From 97349e9d1e7cb9fc270a829e9b84a25c4d9efd1e Mon Sep 17 00:00:00 2001 From: TengkuAchmad Date: Mon, 3 Aug 2026 22:49:57 +0700 Subject: [PATCH] chore: add .env.example MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Documents every environment variable read by server/index.cjs and the Vite frontend (grep-verified against process.env.* / import.meta.env.* usage), with placeholder values only — no real secrets. Not gitignored (.gitignore already carves out an exception for it). Co-Authored-By: Claude Sonnet 5 --- .env.example | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) create mode 100644 .env.example diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..a2e9115 --- /dev/null +++ b/.env.example @@ -0,0 +1,96 @@ +# ============================================================================== +# Frontend (Vite) — exposed to the browser bundle, never put secrets here +# ============================================================================== +# VITE_API_BASE_URL=https://your-backend-domain.example.com/api +VITE_API_BASE_URL=http://localhost:8000/api +VITE_MIDTRANS_CLIENT_KEY=Mid-client-xxxxxxxxxxxxxxxx + +VITE_MIDTRANS_ENV=sandbox +VITE_LOG_LEVEL=info +VITE_PAYMENT_GATEWAY_MODE=snap + +VITE_ENABLE_BANK_TRANSFER=true +VITE_ENABLE_CREDIT_CARD=true +VITE_ENABLE_GOPAY=true +VITE_ENABLE_CSTORE=true +VITE_ENABLE_CPAY=false + +# ============================================================================== +# Midtrans (server-side) +# ============================================================================== +MIDTRANS_SERVER_KEY=Mid-server-xxxxxxxxxxxxxxxx +MIDTRANS_CLIENT_KEY=Mid-client-xxxxxxxxxxxxxxxx +MIDTRANS_IS_PRODUCTION=false + +# ============================================================================== +# Core payment method toggles (server-side) +# ============================================================================== +ENABLE_BANK_TRANSFER=true +ENABLE_CREDIT_CARD=true +ENABLE_GOPAY=true +ENABLE_CSTORE=true + +# ============================================================================== +# Logging +# ============================================================================== +LOG_LEVEL=info +LOG_TO_FILE=true +LOG_TO_CONSOLE=true +# Max number of recent log entries kept in memory for GET /api/logs +LOG_BUFFER_SIZE=1000 + +# Exposes GET /api/logs, /api/logs/files, /api/logs/files/:filename, /api/logs/view. +# WARNING: defaults to true if unset — set to false unless you also configure +# LOG_BASIC_AUTH_USER/PASS below. +LOG_EXPOSE_API=false +# Required in production to protect the log endpoints (HTTP Basic Auth, browser-native prompt). +# Leaving these empty only works in non-production NODE_ENV. +LOG_BASIC_AUTH_USER= +LOG_BASIC_AUTH_PASS= +# Delete LOGS_*.log files older than this many days +LOG_RETENTION_DAYS=30 + +# ============================================================================== +# ERP integration +# ============================================================================== +ERP_NOTIFICATION_URL=https://erp.example.com/callback/ +# Optional: multiple ERP endpoints, comma-separated. Overrides ERP_NOTIFICATION_URL if set. +# ERP_NOTIFICATION_URLS=https://erp1.example.com/callback/,https://erp2.example.com/callback/ +# Used both as the client identifier AND (via fallback) the HMAC secret for ERP notification +# signatures — set ERP_CLIENT_SECRET separately only if your ERP uses a different signing key. +ERP_CLIENT_ID=changeme-erp-client-id +# ERP_CLIENT_SECRET= +ERP_ENABLE_NOTIF=true + +# ============================================================================== +# Payment link signing & external API access +# ============================================================================== +# Required by /createtransaksi and POST /api/payment-links (X-API-KEY header). Generate with: +# node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))" +EXTERNAL_API_KEY=changeme-generate-a-strong-random-key +# HMAC secret that signs shareable payment link tokens. Generate with: +# node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))" +PAYMENT_LINK_SECRET=changeme-generate-a-strong-random-secret +# Base URL the generated payment links point to (your frontend's /pay route) +# PAYMENT_LINK_BASE=https://your-frontend-domain.example.com/pay +PAYMENT_LINK_BASE=http://localhost:5173/pay +PAYMENT_LINK_TTL_MINUTES=1440 + +# ============================================================================== +# CORS — comma-separated list of allowed frontend origins. +# Leaving this unset allows all origins (fine for local dev, NOT recommended in production). +# ============================================================================== +# CORS_ALLOWED_ORIGINS=https://your-frontend-domain.example.com + +# ============================================================================== +# Rate limiting for /createtransaksi, /api/payment-links, /api/payments/charge, +# /api/payments/snap/token +# ============================================================================== +RATE_LIMIT_WINDOW_MS=60000 +RATE_LIMIT_MAX=20 + +# ============================================================================== +# Server +# ============================================================================== +NODE_ENV=development +PORT=8000