98 lines
4.5 KiB
Plaintext
98 lines
4.5 KiB
Plaintext
# ==============================================================================
|
|
# Frontend (Vite) — exposed to the browser bundle, never put secrets here
|
|
# ==============================================================================
|
|
# VITE_API_BASE_URL=https://your-backend-domain.example.com/api
|
|
VITE_API_BASE_URL=http://localhost:8000/api
|
|
VITE_MIDTRANS_CLIENT_KEY=Mid-client-xxxxxxxxxxxxxxxx
|
|
|
|
VITE_MIDTRANS_ENV=sandbox
|
|
VITE_LOG_LEVEL=info
|
|
VITE_PAYMENT_GATEWAY_MODE=snap
|
|
|
|
VITE_ENABLE_BANK_TRANSFER=true
|
|
VITE_ENABLE_CREDIT_CARD=true
|
|
VITE_ENABLE_GOPAY=true
|
|
VITE_ENABLE_CSTORE=true
|
|
VITE_ENABLE_CPAY=false
|
|
|
|
# ==============================================================================
|
|
# Midtrans (server-side)
|
|
# ==============================================================================
|
|
MIDTRANS_SERVER_KEY=Mid-server-xxxxxxxxxxxxxxxx
|
|
MIDTRANS_CLIENT_KEY=Mid-client-xxxxxxxxxxxxxxxx
|
|
MIDTRANS_IS_PRODUCTION=false
|
|
|
|
# ==============================================================================
|
|
# Core payment method toggles (server-side)
|
|
# ==============================================================================
|
|
ENABLE_BANK_TRANSFER=true
|
|
ENABLE_CREDIT_CARD=true
|
|
ENABLE_GOPAY=true
|
|
ENABLE_CSTORE=true
|
|
|
|
# ==============================================================================
|
|
# Logging
|
|
# ==============================================================================
|
|
LOG_LEVEL=info
|
|
LOG_TO_FILE=true
|
|
LOG_TO_CONSOLE=true
|
|
# Max number of recent log entries kept in memory for GET /api/logs
|
|
LOG_BUFFER_SIZE=1000
|
|
|
|
# Exposes GET /api/logs, /api/logs/files, /api/logs/files/:filename, /api/logs/view,
|
|
# and registers the LOG_EXPOSE_API-only dev/test endpoints (/api/echo, /api/echo2,
|
|
# /api/test/notify-erp). Does NOT affect /openapi.json or /docs (those are gated only
|
|
# by LOG_BASIC_AUTH_USER/PASS below). Defaults to false (closed) when unset.
|
|
LOG_EXPOSE_API=false
|
|
# Required in production to protect the log endpoints (HTTP Basic Auth, browser-native prompt).
|
|
# Leaving these empty only works in non-production NODE_ENV.
|
|
LOG_BASIC_AUTH_USER=
|
|
LOG_BASIC_AUTH_PASS=
|
|
# Delete LOGS_*.log files older than this many days
|
|
LOG_RETENTION_DAYS=30
|
|
|
|
# ==============================================================================
|
|
# ERP integration
|
|
# ==============================================================================
|
|
ERP_NOTIFICATION_URL=https://erp.example.com/callback/
|
|
# Optional: multiple ERP endpoints, comma-separated. Overrides ERP_NOTIFICATION_URL if set.
|
|
# ERP_NOTIFICATION_URLS=https://erp1.example.com/callback/,https://erp2.example.com/callback/
|
|
# Used both as the client identifier AND (via fallback) the HMAC secret for ERP notification
|
|
# signatures — set ERP_CLIENT_SECRET separately only if your ERP uses a different signing key.
|
|
ERP_CLIENT_ID=changeme-erp-client-id
|
|
# ERP_CLIENT_SECRET=
|
|
ERP_ENABLE_NOTIF=true
|
|
|
|
# ==============================================================================
|
|
# Payment link signing & external API access
|
|
# ==============================================================================
|
|
# Required by /createtransaksi and POST /api/payment-links (X-API-KEY header). Generate with:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
|
|
EXTERNAL_API_KEY=changeme-generate-a-strong-random-key
|
|
# HMAC secret that signs shareable payment link tokens. Generate with:
|
|
# node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))"
|
|
PAYMENT_LINK_SECRET=changeme-generate-a-strong-random-secret
|
|
# Base URL the generated payment links point to (your frontend's /pay route)
|
|
# PAYMENT_LINK_BASE=https://your-frontend-domain.example.com/pay
|
|
PAYMENT_LINK_BASE=http://localhost:5173/pay
|
|
PAYMENT_LINK_TTL_MINUTES=1440
|
|
|
|
# ==============================================================================
|
|
# CORS — comma-separated list of allowed frontend origins.
|
|
# Leaving this unset allows all origins (fine for local dev, NOT recommended in production).
|
|
# ==============================================================================
|
|
# CORS_ALLOWED_ORIGINS=https://your-frontend-domain.example.com
|
|
|
|
# ==============================================================================
|
|
# Rate limiting for /createtransaksi, /api/payment-links, /api/payments/charge,
|
|
# /api/payments/snap/token
|
|
# ==============================================================================
|
|
RATE_LIMIT_WINDOW_MS=60000
|
|
RATE_LIMIT_MAX=20
|
|
|
|
# ==============================================================================
|
|
# Server
|
|
# ==============================================================================
|
|
NODE_ENV=development
|
|
PORT=8000
|