.env.example

APP_ADDR=0.0.0.0
APP_PORT=8080
CEPS_RPC_URL=http://127.0.0.1:11101
CEPS_SSE_URL=http://127.0.0.1:18101/events
CEPS_CHAIN_NAME=casper-net-1
RUST_LOG=info
# DOTENV_DISABLE=1

# SIGN_BACKEND:
#   kms (recommended for production) - private network + KMS_URL peer signs puts.
#   local-production                 - private network fallback; PEMs in LOCAL_KEYS_JSON_PRODUCTION.
#   local                            - lab/tests only; PEMs from LOCAL_KEYS_JSON.
#   none (default)                   - no secrets; submit=return (+ chain-put). OK for public demos.
#
# WARNING: local, local-production, and kms all sign for any HTTP caller who names a
# loaded public key. Keep those listeners off the public internet.

# Recommended production (private network + KMS):
# SIGN_BACKEND=kms
# KMS_URL=http://127.0.0.1:4000
# Peer configuration: see kms-secp256k1-api docs
# https://github.com/Interchouette-ITC/kms-secp256k1-api/blob/dev/docs/Tutorial.md
# https://github.com/Interchouette-ITC/kms-secp256k1-api/blob/dev/docs/OVERVIEW.md

# Private network fallback without KMS (same JSON shape as LOCAL_KEYS_JSON:
# inline PEM text or file path). Prefer mounted paths in production, not env PEMs:
# SIGN_BACKEND=local-production
# LOCAL_KEYS_JSON_PRODUCTION={"01…":"/run/secrets/operator.pem"}
# LOCAL_KEYS_JSON_PRODUCTION={"01…":"-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----"}

# Lab / NCTL (make export-local-keys / make run-local):
# SIGN_BACKEND=local
# LOCAL_KEYS_JSON={"01…":"-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----"}
# LOCAL_KEYS_JSON={"01…":"/path/to/operator.pem"}

# Contract WASMs: committed under tests/wasm/ (same idea as ceps-rust-ts-client).
# Refresh: make wasm-from-ceps
# CEPS_WASM_ROOT=tests/wasm