.env.example

# =====================
# THE .env FILE
# =====================
# Values marked REQUIRED have no default. The app refuses to start without
# them rather than falling back to something insecure.

# Flask / Webhook Settings
# REQUIRED - generate with: python generate_credentials.py
FLASK_SECRET_KEY=GENERATE_WITH_SCRIPT
# REQUIRED - generate with: python generate_credentials.py
WEBHOOK_PIN=GENERATE_WITH_SCRIPT
# REQUIRED - bcrypt hash, generate with: python generate_credentials.py
# Docker Compose interpolates $ in this file. Write every $ as $$
# (the script already prints it that way) or the hash is truncated.
DASHBOARD_PASSWORD=GENERATE_WITH_SCRIPT

# Set to true when the dashboard is served over HTTPS
SESSION_COOKIE_SECURE=false
SESSION_LIFETIME_HOURS=12

# Dashboard brute-force protection
LOGIN_MAX_ATTEMPTS=5
LOGIN_LOCKOUT_SECONDS=300

# Webhook brute-force protection (per source IP, never endpoint-wide)
WEBHOOK_MAX_FAILURES=5
WEBHOOK_LOCKOUT_SECONDS=300

# Ignore an identical signal repeated within this many seconds, so a lost
# response cannot become a doubled position. Set 0 to disable. Include a
# unique "ID" field in your alert to distinguish a retry from a genuine
# second identical order.
WEBHOOK_DEDUP_SECONDS=60

# --- Optional: restrict /webhook to known senders ---
# OFF by default (empty = accept any address), so a fresh clone works
# straight away. Enabling it is your decision: it removes brute-forcing the
# PIN as a possibility, but if TradingView changes its addresses a stale
# list silently rejects real trade signals with a 403.
#
# TradingView's published webhook source IPs, as of this writing:
#   https://www.tradingview.com/support/solutions/43000529348-how-to-configure-webhook-alerts/
# Check that page before enabling, and re-check if signals stop arriving.
# Uncomment the line below to turn it on.
# WEBHOOK_ALLOWED_IPS=52.89.214.238,34.212.75.30,54.218.53.128,52.32.178.7

# Only enable behind a reverse proxy that overwrites X-Forwarded-For.
# If the app is directly exposed, a client can forge the header and bypass
# both WEBHOOK_ALLOWED_IPS and the lockout.
TRUST_PROXY_HEADERS=false

# Bybit API Credentials
BYBIT_API_KEY=
BYBIT_API_SECRET=

# Binance API Credentials
BINANCE_API_KEY=
BINANCE_API_SECRET=

# Which exchanges to enable (comma-separated)
EXCHANGES=bybit,binance

# Signal Source MODE: "webhook", "email", or "both"
MODE=both

# Email Settings (required only when MODE includes email)
IMAP_SERVER=imap.your-email-provider.com
IMAP_PORT=993
IMAP_EMAIL=your_email@example.com
IMAP_PASSWORD=your_email_password
IMAP_USE_SSL=true
IMAP_CHECK_INTERVAL=15