.env.example

# Database configuration
DB_DRIVER=postgres
# ⚠️ SECURITY WARNING: sslmode=disable is for DEVELOPMENT ONLY
# Production MUST use sslmode=require or sslmode=verify-full
# See docs/operations/security-hardening.md for guidance
DB_CONNECTION_STRING=postgres://user:password@localhost:5432/mydb?sslmode=disable
DB_MAX_OPEN_CONNECTIONS=25
DB_MAX_IDLE_CONNECTIONS=5
DB_CONN_MAX_LIFETIME_MINUTES=5
DB_CONN_MAX_IDLE_TIME_MINUTES=5

# Server configuration
SERVER_HOST=0.0.0.0
SERVER_PORT=8080
SERVER_SHUTDOWN_TIMEOUT_SECONDS=10

# HTTP server timeout configuration (in seconds)
# Read timeout: maximum duration for reading the entire request, including the body
SERVER_READ_TIMEOUT_SECONDS=15
# Write timeout: maximum duration before timing out writes of the response
SERVER_WRITE_TIMEOUT_SECONDS=15
# Idle timeout: maximum time to wait for the next request when keep-alives are enabled
SERVER_IDLE_TIMEOUT_SECONDS=60

# Logging
LOG_LEVEL=info

# Metrics configuration
METRICS_ENABLED=true
METRICS_NAMESPACE=secrets
METRICS_PORT=8081

# Metrics server timeout configuration (in seconds)
# Read timeout: maximum duration for reading the entire request, including the body
METRICS_SERVER_READ_TIMEOUT_SECONDS=15
# Write timeout: maximum duration before timing out writes of the response
METRICS_SERVER_WRITE_TIMEOUT_SECONDS=15
# Idle timeout: maximum time to wait for the next request when keep-alives are enabled
METRICS_SERVER_IDLE_TIMEOUT_SECONDS=60

# ...

# Authentication configuration
# Token expiration in seconds (default: 14400 = 4 hours)
# Migration note: Prior to v0.5.0, default was 86400 (24 hours)
AUTH_TOKEN_EXPIRATION_SECONDS=14400

# Rate limiting configuration (authenticated endpoints)
# Protects against abuse and denial-of-service attacks on authenticated routes
RATE_LIMIT_ENABLED=true
RATE_LIMIT_REQUESTS_PER_SEC=10.0
RATE_LIMIT_BURST=20

# Token endpoint rate limiting (IP-based, unauthenticated)
# Applies to POST /v1/token endpoint to prevent credential stuffing and brute force attacks
# Stricter limits recommended as this endpoint is unauthenticated and commonly targeted
RATE_LIMIT_TOKEN_ENABLED=true
RATE_LIMIT_TOKEN_REQUESTS_PER_SEC=5.0
RATE_LIMIT_TOKEN_BURST=10

# Account Lockout
LOCKOUT_MAX_ATTEMPTS=10
LOCKOUT_DURATION_MINUTES=30

# Secret value size limit
# Maximum size allowed for a secret value in bytes (default: 524288 = 512 KB)
SECRET_VALUE_SIZE_LIMIT_BYTES=524288

# Tokenization batch limit
# Maximum number of items in a batch tokenization request (default: 100)
TOKENIZATION_BATCH_LIMIT=100


# CORS configuration
# ⚠️ SECURITY WARNING: CORS is disabled by default for server-to-server API
# Enable only if browser-based access is required
# Never use "*" for CORS_ALLOW_ORIGINS in production
CORS_ENABLED=false
CORS_ALLOW_ORIGINS=