46 lines
1.7 KiB
Plaintext
46 lines
1.7 KiB
Plaintext
|
# Copy this file to api.env and keep api.env outside the public directory.
|
||
|
|
|
||
|
|
APP_ENV=production
|
||
|
|
|
||
|
|
# Give every endpoint a unique name. Separate endpoints with commas.
|
||
|
|
CONTRACTLESS_RPC_NODES=node-1=127.0.0.1:50050,node-2=192.0.2.10:50050
|
||
|
|
CONTRACTLESS_RPC_TIMEOUT=10
|
||
|
|
|
||
|
|
# An endpoint enters a temporary cooldown after this many consecutive
|
||
|
|
# connection or transport failures. Protocol and validation failures do not
|
||
|
|
# count because retrying them against another node could conceal bad data.
|
||
|
|
RPC_FAILURE_THRESHOLD=2
|
||
|
|
RPC_COOLDOWN_SECONDS=30
|
||
|
|
|
||
|
|
# Production requests must use HTTPS. When TLS terminates at a reverse proxy,
|
||
|
|
# list only that proxy's IP or CIDR below so X-Forwarded-* can be trusted.
|
||
|
|
API_REQUIRE_HTTPS=true
|
||
|
|
API_TRUSTED_PROXIES=
|
||
|
|
|
||
|
|
# Comma-separated exact browser origins. Use * only for a deliberately public
|
||
|
|
# API. Browser-extension origins are supported.
|
||
|
|
API_CORS_ORIGINS=https://wallet.example.com,chrome-extension://extension-id
|
||
|
|
|
||
|
|
# This directory must be writable by PHP and must remain outside public/.
|
||
|
|
API_SECURITY_STATE_PATH=storage/security-state.json
|
||
|
|
API_MAX_BODY_BYTES=2000000
|
||
|
|
|
||
|
|
# Public browser-wallet limits use the caller's resolved IP address.
|
||
|
|
API_RATE_WINDOW_SECONDS=60
|
||
|
|
API_PUBLIC_REQUESTS_PER_WINDOW=120
|
||
|
|
API_MESSAGE_VERIFY_REQUESTS_PER_WINDOW=30
|
||
|
|
API_BROADCAST_REQUESTS_PER_WINDOW=10
|
||
|
|
API_EXPENSIVE_REQUESTS_PER_WINDOW=5
|
||
|
|
|
||
|
|
# Large raw-response routes can be disabled independently.
|
||
|
|
API_ENABLE_RAW_BLOCKS=true
|
||
|
|
API_ENABLE_TORRENTS=true
|
||
|
|
API_ENABLE_ALL_HEADERS=false
|
||
|
|
|
||
|
|
# Optional identified clients use client-id=secret:requests-per-window.
|
||
|
|
# Secrets must contain at least 32 characters. Leave these settings empty when
|
||
|
|
# not needed. Never embed either kind of secret in a browser wallet.
|
||
|
|
API_KEYS=
|
||
|
|
API_HMAC_KEYS=
|
||
|
|
API_HMAC_CLOCK_SKEW_SECONDS=300
|