.env.example

# Teranode Quickstart environment
#
# Copy to .env and edit (or run ./setup.sh to generate it).
# This file is committed; .env is git-ignored so your customisations
# never produce diffs when you `git pull`.
#
# .env contains rpc_pass, POSTGRES_PASSWORD and grpc_admin_api_key in cleartext. Quickstart leaves
# permissions alone (your umask wins) so setups where a separate user runs
# docker compose still work. On multi-user hosts you may want
# `chmod 600 .env` manually.

# === Version pin ===
# Bumped by ./update.sh after checking github.com/bsv-blockchain/teranode/releases/latest
TERANODE_VERSION=v0.16.0

# === Network ===
# One of: mainnet | testnet | regtest | teratestnet
# This is read directly by Teranode (matches settings.conf `network` key) and
# also tells the quickstart scripts which network you're on.
network=testnet

# SETTINGS_CONTEXT is docker.m for all networks; the `network` value above
# selects the live network. Leave this as docker.m unless you know you need a different leaf.
SETTINGS_CONTEXT=docker.m

# === Per-network consensus knobs ===
# setup.sh writes per-network defaults below. Edit if you know what you need.
#
#   minminingtxfee — fee floor (BSV/KB). 0 = accept anything.
#     mainnet     0.00000100  (100 sat/kb)
#     testnet     0.00000001  (1 sat/kb)
#     teratestnet 0.00000001  (1 sat/kb)
#     regtest     0           (no floor — local testing)
#
#   blockmaxsize — mining policy soft limit on block size (bytes).
#     mainnet/testnet/regtest 4294967296   (4 GiB)
#     teratestnet             1073741824   (1 GiB — capped for shared test network)
#
#   excessiveblocksize — consensus-level absolute max block size (bytes).
#     mainnet/testnet/regtest 10737418240  (10 GiB)
#     teratestnet             1073741824   (1 GiB — capped for shared test network)
minminingtxfee=0.00000001
blockmaxsize=4294967296
excessiveblocksize=10737418240

# === Host binding ===
# Controls ONLY these 3 ports — everything else (RPC, Grafana, Prometheus,
# Kafka, Postgres, Aerospike) stays hardcoded to 127.0.0.1 regardless.
#
#   8090  asset viewer UI                           (always on)
#   8000  asset-cache public API                    (p2p profile only)
#   9905  P2P inbound peer connections              (p2p profile only)
#
# 127.0.0.1 = localhost only (safe default, works behind NAT)
# 0.0.0.0   = all interfaces (needed when a reverse proxy / firewall on
#             another host needs to reach these 3 ports directly)
HOST_IP=127.0.0.1

# === Go runtime tuning / memory limits ===
# Do NOT set GOGC here. Teranode auto-tunes the Go GC per service: it sets
# GOMEMLIMIT to 90% of the container's memory cap and GOGC=100. A global GOGC
# override suppresses the GOGC half of that tuning, and on a service with no
# memory cap there is no GOMEMLIMIT either — the heap then grows to
# GOGC x live-heap unbounded: a 4 GB block balloons one service past host
# RAM, Aerospike hits stop-writes-sys-memory-pct, and the node wedges. With
# caps in place an override "merely" defers GC until the heap slams the
# GOMEMLIMIT ceiling. Leave GOGC unset.
#
# Per-service caps (written by setup.sh, scaled to host RAM — see
# lib/mem_limits.sh). Caps, not reservations: they deliberately overcommit;
# the point is no single service can starve the datastores. 0 = unlimited.
# Re-run setup.sh after a RAM change, or edit by hand.
#MEM_LIMIT_LEGACY=
#MEM_LIMIT_SUBTREEVALIDATION=
#MEM_LIMIT_BLOCKVALIDATION=
#MEM_LIMIT_BLOCKASSEMBLY=
#MEM_LIMIT_SEEDER=
#MEM_LIMIT_BLOCKCHAIN=
#MEM_LIMIT_ASSET=
#MEM_LIMIT_PROPAGATION=
#MEM_LIMIT_BLOCKPERSISTER=
#MEM_LIMIT_PEER=
#MEM_LIMIT_RPC=
#MEM_LIMIT_PRUNER=

# === Log verbosity ===
# INFO (default) | DEBUG | WARN | ERROR
# Raise to DEBUG when diagnosing issues; expect significantly more log volume.
logLevel=INFO

# === Run mode ===
# Node listen mode: full or listen_only (blank not allowed).
#   full        — normal operation (sends + receives). Requires the two public
#                 endpoints below + COMPOSE_PROFILES containing 'p2p'.
#   listen_only — receive only, no outbound messages. Quickstart default for
#                 safety; flip to full once your public endpoints are wired up.
listen_mode=listen_only

# === Full-mode public endpoints (listen-only = leave blank) ===
# Quickstart does NOT set up a reverse proxy or TLS for you. Bring your own
# (Caddy, Cloudflare Tunnel, nginx+Let's Encrypt, VPS with domain) and point
# these values at it.
#
#   asset_httpPublicAddress  — full HTTPS URL including /api/v1
#                              e.g. https://node.example.com/api/v1
#   p2p_advertise_addresses  — libp2p multiaddr; one of:
#                              /dns4/<hostname>/tcp/9905   (DNS, recommended)
#                              /ip4/<ip>/tcp/9905          (IPv4 literal)
#                              /ip6/<ip>/tcp/9905          (IPv6 literal)
#
# After start.sh, lib/reachability.sh probes these to flag misconfiguration.
asset_httpPublicAddress=
p2p_advertise_addresses=

# === RPC credentials ===
# Generated by setup.sh (always — quickstart does not ship a blank-RPC config).
# You can also set these manually. Keep the password strong; the RPC port is
# loopback-only by default but that's not a substitute for real auth.
rpc_user=
rpc_pass=

# === gRPC admin API key ===
# Shared secret every Teranode service uses to call Blockchain. Blockchain
# refuses to start without it. setup.sh generates it, and start.sh fills it in
# when it is missing or blank; it never replaces a value you set. To rotate,
# put a new random value here (openssl rand -hex 32) and run ./start.sh so
# every service restarts with it.
grpc_admin_api_key=

# === Client identity shown in explorer ===
# setup.sh defaults this to teranode-<4 random hex> so each install is distinct.
clientName=teranode-default

# === Misc Teranode defaults for quickstart ===
p2p_health_check_enabled=false

# === DHT mode ===
# off    — no DHT participation. Bootstrap + topic peers only. Quickstart default.
#          Safe on abuse-sensitive hosts (Hetzner, OVH).
# client — queries the DHT but doesn't advertise.
# server — full DHT participation. Only enable if you advertise a public address
#          AND your provider tolerates the 100+ peer probes used to build the
#          routing table. See README "DHT mode" for details.
p2p_dht_mode=off

# === Legacy P2P bootstrap peers (optional) ===
# Pipe-separated list of host:port for the legacy BSV wire-protocol service.
# Leave blank to use the network's DNS seeds (default for mainnet / testnet /
# regtest). Set explicitly only when DNS seeds aren't appropriate — e.g.
# teratestnet, which has no DNS seeder:
#   legacy_config_ConnectPeers=57.130.17.176:38333
legacy_config_ConnectPeers=

# === Postgres password ===
# Generated by setup.sh. This protects the postgres superuser only; the
# Teranode services connect with a separate role (teranode:teranode) hardcoded
# in upstream settings.conf for the docker.m context, so rotating that password
# requires a different upstream context. Postgres is loopback-only by default.
POSTGRES_PASSWORD=teranode_change_me

# === Pruner trigger ===
# Controls when the pruner deletes spent UTXOs.
#   OnBlockMined     — prune spent UTXOs as soon as a block reaches the pruning
#                      depth (288 blocks by default). Use when blockpersister
#                      is NOT in COMPOSE_PROFILES (default quickstart setup).
#   OnBlockPersisted — wait for blockpersister to archive each block before pruning.
#                      Use only when COMPOSE_PROFILES includes 'blockpersister'.
# setup.sh sets this automatically based on your profile choice. If you flip
# blockpersister on/off by hand-editing COMPOSE_PROFILES, re-run ./setup.sh
# or update this value to match.
pruner_block_trigger=OnBlockMined

# === Compose profiles — controls which optional services run ===
# Comma-separated list. `docker compose up -d` reads this directly from .env;
# no need to pass --profile flags. Each tag toggles one service:
#
#   legacy         — legacy P2P bridge (BSV original wire protocol). On by default.
#   p2p            — Teranode P2P peer service. On by default. The listen_mode
#                    var above (active vs passive) controls behaviour, not
#                    whether this service runs.
#   blockpersister — archival mode: keeps full raw block history on disk.
#                    Off by default. Most operators don't need it (Teranode
#                    prunes spent UTXOs after 288 blocks). Useful for indexers /
#                    explorers / research. Significant disk cost.
#   monitoring     — Grafana + Prometheus + Aerospike exporter + Kafka console.
#                    On by default. Adds ~4 containers and ~1GB RAM. Drop the
#                    tag if you want a lean node-only stack.
#   seeding        — seeder service, one-shot UTXO snapshot loader.
#                    Off by default. Activated by ./seed.sh; don't set here.
COMPOSE_PROFILES=legacy,p2p,monitoring

# === Config file permissions ===
# setup.sh and start.sh make the config/ files mounted by the non-root
# monitoring containers world-readable (a+r), since a restrictive umask
# (027/077) otherwise leaves Prometheus/Grafana unable to read them.
# Set to 1 to manage those modes yourself. See lib/config_perms.sh.
# QUICKSTART_SKIP_CONFIG_PERMS=0