.env.sample

BACKUP_ZIP_PASSWORD=<zip-password>
SB_DOMAIN=sb.localhost
EBP_API_TOKEN=<ebp-api-token>
EBP_API_BASE_URL=<ebp-api-base-url>

# Suspicious Activity Detection
# How long to keep request_ip_log records
SUSPICIOUS_ACTIVITY_RETENTION_DAYS=<retention-days>

# Bulk Operations Detection
# Trigger alert when a user makes more than this many requests
SUSPICIOUS_ACTIVITY_BULK_REQUEST_COUNT=<bulk-request-count>
# Within this time window
SUSPICIOUS_ACTIVITY_BULK_TIME_WINDOW_MINUTES=<bulk-time-window-minutes>

# Rapid Fire Detection
# Trigger alert when a user makes more than this many requests per minute
SUSPICIOUS_ACTIVITY_RAPID_REQUEST_COUNT=<rapid-request-count>
# Detection window
SUSPICIOUS_ACTIVITY_RAPID_TIME_WINDOW_MINUTES=<rapid-time-window-minutes>
# How far back to search for bursts
SUSPICIOUS_ACTIVITY_RAPID_LOOKBACK_MINUTES=<rapid-lookback-minutes>

# IP Switching Detection
# Trigger alert when a user uses this many distinct IP addresses
SUSPICIOUS_ACTIVITY_IP_SWITCHING_DISTINCT_IPS=<ip-switching-distinct-ips>
# Within this time window
SUSPICIOUS_ACTIVITY_IP_SWITCHING_TIME_WINDOW_MINUTES=<ip-switching-time-window-minutes>

# Session Anomalies Detection
# Time window for detecting multiple sessions from different IPs
SUSPICIOUS_ACTIVITY_SESSION_TIME_WINDOW_MINUTES=<session-time-window-minutes>

# Rate Limiting
# Enable/disable the limiter (default: on outside NODE_ENV=test)
RATE_LIMIT_ENABLED=<true|false>
# enforce = return 429 over limit; monitor = record + log would-block but never
# block (use to measure real traffic and tune the ceilings). Default: monitor —
# the ceilings below are unvalidated guesses and enforcing them blocks ordinary
# use, so set this to enforce only after sizing them from observed traffic.
RATE_LIMIT_MODE=<enforce|monitor>
# Redis-error behaviour: true = allow the request (default); false = reject 503
RATE_LIMIT_FAIL_OPEN=<true|false>
# Sliding-window length in milliseconds
RATE_LIMIT_WINDOW_MS=<window-ms>
# The single request header trusted for the client IP. Prod/staging are behind
# Cloudflare, so the real client IP is cf-connecting-ip. Set to x-forwarded-for
# (or unset) only for a direct-serve deployment with no Cloudflare in front.
RATE_LIMIT_IP_HEADER=<cf-connecting-ip>
# Per-window ceilings for ordinary actions (per-user and per-IP)
RATE_LIMIT_DEFAULT_PER_USER=<default-per-user>
RATE_LIMIT_DEFAULT_PER_IP=<default-per-ip>
# Per-window ceilings for bulk-extraction actions (*:list, *:export).
# NB: photo/track fetch (downloader) is governed by the DEFAULT tier, not this.
RATE_LIMIT_SENSITIVE_PER_USER=<sensitive-per-user>
RATE_LIMIT_SENSITIVE_PER_IP=<sensitive-per-ip>

# StatsD Metrics
# Emit rate-limiter observability metrics as DogStatsD packets over UDP to
# Telegraf. Fire-and-forget; disabled by default (no socket created when off).
# Enable emission (default: false)
STATSD_ENABLED=<true|false>
# Telegraf statsd endpoint host (infra sets this to the sidecar, e.g. telegraf)
STATSD_HOST=<telegraf>
# UDP port for the statsd input (DogStatsD default 8125)
STATSD_PORT=<statsd-port>