diff options
| author | Chia <Chia@93.nz> | 2026-08-05 22:01:29 +1200 |
|---|---|---|
| committer | Chia <Chia@93.nz> | 2026-08-05 22:07:50 +1200 |
| commit | eadb2ffe85c43cf6fc741c9823cd28eedb4a844c (patch) | |
| tree | 1aba2536d57360da403aa35c9ced58b615c7064e /.env.control.example | |
| parent | cd0dd91ab93653631904f2ea0e574ccde6d60339 (diff) | |
feat: harden prepaid billing and commercial operations
Diffstat (limited to '')
| -rw-r--r-- | .env.control.example | 26 |
1 files changed, 22 insertions, 4 deletions
diff --git a/.env.control.example b/.env.control.example index 8122e07..5020f32 100644 --- a/.env.control.example +++ b/.env.control.example @@ -1,4 +1,12 @@ AIGW_SERVER_ADDRESS=:8080 +AIGW_PUBLIC_ADDRESS=:8080 +AIGW_ADMIN_ADDRESS=:8081 +AIGW_WEBHOOK_ADDRESS=:8082 +AIGW_OPERATIONS_ADDRESS=:9090 +# Empty means direct connections only; add only your load balancer CIDRs. +AIGW_TRUSTED_PROXY_CIDRS= +AIGW_REQUIRE_HTTPS=false +AIGW_DEPLOYMENT_REGION= AIGW_POSTGRES_USER=aigw-local AIGW_POSTGRES_PASSWORD=replace-with-a-long-random-password AIGW_POSTGRES_DB=aigw-local @@ -8,20 +16,30 @@ AIGW_REDIS_URL=redis://127.0.0.1:6379/0 AIGW_REDIS_URL_DOCKER=redis://redis:6379/0 # base64 of exactly 32 random bytes; generate with: openssl rand -base64 32 AIGW_CREDENTIAL_KEY=replace-with-base64-32-byte-key +# Comma-separated prior keys during a rotation window; remove after re-encryption. +AIGW_CREDENTIAL_PREVIOUS_KEYS= AIGW_ADMIN_TOKEN=replace-with-a-long-random-admin-token -AIGW_PUBLIC_URL=http://localhost:8080/admin/ +AIGW_PUBLIC_URL=http://localhost:8081/admin/ AIGW_WEBAUTHN_RP_ID=localhost -AIGW_WEBAUTHN_ORIGINS=http://localhost:8080 +AIGW_WEBAUTHN_ORIGINS=http://localhost:8081 AIGW_SMTP_FROM_ADDRESS=no-reply@aigw.local AIGW_SMTP_ADDRESS=127.0.0.1:1025 AIGW_SMTP_ADDRESS_DOCKER=mailpit:1025 # Leave both empty for a local Mailpit server; set both through a secret manager in production. AIGW_SMTP_USERNAME= AIGW_SMTP_PASSWORD= +# HMAC-SHA256 secret for normalized bounce/complaint callbacks. Inject from a secret manager. +AIGW_MAIL_FEEDBACK_SECRET= # Prefer a restricted test key (rk_test_) with Checkout Session write access. AIGW_STRIPE_API_KEY=replace-with-a-stripe-restricted-key # Development only: use a separate key with Debugging Tools Write for Stripe CLI. AIGW_STRIPE_CLI_API_KEY=replace-with-a-separate-cli-restricted-key AIGW_STRIPE_WEBHOOK_SECRET=replace-with-a-webhook-signing-secret -AIGW_STRIPE_SUCCESS_URL=http://localhost:8080/admin/?topup=success -AIGW_STRIPE_CANCEL_URL=http://localhost:8080/admin/?topup=cancel +AIGW_STRIPE_SUCCESS_URL=http://localhost:8081/admin/?topup=success +AIGW_STRIPE_CANCEL_URL=http://localhost:8081/admin/?topup=cancel +AIGW_STRIPE_PORTAL_RETURN_URL=http://localhost:8081/admin/?billing=portal +AIGW_STRIPE_AUTOMATIC_TAX_ENABLED=false +AIGW_STRIPE_TAX_REGISTRATION_CONFIRMED=false +# Set only after a tax adviser confirms the canonical Stripe Tax code for the product. +AIGW_STRIPE_PRODUCT_TAX_CODE= +AIGW_SETTLEMENT_SPOOL_PATH=/var/lib/aigw/settlements.jsonl |