diff --git a/.env.sample b/.env.sample index 453d301..3615d71 100644 --- a/.env.sample +++ b/.env.sample @@ -1,9 +1,45 @@ +# Safe Infrastructure Environment Configuration +# Copy this file to .env and configure the values for your environment + +# ============================================================================= +# RPC Configuration +# ============================================================================= +# RPC Node URL - Set this to your blockchain RPC endpoint +# This is REQUIRED and must point to an L2 chain (L1 chains are not supported) +# Examples: +# - Gnosis Chain: https://rpc.gnosischain.com +# - Sepolia (testnet): https://sepolia.infura.io/v3/YOUR_INFURA_KEY +# - Arbitrum One: https://arb1.arbitrum.io/rpc +# - Optimism: https://mainnet.optimism.io +# - Polygon: https://polygon-rpc.com +# - Base: https://mainnet.base.org +RPC_NODE_URL=https://rpc.gnosischain.com + +# ============================================================================= +# Network Configuration +# ============================================================================= +# Reverse proxy port (nginx will be accessible on this port) +# The Safe Web UI and all services will be available at http://localhost:REVERSE_PROXY_PORT REVERSE_PROXY_PORT=8000 +# ============================================================================= +# Service Versions +# ============================================================================= +# Docker image versions for each Safe service +# You can use 'latest' for the most recent version or specify a version tag +# Check https://hub.docker.com/u/safeglobal for available versions + +# Safe Transaction Service - Indexes and serves Safe transaction data +TXS_VERSION=latest + +# Safe Config Service - Manages chain configurations and service URLs CFG_VERSION=latest + +# Safe Client Gateway - API gateway that aggregates data from other services CGW_VERSION=latest -TXS_VERSION=latest + +# Safe Web UI - The Safe web interface UI_VERSION=latest -EVENTS_VERSION=latest -RPC_NODE_URL=http://url.to.node +# Safe Events Service - Handles real-time events and webhooks +EVENTS_VERSION=latest diff --git a/container_env_files/cgw.env b/container_env_files/cgw.env index a1ee287..1b54361 100644 --- a/container_env_files/cgw.env +++ b/container_env_files/cgw.env @@ -1,55 +1,53 @@ -# HTTP -HTTP_CLIENT_REQUEST_TIMEOUT_MILLISECONDS=60000 - -# Config Service -# The base url for the Safe Config Service -SAFE_CONFIG_BASE_URI=http://nginx:8000/cfg +# Token prices Provider API +# The base Prices Provider API to be used. +# NOTE: For production usage, a paid subscription is recommended. +# (default is https://api.coingecko.com/api/v3 if none is set) +# (Pro account base url is https://pro-api.coingecko.com/api/v3) +# PRICES_PROVIDER_API_BASE_URI= +# The API Key to be used. If none is set, rate limits on the provider side would apply. +# PRICES_PROVIDER_API_KEY= +# The cache TTL for each token price datapoint. +# PRICES_TTL_SECONDS= +# The cache TTL for a missing token price. +# (default is 259200 [72 hours]) +# NOT_FOUND_PRICE_TTL_SECONDS= +# Token addresses whose prices should be refresed more often (with HIGH_REFRESH_RATE_TOKENS_TTL_SECONDS TTL). +# (default is []) +# HIGH_REFRESH_RATE_TOKENS= +# The cache TTL for high-refresh-rate token addresses. +# (default is 30) +# HIGH_REFRESH_RATE_TOKENS_TTL_SECONDS= +# The cache TTL for native coins. +# (default is 100) +# NATIVE_COINS_PRICES_TTL_SECONDS= # RPC Provider # The RPC provider to be used. -INFURA_API_KEY='' +# INFURA_API_KEY= -# Redis -# The host name of where the Redis instance is running -REDIS_HOST=cgw-redis -# The default port of where the Redis instance is running (default=6379) -# REDIS_PORT= +# Balances Provider - Zerion API +# Chain ids configured to use this provider. (comma-separated numbers) +# (default='') +# FF_ZERION_BALANCES_CHAIN_IDS= +# The base Zerion API URL to be used. +# (default is https://api.zerion.io if none is set) +# ZERION_BASE_URI= +# The API Key to be used. If none is set, balances cannot be retrieved using this provider. +# The key should be base64 encoded with a `:` appended. Detailed instructions are provided at https://developers.zerion.io/reference/authentication +# ZERION_API_KEY= -# Cache Expiration Times -# The default cache expiration time in seconds if none is set (default=60) -# EXPIRATION_TIME_DEFAULT_SECONDS -# DEFAULT_NOT_FOUND_EXPIRE_TIME_SECONDS= -# CONTRACT_NOT_FOUND_EXPIRE_TIME_SECONDS= -# TOKEN_NOT_FOUND_EXPIRE_TIME_SECONDS= +# Disables Zerion Positions feature +# FF_ZERION_POSITIONS_DISABLED= -# Privileged endpoints authorization token -# The AUTH_TOKEN should always be set -AUTH_TOKEN=your_privileged_endpoints_token - -# Log level -LOG_LEVEL=info -# LOG_SILENT=true - -# Email handling -# Please note that the Safe CGW is currently using Pushwoosh as the email services provider. -# Refer to the provider's official documentation to set up emailing. -EMAIL_API_APPLICATION_CODE='' -EMAIL_API_FROM_EMAIL=changeme@example.com -EMAIL_API_KEY='' -EMAIL_TEMPLATE_RECOVERY_TX='' -EMAIL_TEMPLATE_UNKNOWN_RECOVERY_TX='' -EMAIL_TEMPLATE_VERIFICATION_CODE='' - -# Push Notifications Provider -# The Safe CGW uses Firebase Cloud Message to dispatch push notifications. -# Please refer to the provider's official documentation for configuration. +# Push Notifications Provider - Firebase Cloud Messaging +# Firebase API URL # (default=https://fcm.googleapis.com/v1/projects) # PUSH_NOTIFICATIONS_API_BASE_URI= # Firebase project -PUSH_NOTIFICATIONS_API_PROJECT='' +# PUSH_NOTIFICATIONS_API_PROJECT= # Firebase service account details for authenticating with Google -PUSH_NOTIFICATIONS_API_SERVICE_ACCOUNT_CLIENT_EMAIL=changeme@example.com -PUSH_NOTIFICATIONS_API_SERVICE_ACCOUNT_PRIVATE_KEY='' +# PUSH_NOTIFICATIONS_API_SERVICE_ACCOUNT_CLIENT_EMAIL= +# PUSH_NOTIFICATIONS_API_SERVICE_ACCOUNT_PRIVATE_KEY= # Relay Provider # The relay provider to be used. @@ -58,39 +56,266 @@ PUSH_NOTIFICATIONS_API_SERVICE_ACCOUNT_PRIVATE_KEY='' # (default=5) # RELAY_THROTTLE_LIMIT= # The API key to be used per chain. -RELAY_PROVIDER_API_KEY_OPTIMISM='' -RELAY_PROVIDER_API_KEY_BSC='' -RELAY_PROVIDER_API_KEY_GNOSIS_CHAIN='' -RELAY_PROVIDER_API_KEY_POLYGON='' -RELAY_PROVIDER_API_KEY_POLYGON_ZKEVM='' -RELAY_PROVIDER_API_KEY_BASE='' -RELAY_PROVIDER_API_KEY_ARBITRUM_ONE='' -RELAY_PROVIDER_API_KEY_AVALANCHE='' -RELAY_PROVIDER_API_KEY_LINEA='' -RELAY_PROVIDER_API_KEY_BLAST='' -RELAY_PROVIDER_API_KEY_SEPOLIA='' - -# Staking Provider -# The staking provider to be used. -# (default='https://api.kiln.fi') -STAKING_API_KEY='' - -# Bridge -# The bridge API key for LI.FI (optional) -BRIDGE_API_KEY='' - -# Testnet Staking Provider -# The testnet staking provider to be used. -# (default='https://api.testnet.kiln.fi') -STAKING_TESTNET_API_KEY='' +# RELAY_PROVIDER_API_KEY_OPTIMISM= +# RELAY_PROVIDER_API_KEY_BSC= +# RELAY_PROVIDER_API_KEY_GNOSIS_CHAIN= +# RELAY_PROVIDER_API_KEY_POLYGON= +# RELAY_PROVIDER_API_KEY_POLYGON_ZKEVM= +# RELAY_PROVIDER_API_KEY_BASE= +# RELAY_PROVIDER_API_KEY_ARBITRUM_ONE= +# RELAY_PROVIDER_API_KEY_AVALANCHE= +# RELAY_PROVIDER_API_KEY_LINEA= +# RELAY_PROVIDER_API_KEY_BLAST= +# RELAY_PROVIDER_API_KEY_SEPOLIA= +# The chain ids to apply daily limit relayer feature (comma-separated chainIds). +# RELAY_DAILY_LIMIT_CHAIN_IDS=11155111 +# No-fee duration based on token balance configuration +# If value is zero address, it means native token. +# RELAY_NO_FEE_CAMPAIGN_SEPOLIA_SAFE_TOKEN_ADDRESS= +# RELAY_NO_FEE_CAMPAIGN_SEPOLIA_START_TIMESTAMP= +# RELAY_NO_FEE_CAMPAIGN_SEPOLIA_END_TIMESTAMP= +# RELAY_NO_FEE_CAMPAIGN_SEPOLIA_MAX_GAS_LIMIT= +# RELAY_NO_FEE_CAMPAIGN_SEPOLIA_RELAY_RULES=[{"balanceMin":"0", "balanceMax": "0","limit":0}] +# If value is zero address, it means native token. +# RELAY_NO_FEE_CAMPAIGN_MAINNET_SAFE_TOKEN_ADDRESS= +# RELAY_NO_FEE_CAMPAIGN_MAINNET_START_TIMESTAMP= +# RELAY_NO_FEE_CAMPAIGN_MAINNET_END_TIMESTAMP= +# RELAY_NO_FEE_CAMPAIGN_MAINNET_MAX_GAS_LIMIT= +# RELAY_NO_FEE_CAMPAIGN_MAINNET_RELAY_RULES=[{"balanceMin":"0", "balanceMax": "0","limit":0}] +# Email-sending API +# The application code associated with this service, provided by the email-sending service. +# EMAIL_API_APPLICATION_CODE= +# The API Key to be used. +# EMAIL_API_KEY= +# The email address to be included in the 'from' section of the emails sent. +# EMAIL_API_FROM_EMAIL= +# The email template reference for an unknown recovery transaction notification. +# EMAIL_TEMPLATE_UNKNOWN_RECOVERY_TX= +# The email template reference for a recovery transaction notification. +# EMAIL_TEMPLATE_RECOVERY_TX= +# The email template reference for a verification code sent. +# EMAIL_TEMPLATE_VERIFICATION_CODE= +# The sender name to be included in the 'from' section of the emails sent. +# (default is 'Safe' if none is set) +# EMAIL_API_FROM_NAME= +# The Email Provider API base URL to be used. +# (default is https://api.pushwoosh.com if none is set) +# EMAIL_API_BASE_URI= + +# The base url for the Safe Config Service +# Default if none is set: https://safe-config.safe.global +# For local development, point to the local config service (via nginx proxy) +# This service provides chain configurations, contract addresses, and feature flags +SAFE_CONFIG_BASE_URI=http://nginx:8000/cfg + +# The base url for the Safe Locking Service +# Default if none is set: https://safe-locking.safe.global +# LOCKING_PROVIDER_API_BASE_URI=https://safe-locking.safe.global + +# Redis +# The host name of where the Redis instance is running +# (default=localhost) +# In Docker Compose, use the service name (cgw-redis) for inter-container communication +REDIS_HOST=cgw-redis +# The default port of where the Redis instance is running +# (default=6379) +REDIS_PORT=6379 +# The username of the redis server +# REDIS_USER= +# The password of the redis server +# REDIS_PASS= + + +# Cache Expiration Times +# The default cache expiration time in seconds if none is set +# (default=60) +# EXPIRATION_TIME_DEFAULT_SECONDS +# The default cache expiration time in seconds for not found errors (default=30) +# DEFAULT_NOT_FOUND_EXPIRE_TIME_SECONDS +# The cache expiration time in seconds for not found contracts errors (default=60) +# CONTRACT_NOT_FOUND_EXPIRE_TIME_SECONDS +# The cache expiration time in seconds for not found tokens errors (default=60) +# TOKEN_NOT_FOUND_EXPIRE_TIME_SECONDS +# The cache expiration time in seconds for defi positions +# EXPIRATION_TIME_POSITIONS_SECONDS + +# RabbitMQ / AMQP Queue +# The AMQP server URL +# AMQP_URL= +# The AMQP Exchange name +# AMQP_EXCHANGE_NAME= +# The AMQP queue name +# AMQP_QUEUE= +# The AMQP Exchange mode +# (default=fanout) +# AMQP_EXCHANGE_MODE= +# The message prefetch amount (max non-acknowledged messages being processed) +# (default=100) +# AMQP_PREFETCH= +# The AMQP heartbeat interval in seconds +# (default=60) +# AMQP_HEARBEAT_INTERVAL_SECONDS= +# The AMQP reconnect time in seconds +# (default=5) +# AMQP_RECONNECT_TIME_SECONDS= + +# Authorization token to use privileged endpoints. +# The AUTH_TOKEN should always be set +# AUTH_TOKEN= # The issuer and secret used to sign and verify JWTs. -JWT_ISSUER='' -JWT_SECRET='' +# The JWT_ISSUER and JWT_SECRET should always be set +# JWT_ISSUER= +# JWT_SECRET= + +# Log level for the service. +# LOG_LEVEL= + +# Make logs prrety and colorize +# LOG_PRETTY_COLORIZE= + +# Targeted Messaging +# Storage type for targeted messaging files +# Options: 'local' (files stored locally) or 's3' (files stored in AWS S3) +# Set to 'local' to avoid AWS requirements for local development +TARGETED_MESSAGING_FILE_STORAGE_TYPE=local # Community -FINGERPRINT_ENCRYPTION_KEY='' +# FINGERPRINT_ENCRYPTION_KEY= + +# Staking +# STAKING_TESTNET_API_BASE_URI= +# STAKING_TESTNET_API_KEY= +# STAKING_API_BASE_URI= +# STAKING_API_KEY= + +# Targeted Messaging +# TARGETED_MESSAGING_FILE_STORAGE_TYPE= + +# CSV Export +# Storage type for CSV export files +# Options: 'local' (files stored locally) or 's3' (files stored in AWS S3) +# Set to 'local' to avoid AWS requirements for local development +CSV_EXPORT_FILE_STORAGE_TYPE=local +# The TTL for a signed S3 URL upload (in seconds) +# (default is 36000 [1 hour]) +# CSV_EXPORT_SIGNED_URL_TTL_SECONDS= +# Required AWS credentials for CSV export (even when using 'local' storage due to module initialization) +# AWS access key ID specifically for CSV exports +CSV_AWS_ACCESS_KEY_ID=dummy +# AWS secret access key specifically for CSV exports +CSV_AWS_SECRET_ACCESS_KEY=dummy +# S3 bucket name for CSV exports +CSV_AWS_STORAGE_BUCKET_NAME=safe-client-gateway-local +# Base path within S3 bucket for CSV export files +CSV_AWS_S3_BASE_PATH=assets/csv-export + +# Database + +# The ORM query cache status +# (value: true/false) +# (default=false) +# ORM_CACHE_ENABLED= + +# Bridge API key for LI.FI bridge functionality +# Required even if not using bridge features (due to module initialization) +BRIDGE_API_KEY=dummy +# CORS +# Enable CORS headers from the API by setting to true (default disabled) +# Allows cross-origin requests from web browsers +# ALLOW_CORS=false + +# Safe Shield +# Blockaid API key for transaction security scanning +# Required even if not using Safe Shield (due to module initialization) +# BLOCKAID_CLIENT_API_KEY=dummy + +# ============================================================================= +# REQUIRED CONFIGURATION FOR LOCAL DEVELOPMENT +# These values are required by the latest CGW version +# Using dummy values for local development +# ============================================================================= + +# Authentication & Security +# Authorization token for privileged endpoints - MUST be changed in production +AUTH_TOKEN=local_development_token +# JWT issuer identifier - used for signing and verifying JWT tokens +JWT_ISSUER=safe-client-gateway +# JWT secret key - used for signing and verifying JWT tokens, MUST be changed in production +JWT_SECRET=local_development_secret_change_in_production +# Encryption key for fingerprinting functionality - MUST be changed in production +FINGERPRINT_ENCRYPTION_KEY=local_development_fingerprint_key + +# RPC Provider +# Infura API key for Ethereum RPC calls - required even if using other providers +INFURA_API_KEY=dummy + +# Email Service (Pushwoosh) +# Application code for Pushwoosh email service +EMAIL_API_APPLICATION_CODE=dummy +# Email address used as sender for outgoing emails (must be valid email format) +EMAIL_API_FROM_EMAIL=noreply@example.com +# API key for Pushwoosh email service +EMAIL_API_KEY=dummy +# Template reference for recovery transaction emails +EMAIL_TEMPLATE_RECOVERY_TX=dummy +# Template reference for unknown recovery transaction emails +EMAIL_TEMPLATE_UNKNOWN_RECOVERY_TX=dummy +# Template reference for verification code emails +EMAIL_TEMPLATE_VERIFICATION_CODE=dummy + +# Push Notifications (Firebase) +# Firebase project identifier +PUSH_NOTIFICATIONS_API_PROJECT=dummy +# Firebase service account email for authentication (must be valid email format) +PUSH_NOTIFICATIONS_API_SERVICE_ACCOUNT_CLIENT_EMAIL=dummy@example.com +# Firebase service account private key for authentication +PUSH_NOTIFICATIONS_API_SERVICE_ACCOUNT_PRIVATE_KEY=dummy + +# Relay Provider API Keys (Gelato) +# Gelato API keys for each supported chain - required even if not using that chain +RELAY_PROVIDER_API_KEY_OPTIMISM=dummy +RELAY_PROVIDER_API_KEY_BSC=dummy +RELAY_PROVIDER_API_KEY_GNOSIS_CHAIN=dummy +RELAY_PROVIDER_API_KEY_POLYGON=dummy +RELAY_PROVIDER_API_KEY_POLYGON_ZKEVM=dummy +RELAY_PROVIDER_API_KEY_BASE=dummy +RELAY_PROVIDER_API_KEY_ARBITRUM_ONE=dummy +RELAY_PROVIDER_API_KEY_AVALANCHE=dummy +RELAY_PROVIDER_API_KEY_LINEA=dummy +RELAY_PROVIDER_API_KEY_BLAST=dummy +RELAY_PROVIDER_API_KEY_SEPOLIA=dummy + +# Staking Provider (Kiln) +# Kiln API key for mainnet staking - required even if not using staking +STAKING_API_KEY=dummy +# Kiln API key for testnet staking - required even if not using testnet staking +STAKING_TESTNET_API_KEY=dummy + +# PostgreSQL Database Configuration +# PostgreSQL hostname (Docker service name in containerized setup) POSTGRES_HOST=cgw-db +# PostgreSQL port number +POSTGRES_PORT=5432 +# PostgreSQL username +POSTGRES_USER=postgres +# PostgreSQL password - MUST be changed in production +POSTGRES_PASSWORD=postgres +# PostgreSQL database name POSTGRES_DB=postgres + +# Targeted Messaging AWS Configuration +# Uses the same AWS credentials as the main AWS configuration +# These are required even when using 'local' storage type due to module initialization +# AWS access key ID for S3 storage +AWS_ACCESS_KEY_ID=dummy +# AWS secret access key for S3 storage +AWS_SECRET_ACCESS_KEY=dummy +# S3 bucket name for file storage +AWS_STORAGE_BUCKET_NAME=safe-client-gateway-local +# Base path within S3 bucket for targeted messaging files +AWS_S3_BASE_PATH=assets/targeted-messaging +# AWS region for S3 storage +AWS_REGION=us-east-1 diff --git a/container_env_files/txs.env b/container_env_files/txs.env index 47ce4cc..700e783 100644 --- a/container_env_files/txs.env +++ b/container_env_files/txs.env @@ -1,14 +1,52 @@ +# Python path - sets the application directory for Python imports PYTHONPATH=/app/ + +# Django settings module - specifies which Django settings configuration to use DJANGO_SETTINGS_MODULE=config.settings.production + +# Django secret key - used for cryptographic signing (sessions, CSRF tokens, etc.) +# MUST be changed in production to a secure random string DJANGO_SECRET_KEY='Very-secure-secret-string' -DEBUG=0 + +# Django debug mode - enables detailed error pages (set to 0 in production) +DEBUG=1 + +# Django log level - sets logging verbosity (DEBUG, INFO, WARNING, ERROR, CRITICAL) +DJANGO_LOG_LEVEL=DEBUG + +# PostgreSQL database connection URL +# Format: psql://username:password@host:port/database DATABASE_URL=psql://postgres:postgres@txs-db:5432/postgres + +# Ethereum L2 network flag - set to 1 for L2 networks (Optimism, Arbitrum, etc.), 0 for L1 ETH_L2_NETWORK=1 + +# Redis connection URL for caching +# Format: redis://host:port/database_number REDIS_URL=redis://txs-redis:6379/0 + +# Celery broker URL for task queue (RabbitMQ) +# Format: amqp://username:password@host/vhost CELERY_BROKER_URL=amqp://guest:guest@txs-rabbitmq/ + +# Django allowed hosts - list of allowed host/domain names +# In production, should be specific domains, not "*" DJANGO_ALLOWED_HOSTS="*" + +# Force script name - sets the base path for all URLs when running behind nginx with path prefix +# Ensures URLs are generated correctly when accessed via /txs/ prefix FORCE_SCRIPT_NAME=/txs/ + +# CSRF trusted origins - list of trusted origins for CSRF protection +# Should include all domains that can submit forms to the service CSRF_TRUSTED_ORIGINS="http://localhost:8000" + +# Events queue URL - RabbitMQ connection for publishing Safe-related events to other services EVENTS_QUEUE_URL=amqp://general-rabbitmq:5672 + +# Events queue async connection - enables asynchronous connection handling for better performance EVENTS_QUEUE_ASYNC_CONNECTION=True + +# Events queue exchange name - RabbitMQ exchange name for publishing events +# Other services subscribe to this exchange to receive Safe events EVENTS_QUEUE_EXCHANGE_NAME="safe-transaction-service-events" diff --git a/container_env_files/ui.env b/container_env_files/ui.env index 242d869..94f9d72 100644 --- a/container_env_files/ui.env +++ b/container_env_files/ui.env @@ -1,6 +1,9 @@ ### Required variables ### NEXT_PUBLIC_INFURA_TOKEN= -NEXT_PUBLIC_GATEWAY_URL_PRODUCTION=http://localhost:8000/cgw +NEXT_PUBLIC_WC_PROJECT_ID= +NEXT_PUBLIC_IS_OFFICIAL_HOST=true +NEXT_PUBLIC_PROD_MIXPANEL_TOKEN=1234567890 # Use Mixpanel Project TEST here +NEXT_PUBLIC_STAGING_MIXPANEL_TOKEN=1234567890 # # infura token used by Safe Apps NEXT_PUBLIC_SAFE_APPS_INFURA_TOKEN= @@ -13,6 +16,13 @@ NEXT_PUBLIC_TENDERLY_ORG_NAME= # Flag to switch to the production environment (redirect urls, gateway url, etc) NEXT_PUBLIC_IS_PRODUCTION=true +# Gateway URL - Point to local Client Gateway +NEXT_PUBLIC_GATEWAY_URL_PRODUCTION=http://localhost:8000/cgw +NEXT_PUBLIC_GATEWAY_URL_STAGING=http://localhost:8000/cgw + +# Disable linting during build to avoid ESLint errors +NEXT_DISABLE_ESLINT=true + ### Optional variables ### # These variables are required only if you require a certain feature in the interface (e.g. Portis wallet) # Or overwrite the fallback values (set a different WalletConnect bridge)