env.example

APP_SECRET=1234abcd
CACHE_REFRESH_STDTLL=1860
TEMPLATES_LOCATION=https://raw.githubusercontent.com/HDRUK/traser-mapping-files/dev
SCHEMA_LOCATION=https://raw.githubusercontent.com/HDRUK/schemata-2/dev
HYDRATION_MAP_VERSION=2.2.1

AUDIT_LOG_ENABLED=0
PUBSUB_PROJECT_ID=hdrinnovationgatewaydev
PUBSUB_TOPIC_NAME=projects/hdrinnovationgatewaydev/topics/gateway-audit-logs-topic
GOOGLE_APPLICATION_CREDENTIALS=/app/application_default_credentials.json

# ── Dataset cache location ──────────────────────────────────────────────────
# Where the cache is kept. Layout, identical on disk and in a bucket:
#
#   datasets/{pid}.json          one record per dataset
#   benchmark/{runId}.json       one record per benchmark run, plus index.json
#   test-results.json            the results matrix
#   test-results-control.json    progress, log and fetch failures
#
# Datasets and benchmark runs each have their own prefix so a bucket lifecycle
# rule can expire them on different schedules without reaching the two control
# objects at the root.
#
#   fs  (default) — local disk under DATA_DIR. Right for local development and
#                   for a single long-lived process.
#   gcs           — a Google Cloud Storage bucket. Required on Cloud Run, where
#                   container disk is ephemeral and several instances serve the
#                   same service. Credentials come from Application Default
#                   Credentials (the attached service account), so there is
#                   nothing else to configure in a GCP runtime.
STORAGE_BACKEND=fs
# fs only. Defaults to ./data. On a VM, point this at a separate mounted volume
# so the cache can't fill the app/OS disk.
# DATA_DIR=./data
# gcs only. STORAGE_BUCKET is required; STORAGE_PREFIX is an optional key
# prefix so one bucket can hold more than one environment.
# STORAGE_BUCKET=hdr-gw-traser-dataset-cache-bucket-dev
# STORAGE_PREFIX=

# ── Job coordination ────────────────────────────────────────────────────────
# Which instance owns the refresh, the benchmark run and the retention sweep,
# and when the cached dataset index is stale.
#
#   memory (default) — in-process. Correct for local development and for a
#                      single instance.
#   redis            — a shared lease in Memorystore. Required whenever more
#                      than one instance runs, otherwise two instances both
#                      refresh, and a page load on one can cancel a healthy
#                      run on another.
#
# A lease lapses if its holder stops renewing, so a crashed or scaled-away
# instance frees the slot on its own — there is no stale-flag to reset.
COORDINATION_BACKEND=memory
# redis only. REDIS_HOST is required; the rest have defaults. REDIS_PASSWORD is
# needed for any instance with AUTH enabled — Memorystore on dev/preprod/prod
# has it off, but a local Redis from the Bitnami chart has it on by default.
# REDIS_HOST=
# REDIS_PORT=6379
# REDIS_PASSWORD=
# REDIS_KEY_PREFIX=traser:
# GATEWAY_API_URL has no built-in default — refresh.server throws if it is
# unset, rather than silently falling back to production. Set it explicitly
# before using Refresh All or a benchmark run.
# GATEWAY_API_URL=https://api.prod.hdruk.cloud/api/v2
# Refresh All concurrency. SYNC_CONCURRENCY is how many dataset fetches run
# against the Gateway API at once (phase 1, network-bound); TEST_CONCURRENCY is
# how many datasets are translated at once (phase 2, CPU-bound in this process).
# SYNC_CONCURRENCY=8
# TEST_CONCURRENCY=10

# ── Benchmark target allow-list ─────────────────────────────────────────────
# /benchmark fetches an operator-supplied base URL server-side, so the host is
# constrained to this comma-separated list. Unset, it defaults to the three
# Gateway environments below, plus the GATEWAY_API_URL host if that is set to
# something else. Set it to a single empty value to permit nothing.
# BENCHMARK_ALLOWED_HOSTS=api.prod.hdruk.cloud,api.preprod.hdruk.cloud,api.dev.hdruk.cloud

# ── Cache retention (bounds disk growth on the VM) ──────────────────────────
# A daily background sweep enforces these. The dataset cache is derived and
# re-fetchable — evicting a {pid}.json just means the next "Refresh All"
# re-downloads it. Set a TTL to 0 to disable that particular sweep.
DATA_CACHE_TTL_DAYS=7        # delete {pid}.json dataset files older than N days (by mtime)
BENCHMARK_TTL_DAYS=30        # delete completed benchmark runs older than N days (by completedAt)
RESULT_BODY_TTL_DAYS=3       # strip heavy embedded translate/validate bodies from result cells older than N days
# DATA_MAX_BYTES=             # optional hard size cap for the dataset cache (bytes); evicts oldest first
# DATA_MAX_FILES=             # optional hard file-count cap for the dataset cache; evicts oldest first

# ── Auth ─────────────────────────────────────────────────────────────────────
# HS256 secret gateway-api-2 signs the `token` cookie with. Must be the same
# value on both sides. Supplied as a deploy secret, never committed — without
# it, requireAuth/requireAdmin fail closed (no user).
# JWT_SECRET=
# Whether the `token` cookie checks are enforced. `1`/`true` enforces,
# `0`/`false` disables them — every request is then treated as an admin, so
# the admin pages are open to anyone who can reach the service. Unset means
# enforced; any other value is rejected with an error rather than guessed at.
# Set AUTH_ENFORCED=0 for local dev and on dev/preprod; leave it unset or =1
# on prod.
AUTH_ENFORCED=0

# ── Request limits / hardening ──────────────────────────────────────────────
MAX_BODY_MB=10               # reject request bodies larger than this (matches the 10mb limit the Express service used)
# Server listen port (chart targetPort is 3001)
PORT=3001