.env.example

#================================================================================================
# TELEMETRYFLOW CORE - ENVIRONMENT CONFIGURATION
#================================================================================================
#
# 🔒 SECURITY NOTICE:
#
# This file contains DEFAULT VALUES suitable for DEVELOPMENT ONLY.
# DO NOT use these values in production environments.
#
# Before deploying to production:
#   1. Generate secure secrets: pnpm run generate:secrets
#   2. Change all default passwords and credentials
#   3. Configure CORS_ORIGIN with specific trusted domains
#   4. Review all security-related settings below
#
# Quick Start: README.md
# Documentation: docs/
#
#================================================================================================

#================================================================================================
# APPLICATION CONFIGURATION
#================================================================================================
NODE_ENV=development

# Backend API Port
# The NestJS backend API server port
PORT=3000

LOG_LEVEL=info
TZ=UTC

# CORS Configuration
# 🔒 SECURITY: Configure allowed origins for Cross-Origin Resource Sharing
#
# Development: Use * to allow all origins (localhost, 127.0.0.1, etc.)
# Production: MUST specify comma-separated list of trusted origins (no wildcards)
#
# Examples:
#   Development:  CORS_ORIGIN=*
#   Production:   CORS_ORIGIN=https://app.telemetryflow.id,https://dashboard.telemetryflow.id
#   Staging:      CORS_ORIGIN=https://staging.telemetryflow.id
#
# Security Note: Wildcard (*) will trigger warnings in production mode
CORS_ORIGIN=*

#================================================================================================
# LOGGING CONFIGURATION
#================================================================================================
# TelemetryFlow Core supports two logging modes:
#   1. Native NestJS Logger (default) - Simple console logging
#   2. Winston Logger - Advanced logging with multiple transports
#
# Winston provides:
#   - OpenTelemetry trace correlation (traceId, spanId)
#   - Multiple transports (Console, OTEL, File, Loki, FluentBit, OpenSearch, ClickHouse)
#   - Structured JSON logging
#   - Request context management
#   - @Log() decorator for automatic method logging
#   - Log enrichment and sampling utilities
#
# Documentation: docs/WINSTON_LOGGER.md
#================================================================================================

#------------------------------------------------------------------------------------------------
# Logger Selection
#------------------------------------------------------------------------------------------------
# Choose logging implementation:
#   nestjs  - Use native NestJS Logger (simple, console only)
#   winston - Use Winston Logger with OpenTelemetry integration
#
# Default: nestjs (for backward compatibility)
# Recommended: winston (for production with observability)
LOGGER_TYPE=winston

#------------------------------------------------------------------------------------------------
# Winston Logger Configuration
#------------------------------------------------------------------------------------------------
# These settings only apply when LOGGER_TYPE=winston

# Console Transport (always enabled in development)
# Pretty print for development, JSON for production
LOG_PRETTY_PRINT=true
LOG_COLORIZE=true

#------------------------------------------------------------------------------------------------
# OpenTelemetry Transport
#------------------------------------------------------------------------------------------------
# OTEL transport sends logs to OpenTelemetry Collector
# Automatically enabled if OTEL_EXPORTER_OTLP_ENDPOINT is set
OTEL_LOGS_ENABLED=true

#------------------------------------------------------------------------------------------------
# File Transport (Daily Rotation)
#------------------------------------------------------------------------------------------------
# File transport writes logs to rotating files for production environments
# Requires: pnpm add winston-daily-rotate-file (already installed)
#
# Features:
#   - Daily log rotation (configurable pattern)
#   - Automatic compression of old logs (gzip)
#   - Size-based rotation (maxSize)
#   - Automatic cleanup (maxFiles)
#
# Enable file transport (default: enabled in production, disabled in development)
LOG_FILE_ENABLED=true
# Directory for log files (relative to app root or absolute path)
LOG_FILE_DIRNAME=logs
# Filename pattern (%DATE% is replaced with date)
LOG_FILE_FILENAME=app-%DATE%.log
# Date pattern for file rotation (default: YYYY-MM-DD = daily)
LOG_FILE_DATE_PATTERN=YYYY-MM-DD
# Compress old log files with gzip
LOG_FILE_ZIPPED=true
# Maximum file size before rotation (e.g., '20m', '100k', '1g')
LOG_FILE_MAX_SIZE=20m
# Maximum days/count to keep logs (e.g., '14d' = 14 days, '10' = 10 files)
LOG_FILE_MAX_FILES=14d
# Use JSON format for log files (recommended for log aggregation)
LOG_FILE_JSON=true

#------------------------------------------------------------------------------------------------
# Grafana Loki Integration (Log Aggregation)
#------------------------------------------------------------------------------------------------
# Loki provides log aggregation with LogQL querying
# Requires: pnpm add winston-loki (already installed)
# Docker: docker-compose --profile monitoring (includes loki service)
#
# Features:
#   - Label-based log aggregation
#   - LogQL query language
#   - Grafana integration
#   - Batching for performance (5s interval)
#   - Basic authentication support
#
# Enable Loki transport
LOKI_ENABLED=false
# Loki server endpoint
LOKI_HOST=http://loki:3100
# Additional labels for log streams
LOKI_LABELS_APP=telemetryflow
LOKI_LABELS_ENV=development
# Batch interval in seconds
LOKI_BATCH_INTERVAL=5
# Connection timeout in milliseconds
LOKI_TIMEOUT=30000
# Optional: Basic authentication
# LOKI_USERNAME=admin
# LOKI_PASSWORD=secret

#------------------------------------------------------------------------------------------------
# FluentBit Integration (Log Forwarding)
#------------------------------------------------------------------------------------------------
# FluentBit provides lightweight log forwarding to multiple destinations
# Requires: pnpm add fluent-logger (already installed)
# Docker: docker-compose --profile monitoring (includes fluentbit service)
#
# Features:
#   - Forward protocol (Fluentd/FluentBit compatible)
#   - Automatic reconnection
#   - Custom tagging for log routing
#   - Low overhead
#
# Enable FluentBit transport (Forward protocol)
FLUENTBIT_ENABLED=false
# FluentBit server host
FLUENTBIT_HOST=fluentbit
# FluentBit Forward protocol port
FLUENTBIT_PORT=24224
# Log tag for FluentBit routing
FLUENTBIT_TAG=telemetryflow.logs
# Connection timeout in milliseconds
FLUENTBIT_TIMEOUT=3000
# Require acknowledgment response
FLUENTBIT_REQUIRE_ACK=false
# Reconnection interval in milliseconds
FLUENTBIT_RECONNECT_INTERVAL=1000

#------------------------------------------------------------------------------------------------
# OpenSearch Integration (Full-Text Log Search)
#------------------------------------------------------------------------------------------------
# OpenSearch provides full-text search and log analytics
# Requires: pnpm add winston-elasticsearch @opensearch-project/opensearch (already installed)
# Docker: docker-compose --profile monitoring (includes opensearch service)
#
# Features:
#   - Full-text search and analytics
#   - Automatic index creation with templates
#   - Daily index rotation (YYYY.MM.DD)
#   - Buffering for performance
#   - SSL/TLS support
#
# Enable OpenSearch transport
OPENSEARCH_ENABLED=false
# OpenSearch server endpoint
OPENSEARCH_NODE=http://opensearch:9200
# Index name prefix (daily indices: telemetryflow-logs-YYYY.MM.DD)
OPENSEARCH_INDEX=telemetryflow-logs
# Index suffix pattern
OPENSEARCH_INDEX_SUFFIX=YYYY.MM.DD
# Flush interval in milliseconds
OPENSEARCH_FLUSH_INTERVAL=2000
# Buffer limit (number of logs before flush)
OPENSEARCH_BUFFER_LIMIT=100
# SSL certificate verification
OPENSEARCH_SSL_VERIFY=false
# Optional: OpenSearch credentials (change in production!)
# OPENSEARCH_USERNAME=admin
# OPENSEARCH_PASSWORD=admin

#------------------------------------------------------------------------------------------------
# ClickHouse Transport (High-Performance Log Analytics)
#------------------------------------------------------------------------------------------------
# ClickHouse transport for high-performance log storage and analytics
# Leverages existing ClickHouse instance (Core-specific feature)
#
# Features:
#   - Columnar storage optimized for analytics
#   - High compression ratios
#   - Fast aggregation queries
#   - Automatic batching and buffering
#
# Enable ClickHouse logs transport
CLICKHOUSE_LOGS_ENABLED=false
# Uses existing CLICKHOUSE_HOST, CLICKHOUSE_PORT, CLICKHOUSE_DB from ClickHouse configuration
# Table name for logs
CLICKHOUSE_LOGS_TABLE=logs
# Flush interval in milliseconds
CLICKHOUSE_FLUSH_INTERVAL=2000
# Buffer limit (number of logs before flush)
CLICKHOUSE_BUFFER_LIMIT=100

#================================================================================================
# OPENTELEMETRY CONFIGURATION
#================================================================================================
# Enable OpenTelemetry tracing (true/false)
OTEL_ENABLED=true

# Service identification
OTEL_SERVICE_NAME=telemetryflow-core
SERVICE_VERSION=1.1.4
SERVICE_NAMESPACE=devopscorner
SERVICE_TEAM=core

# OTEL Collector Endpoint
# Development: http://localhost:4318 (OTEL Collector HTTP)
# Production: Your OTEL Collector endpoint
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318

# Span and Metrics Storage
SPAN_STORAGE_TYPE=memory
METRICS_STORAGE_TYPE=prometheus
PROMETHEUS_SERVER_URL=http://prometheus:9090
PROMETHEUS_QUERY_SUPPORT_SPANMETRICS_CONNECTOR=true
PROMETHEUS_QUERY_NAMESPACE=telemetryflow_core
PROMETHEUS_QUERY_DURATION_UNIT=ms
PROMETHEUS_QUERY_NORMALIZE_CALLS=true
PROMETHEUS_QUERY_NORMALIZE_DURATION=true

#================================================================================================
# CLICKHOUSE CONFIGURATION
#================================================================================================
# IMPORTANT: ClickHouse configuration is managed in config/clickhouse/
#            - config.xml: Server settings (memory, compression, logging)
#            - users.xml: User accounts and access control
#            See config/clickhouse/README.md for details.
#
# 🔒 SECURITY: Change default database credentials for production
#   Development: Default credentials acceptable for local testing
#   Production:
#     - Create dedicated users in config/clickhouse/users.xml
#     - Use SHA256 password hashing (not plain text)
#     - Separate users for: application, audit logging, read-only access
#     - Restrict network access to specific IP ranges
#
# Connection Settings:
CLICKHOUSE_HOST=172.151.151.40
CLICKHOUSE_PORT=8123
CLICKHOUSE_DB=telemetryflow_db
CLICKHOUSE_USER=default
CLICKHOUSE_PASSWORD=telemetryflow123
#
# Performance Settings (configured in config/clickhouse/config.xml):
#   - Max Memory Per Query: 10GB
#   - Max Concurrent Queries: 100
#   - Compression: LZ4 (optimized for audit logs)
#   - TTL: 90 days (audit logs)

#================================================================================================
# DATABASE CONFIGURATION
#================================================================================================
# IMPORTANT: PostgreSQL configuration is managed in config/postgresql/
#            - postgresql.conf: Server settings (connections, memory, performance)
#            See config/postgresql/README.md for details.
#
# 🔒 SECURITY: Change default database credentials for production
#   Development: Default postgres user acceptable for local testing
#   Production: Create dedicated user with restricted permissions, strong password
#
# PostgreSQL Configuration
POSTGRES_HOST=172.151.151.20
POSTGRES_PORT=5432
POSTGRES_DB=telemetryflow_db
POSTGRES_USERNAME=postgres
POSTGRES_PASSWORD=telemetryflow123

# ClickHouse Configuration
CLICKHOUSE_HOST=localhost
CLICKHOUSE_PORT=8123
CLICKHOUSE_DB=telemetryflow_db
CLICKHOUSE_USER=default
CLICKHOUSE_PASSWORD=telemetryflow123

#================================================================================================
# TFO API & SECRET, JWT & SESSION CONFIGURATION
#================================================================================================
# 🔒 SECURITY CRITICAL: These secrets MUST be changed in production
#
# Requirements:
#   - Minimum 32 characters length
#   - Use cryptographically secure random strings
#   - NEVER commit production secrets to version control
#   - Different secrets for each environment (dev, staging, prod)
#
# Generate secure secrets:
#   pnpm run generate:secrets
#
# Or manually with Node.js:
#   node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
#
TELEMETRYFLOW_API_KEY_ID=tfk_
TELEMETRYFLOW_API_KEY_SECRET=tfs_

# JWT Secret (Token signing)
# Development: Use a simple secret for testing
# Production: Generate a 32+ character random string
JWT_SECRET=your-jwt-secret-min-32-chars-run-pnpm-generate-secrets
JWT_EXPIRES_IN=24h

# Session Secret (Cookie signing)
# Development: Use a simple secret for testing
# Production: Generate a 32+ character random string (different from JWT_SECRET)
SESSION_SECRET=your-session-secret-min-32-chars-run-pnpm-generate-secrets

#================================================================================================
# RATE LIMITING CONFIGURATION
#================================================================================================
# Default rate limit for authenticated endpoints (requests per minute)
THROTTLE_TTL=60000
THROTTLE_LIMIT=100

#================================================================================================
# GRAFANA CONFIGURATION
#================================================================================================
# 🔒 SECURITY: Change default credentials for production
#
# Grafana is used for SPM (Service Performance Monitoring) visualization
# Access: http://localhost:3001
#
# Features:
#   - Prometheus datasource (span metrics)
#   - Jaeger datasource (distributed tracing)
#   - Custom SPM dashboards
#
# Documentation: docs/SPM_SETUP_GUIDE.md
#================================================================================================
GF_SECURITY_ADMIN_USER=admin
GF_SECURITY_ADMIN_PASSWORD=admin

#================================================================================================
# DOCKER-COMPOSE CONFIGURATION
#================================================================================================
# This section contains all environment variables used by docker-compose.yml
#
# Usage:
#   Production (core only):     docker-compose up -d
#   Development (all services): docker-compose --profile all up -d
#   With monitoring only:       docker-compose --profile monitoring up -d
#
# Profiles:
#   - core       : Core services (backend, postgres, clickhouse)
#   - monitoring : OTEL collector, Prometheus, Jaeger, Grafana
#   - tools      : Portainer
#   - all        : All services
#
#================================================================================================

#------------------------------------------------------------------------------------------------
# Volume Configuration
#------------------------------------------------------------------------------------------------
# Docker volume storage path on host
# All container data will be stored under this base path
# Default: /opt/data/docker/telemetryflow-core
#
# Directory structure:
#   /opt/data/docker/telemetryflow-core/
#   ├── postgres/           - PostgreSQL data
#   ├── clickhouse/
#   │   ├── data/          - ClickHouse data
#   │   └── logs/          - ClickHouse logs
#   └── prometheus/        - Prometheus metrics data
#
# Initialize directories: bash scripts/init-volumes.sh
VOLUMES_BASE_PATH=/opt/data/docker/telemetryflow-core
VOLUMES_DRIVER=local

#------------------------------------------------------------------------------------------------
# Configuration File Paths
#------------------------------------------------------------------------------------------------
# Optional: Uncomment and mount custom configuration files
CONFIG_POSTGRESQL=./config/postgresql/postgresql.conf
CONFIG_CLICKHOUSE=./config/clickhouse/config.xml
CONFIG_OTEL=./config/otel/otel-collector-config.yaml
CONFIG_PROMETHEUS=./config/prometheus/prometheus.yml

#------------------------------------------------------------------------------------------------
# Service Versions
#------------------------------------------------------------------------------------------------
# Application
VERSION=latest
NODE_VERSION=22

# Infrastructure
POSTGRES_VERSION=16-alpine
CLICKHOUSE_VERSION=latest

# Monitoring
OTEL_VERSION=latest
PROMETHEUS_VERSION=latest
JAEGER_VERSION=2.13.0
GRAFANA_VERSION=latest

# Management Tools
PORTAINER_VERSION=latest

#------------------------------------------------------------------------------------------------
# Container Names
#------------------------------------------------------------------------------------------------
# Core Services
CONTAINER_BACKEND=telemetryflow_core_backend
CONTAINER_POSTGRES=telemetryflow_core_postgres
CONTAINER_CLICKHOUSE=telemetryflow_core_clickhouse

# Monitoring Services
CONTAINER_OTEL=telemetryflow_core_otel
CONTAINER_PROMETHEUS=telemetryflow_core_prometheus
CONTAINER_JAEGER=telemetryflow_core_jaeger
CONTAINER_GRAFANA=telemetryflow_core_grafana

# Management Tools
CONTAINER_PORTAINER=telemetryflow_core_portainer

#------------------------------------------------------------------------------------------------
# Port Mappings
#------------------------------------------------------------------------------------------------
# Core Services
PORT_BACKEND=3000
PORT_POSTGRES=5432
PORT_CLICKHOUSE_HTTP=8123
PORT_CLICKHOUSE_NATIVE=9000
PORT_CLICKHOUSE_METRICS=9363

# Monitoring Services
PORT_OTEL_GRPC=4317
PORT_OTEL_HTTP=4318
PORT_OTEL_METRICS=8889
PORT_OTEL_HEALTH=13133
PORT_OTEL_ZPAGES=55679
PORT_PROMETHEUS=9090
PORT_JAEGER_UI=16686
PORT_JAEGER_COLLECTOR=14268
PORT_GRAFANA=3001

# Management Tools
PORT_PORTAINER=9100
PORT_PORTAINER_HTTPS=9443

#------------------------------------------------------------------------------------------------
# Static IP Addresses (Optional - for fixed internal networking)
#------------------------------------------------------------------------------------------------
# Network Subnet: 172.151.0.0/16
# Note: These IPs are used for internal Docker networking only
# Services can still communicate using DNS names (preferred method)

# Core Services
CONTAINER_IP_BACKEND=172.151.151.10
CONTAINER_IP_POSTGRES=172.151.151.20
CONTAINER_IP_CLICKHOUSE=172.151.151.40

# Monitoring Services
CONTAINER_IP_OTEL=172.151.151.30
CONTAINER_IP_PROMETHEUS=172.151.151.50
CONTAINER_IP_JAEGER=172.151.151.60
CONTAINER_IP_GRAFANA=172.151.151.70

# Management Tools
CONTAINER_IP_PORTAINER=172.151.151.5

#================================================================================================
# PRODUCTION DEPLOYMENT SECURITY CHECKLIST
#================================================================================================
#
# Before deploying to production, ensure ALL items are checked:
#
# [ ] JWT_SECRET changed to 32+ character random string
# [ ] SESSION_SECRET changed to 32+ character random string (different from JWT_SECRET)
# [ ] CORS_ORIGIN set to specific trusted domains (no wildcard)
# [ ] POSTGRES_PASSWORD changed from default
# [ ] CLICKHOUSE_PASSWORD changed from default
# [ ] GF_SECURITY_ADMIN_PASSWORD changed from default
# [ ] All database users have restricted permissions (principle of least privilege)
# [ ] HTTPS/TLS enabled at reverse proxy (nginx/traefik)
# [ ] Application default user passwords changed (superadmin, admin, etc.)
# [ ] Environment variables stored securely (secrets manager, not in git)
# [ ] Backup and disaster recovery plan in place
# [ ] Monitoring and alerting configured
# [ ] Security documentation reviewed: SECURITY.md
#
# Generate Secure Secrets:
#   pnpm run generate:secrets
#
# For complete deployment guide, see:
#   - SECURITY.md
#   - docs/DOCKER_SETUP.md
#   - README.md
#
#================================================================================================