# Application Environment
NODE_ENV=development # development | production | test
LOG_LEVEL=info       # debug | info | warn | error
PORT=3000

# Security
JWT_SECRET=your-super-secret-jwt-key-minimum-32-characters-long-please-change-this
TRUST_PROXY=false    # Set to true if behind nginx/load balancer

# Safe HTTP Client
SAFE_DOMAINS=api.example.com,api.github.com

# Redis (Optional - for distributed rate limiting)
# REDIS_URL=redis://localhost:6379

# ============================================================================
# PRODUCTION CHECKLIST
# ============================================================================
#  Set NODE_ENV=production
# Generate strong JWT_SECRET (min 32 chars): openssl rand -base64 32
#  Configure TRUST_PROXY if behind reverse proxy
#  Set up Redis for distributed rate limiting
#  Review and adjust rate limit settings
#  Configure CSP directives for your frontend
#  Enable HTTPS in production
# ============================================================================