.env.example

# =============================================================================
# Real-Time AI/ML-Based Phishing Detection & Prevention System
# Master Environment Configuration
# =============================================================================
# Copy this file to .env and fill in the values before running.
# Lines starting with # are comments. Uncomment and set values as needed.
# =============================================================================

# =============================================================================
# DATABASE (Required)
# =============================================================================
POSTGRES_PASSWORD=CHANGE_ME_STRONG_PASSWORD
# DATABASE_URL is built automatically in docker-compose; set only for local dev:
# DATABASE_URL=postgresql://postgres:YOUR_PASSWORD@localhost:5432/phishing_detection
# MONGODB_URL=mongodb://localhost:27017/phishing_detection

# =============================================================================
# FRONTEND — Build-time variables (must be reachable from user's browser)
# =============================================================================
NEXT_PUBLIC_API_URL=http://localhost:3000
NEXT_PUBLIC_WS_URL=http://localhost:3000

# =============================================================================
# SECURITY (Required — CHANGE before production)
# =============================================================================
# JWT_SECRET must be at least 32 random characters in production
# JWT_SECRET=CHANGE_ME_MIN_32_CHARS_RANDOM_STRING
# API_KEY_ENCRYPTION_KEY=CHANGE_ME_MIN_32_CHARS_RANDOM_STRING

# =============================================================================
# FEATURE FLAGS
# =============================================================================
ENABLE_WEBSOCKET=true
ENABLE_THREAT_INTEL=true
ENABLE_SANDBOX_ANALYSIS=true

# =============================================================================
# THREAT INTELLIGENCE (Optional — services degrade gracefully without these)
# =============================================================================
# MISP_URL=https://your-misp-instance.local
# MISP_API_KEY=
# OTX_API_KEY=
# VIRUSTOTAL_API_KEY=
# PHISHTANK_API_KEY=

# Sync settings
SYNC_INTERVAL_MINUTES=60
BLOOM_FILTER_SIZE=1000000
BLOOM_FILTER_FALSE_POSITIVE_RATE=0.01

# =============================================================================
# SANDBOX (Optional — service starts in disabled mode without a provider)
# =============================================================================
# SANDBOX_PROVIDER=anyrun
# ANYRUN_API_KEY=
# CUCKOO_SANDBOX_URL=
# CUCKOO_API_KEY=
SANDBOX_TIMEOUT=300
SANDBOX_POLL_INTERVAL=10
SANDBOX_QUEUE_CONCURRENCY=5

# =============================================================================
# ML SERVICES
# =============================================================================
INFERENCE_DEVICE=cpu
BATCH_SIZE=32
MAX_SEQUENCE_LENGTH=512

# URL Service
DNS_TIMEOUT=5
WHOIS_TIMEOUT=10
MAX_REDIRECTS=10
ENABLE_SSL_VERIFY=true

# Visual Service
BROWSER_TIMEOUT=30000
SCREENSHOT_QUALITY=80

# CORS for ML services (comma-separated, internal only)
ALLOWED_ORIGINS=http://detection-api:3001,http://localhost:3001,http://api-gateway:3000,http://localhost:3000

# =============================================================================
# AWS (Optional — required for production deployment & model storage)
# =============================================================================
AWS_REGION=ap-south-1
# AWS_ACCESS_KEY_ID=
# AWS_SECRET_ACCESS_KEY=
# S3_BUCKET_MODELS=phishing-detection-models
# S3_BUCKET_TRAINING=phishing-detection-training-data
# S3_BUCKET_NAME=  # Visual service screenshot storage

# =============================================================================
# MONITORING (Optional)
# =============================================================================
LOG_LEVEL=info
# SENTRY_DSN=

# =============================================================================
# TESTING
# =============================================================================
# Seeded by DB init on first run
# TEST_API_KEY=testkey_smoke_test_12345
# TEST_DATABASE_URL=postgresql://postgres:YOUR_PASSWORD@localhost:5432/phishing_detection_test
# TEST_REDIS_URL=redis://localhost:6379