Skip to content

Environment Variables

dichit-backend loads a single dotenv file based on NODE_ENV, resolved in src/infrastructure/config/env-config.ts:

NODE_ENV File loaded Typical use
local (default / missing) .env.local local dev
development .env.dev shared dev environment
test .env.test functional tests
staging .env.staging staging
production .env.prod production (never committed)

The reference list is in .env.example. Never commit .env.prod; keep secrets out of git.

Runtime

Variable Default Purpose
NODE_ENV — selects the env file and behaviour
HOST 0.0.0.0 bind address
PORT 3500 HTTP/WS listen port
BASE_URL — public API base URL
FE_URL — frontend origin for CORS
LOG_LEVEL info pino level
LOG_PRETTY false pino-pretty in dev
LOG_REQUEST_BODY / LOG_RESPONSE_BODY false log bodies (debug only)
LOG_PRISMA_QUERIES false log each Prisma query
LOG_PRISMA_QUERY_PARAMS false include query params
LOG_PRISMA_SLOW_QUERY_MS 500 log queries slower than N ms

Database

Variable Purpose
DATABASE_URL full PostgreSQL connection string used by Prisma
DATABASE_HOST/PORT/USER/PASSWORD/DB raw connection components
DATABASE_SSL_ENABLED enable SSL (production)

Redis

Variable Purpose
REDIS_HOST / REDIS_PORT Redis endpoint
REDIS_PASSWORD auth password
REDIS_TLS_ENABLED TLS for managed Redis
REDIS_CONNECT_TIMEOUT connect timeout (ms)
REDIS_MAX_RETRIES_PER_REQUEST retry budget

AWS / S3

Variable Purpose
AWS_ACCESS_KEY / AWS_SECRET_ACCESS_KEY IAM creds
AWS_REGION e.g. ap-south-1
S3_*_BUCKET (COMPANY, SUBSCRIBER, PROGRAM, SUPER_ADMIN files) bucket per domain

SMTP / Mail

SMTP_HOST/PORT/USER/PASSWORD/FROM for the general mail service, plus a SMTP_PG_* set for the payment-gateway (Zwitch) mail pipeline.

Auth / OAuth

Variable Purpose
ACCESS_TOKEN_SECRET / REFRESH_TOKEN_SECRET JWT signing secrets
ACCESS_TOKEN_EXPIRES_IN / REFRESH_TOKEN_EXPIRES_IN TTLs (e.g. 15m / 7d)
COOKIE_SECRET / COOKIE_DOMAIN refresh-token cookie
REFRESH_COOKIE_MAX_AGE_SECONDS cookie lifetime
GOOGLE_* Google OAuth endpoints and client id/secret

SMS

SMS_SERVICE_URL, SMS_SERVICE_API_KEY, SMS_SERVICE_SENDER_ID for the SMS provider integration.

Payments (Zwitch)

ZWITCH_* API keys, payment/UPI/sub-account/IFSC service URLs, ZWITCH_WEBHOOK_SECRET, and ZWITCH_WEBHOOK_ALLOWED_IPS. See infrastructure/payment-gateway.md.

Encryption

AES_SECRET_KEY, HMAC_SECRET_KEY, INVOICE_NUMBER_ENCRYPTION_KEY (at least 32 chars). Used to encrypt sensitive persisted values (e.g. invoice numbers).

Sentry

SENTRY_ENABLED, SENTRY_ORG, SENTRY_PROJECT, SENTRY_DSN, SENTRY_AUTH_TOKEN, SENTRY_TRACE_RATE, SENTRY_PROFILE_RATE. See infrastructure/monitoring.md.

Notifications & integrations

Variable Purpose
SLACK_WEBHOOK_URL DevOps alerts (startup failures, incidents)
FCM_ENABLED, FCM_PROJECT_ID, FCM_CLIENT_EMAIL, FCM_PRIVATE_KEY Firebase push
WHATSAPP_* WhatsApp Business API (messages + webhook)

Admin tooling

BULL_BOARD_BASE_PATH (default /admin/queues), BULL_BOARD_USERNAME, BULL_BOARD_PASSWORD.

App-review login

APP_REVIEW_LOGIN_ENABLED, APP_REVIEW_MOBILE_NUMBERS, APP_REVIEW_FIXED_OTP, APP_REVIEW_ACCOUNT_LABEL — deterministic demo/QA sign-in.

Security rules

  1. Never log secrets — passwords, OTPs, tokens, auth headers, or the AWS_SECRET_ACCESS_KEY.
  2. Never commit .env.prod (or real secrets anywhere).
  3. Rotate *_SECRET values if they ever leave the vault.
  4. Use a password manager / secret manager for shared environments; .env.dev and .env.staging are committed for team convenience, keep them scoped.