SSO (OAuth2), JWKS, client-credentials tokens |
| 33 | OV_NETWORK_URL=https://openvibe.network |
| 34 | OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000 |
| 35 | # OAuth client `trade` (redirect https://openvibe.trade/auth/callback). The same client is Trade's |
| 36 | # service principal svc:trade for client-credentials grants (see README, "Grants"). |
| 37 | OV_OAUTH_CLIENT_ID=trade |
| 38 | OV_OAUTH_CLIENT_SECRET= |
| 39 | # Production: https://openvibe.trade/auth/callback (default: BASE_URL + /auth/callback) |
| 40 | #OV_OAUTH_REDIRECT_URI= |
| 41 | # Cookies: Secure by default in production; set false for plain-http local development |
| 42 | #COOKIE_SECURE=false |
| 43 | # Signs the watchlist, alert and editor form tokens (CSRF). Unset: random per process. |
| 44 | #TRADE_FORM_SECRET= |
| 45 | |
| 46 | # Editors (create instruments, write context, review AI drafts): Network subjects, comma-separated. |
| 47 | # Staff with staff.editorial.manage (Network admins) are editors too; this list is the product's own role. |
| 48 | TRADE_EDITORS= |
| 49 | |
| 50 | # OpenVibe.Sources — the trade category (filings, market data feeds), read by cursor with the |
| 51 | # service token above (sources.item.read, sources.source.read). Off while the secret is unset. |
| 52 | OV_SOURCES_INTERNAL_URL=http://127.0.0.1:4720 |
| 53 | #TRADE_SYNC_INTERVAL_MS=60000 |
| 54 | #TRADE_SYNC_PAGE_LIMIT=200 |
| 55 | #TRADE_SYNC_MAX_PAGES=20 |
| 56 | |
| 57 | # Freshness: the window for a source that reports none, and the age after which a monetary |
| 58 | # observation makes an instrument page noindex (stale_price) |
| 59 | #TRADE_DEFAULT_STALE_AFTER_SEC=10800 |
| 60 | #TRADE_PRICE_MAX_AGE_SEC=86400 |
| 61 | #TRADE_FRESHNESS_INTERVAL_MS=60000 |
| 62 | # Indexability: minimum words of reviewed context before an instrument page may be indexed |
| 63 | #TRADE_GATE_MIN_WORDS=60 |
| 64 | # How long the sitemaps' instrument list (every index candidate's gate decision) is reused, in ms (production |
| 65 | # default 600000; 0 rebuilds on every read, the default elsewhere). Concurrent reads share one build either way. |
| 66 | #TRADE_SITEMAP_TTL_MS=600000 |
| 67 | |
| 68 | # OpenVibe.AI — the instrument briefs and the daily market brief. Unset: off, nothing is made or shown. |
| 69 | #OV_AI_INTERNAL_URL=http://127.0.0.1:4800 |
| 70 | #TRADE_AI_WAIT_MS=60000 |
| 71 | #TRADE_BRIEFS_PER_TICK=6 |
| 72 | #TRADE_BRIEFS_PER_HOUR=40 |
| 73 | #TRADE_BRIEFS_INTERVAL_MS=600000 |
| 74 | # One market-wide brief a UTC day at most: off with TRADE_MARKET_BRIEFS=off, due checked this often. |
| 75 | #TRADE_MARKET_BRIEFS=on |
| 76 | #TRADE_MARKET_BRIEFS_INTERVAL_MS=600000 |
| 77 | |
| 78 | # OpenVibe.Events — the outbox relay runs only when EVENTS_URL and OV_OAUTH_CLIENT_SECRET are set |
| 79 | #EVENTS_URL=http://127.0.0.1:4300 |
| 80 | # Signing secret for Events deliveries to /internal/events (32+ chars). |
| 81 | #TRADE_EVENTS_WEBHOOK_SECRET= |
| 82 | # Unset: the webhook answers 404 and the sync runs on its timer only. |
| 83 | #EVENTS_RELAY_INTERVAL_MS=2000 |
| 84 | |
| 85 | # Background work (Sources sync + freshness); off: TRADE_WORKER=off |
| 86 | #TRADE_WORKER=on |
| 87 | |
| 88 | # IndexNow (openvibe-shared/indexnow): with a key, search engines are told the moment a public, |
| 89 | # indexable instrument page appears, changes or leaves the index (the key file is served at |
| 90 | # /<key>.txt). Unset: off — no key file, nothing sent. |
| 91 | #INDEXNOW_KEY= |
| 92 | |
| 93 | # Browser origins that may call /api/v1 with a Bearer Network JWT |
| 94 | #API_CORS_ORIGINS=https://openvibe.network |
| 95 | |
| 96 | # release.json (openvibe-shared/release): the deployed commit when git is not available |
| 97 | #RELEASE_COMMIT= |
| 98 | #MIN_CLIENT_RELEASE= |
| 99 |