game-analytics/.env.example at master · Tusi-Game/game-analytics · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
# =============================================================================
# Game Analytics Platform — example environment configuration
# =============================================================================
# Copy to `.env` and adjust. The docker-compose stack already sets sane dev
# defaults for most of these; this file documents what the app reads and what a
# production deploy must override. `.env` is gitignored.
#
# See docs/deployment-requirements.md for the production envelope (NTP, TLS,
# Redis maxmemory, secrets).

# ---- Runtime ----------------------------------------------------------------
NODE_ENV=development                 # `production` enables the fail-fast boot checks
PORT=3000
# Logical-day reporting offset, in minutes from UTC (e.g. +3:30 = 210).
REPORTING_OFFSET=0
# Max ingest request body (a full batch is legitimately large).
INGEST_BODY_LIMIT=10mb

# ---- Postgres (durable user spine + result rollups; never raw logs) ---------
DB_HOST=localhost
DB_PORT=5432
DB_USER=analytics
DB_PASSWORD=analytics
DB_NAME=analytics

# ---- Redis (transient queue + hot counters) ---------------------------------
REDIS_HOST=localhost
REDIS_PORT=6379
# MUST match the redis `--maxmemory` so the front door sheds before OOM.
REDIS_MAXMEMORY_BYTES=3984588800     # 3800 MiB
MEMORY_WATERMARK_FRACTION=0.8

# ---- Backpressure / rate limiting -------------------------------------------
QUEUE_DEPTH_WATERMARK=200000
RETRY_AFTER_SECONDS=5
INGEST_EVENTS_PER_SEC_CAP=200
INGEST_RATE_BURST_EVENTS=5000
EVENT_NAME_CAP_PER_GAME=1000

# ---- Worker toggles (single-process by default) -----------------------------
INGEST_WORKER_ENABLED=true
COLD_STORAGE_WORKER_ENABLED=true
WORKER_CONFIG_CACHE_REFRESH_SEC=30

# ---- Cold storage (raw day-files → S3/MinIO → deleted locally) --------------
COLD_STORAGE_ENABLED=true
COLD_STORAGE_INTERVAL_MS=86400000    # nightly
RAW_FILE_DIR=/app/raw                # dedicated volume, OFF the Redis AOF disk
MINIO_ENDPOINT=localhost
MINIO_PORT=9000
MINIO_ACCESS_KEY=minioadmin
MINIO_SECRET_KEY=minioadmin
MINIO_BUCKET=analytics-raw

# ---- Security (see docs/deployment-requirements.md §4) ----------------------
# REQUIRED in production. Out-of-DB master key for envelope-encryption of
# reversible secrets + the erasure-ledger subject_ref hash. The app REFUSES to
# boot in production if this is empty or the insecure dev default.
SECRET_MASTER_KEY=
# Set only during a master-key rotation (dual-key window); otherwise leave empty.
SECRET_MASTER_KEY_NEW=
# When true, ingest refuses bearer auth over plain HTTP (use with the proxy profile).
REQUIRE_TLS=false
# Comma-separated allowed browser Origins for ingest (empty = no Origin check).
ALLOWED_ORIGINS=

# ---- Operator auth ----------------------------------------------------------
OPERATOR_SESSION_TIMEOUT_MIN=60
OPERATOR_LOGIN_MAX_ATTEMPTS=5
OPERATOR_LOCKOUT_MIN=15
OPERATOR_MFA_REQUIRED=false

# ---- Operator panel (branding + live refresh) -------------------------------
PANEL_TITLE=Game Analytics
PANEL_LOGO_URL=
PANEL_CHART_COLOR_PRIMARY=
PANEL_LIVE_POLL_INTERVAL_SEC=15
# Set true behind TLS so the session cookie is marked Secure.
PANEL_COOKIE_SECURE=false