.env.example

#
# QuantDinger unified configuration template
# Copy this file to `.env`. Docker Compose, backend services, workers, and the
# Settings page all use that single file.
#

# Optional custom ports
FRONTEND_HOST=127.0.0.1
FRONTEND_PORT=8888
# Canonical public frontend origins. The first entry is the default OAuth
# post-login redirect; list mobile H5 as an additional comma-separated origin.
FRONTEND_URL=http://localhost:8888,http://localhost:8889
BACKEND_PORT=127.0.0.1:5000
DB_PORT=127.0.0.1:5432
MOBILE_HOST=127.0.0.1
MOBILE_PORT=8889
REDIS_BIND=127.0.0.1:6379

# Core production credentials. Set these before using the production override.
POSTGRES_PASSWORD=
REDIS_PASSWORD=
CELERY_REDIS_PASSWORD=
# Optional Grafana credentials. Required only with docker-compose.observability.yml.
GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=

# Redis workload tiers and container limits.
REDIS_CACHE_MAXMEMORY=128mb
REDIS_JOBS_MAXMEMORY=512mb
REDIS_CACHE_NAMESPACE=quantdinger:cache:v1
CONTAINER_LOG_MAX_SIZE=20m
CONTAINER_LOG_MAX_FILES=5

# The first installation uses one replica per runtime role for a predictable,
# low-overhead single-host deployment. Increase these values only after load
# testing; replicas can later be spread across cluster nodes without changing
# strategy code or Kafka consumer groups.
STRATEGY_DISPATCHER_REPLICAS=1
STRATEGY_EVALUATOR_REPLICAS=1
TRADING_WORKER_REPLICAS=1

# Grid fills are durably routed to the trading worker that owns the strategy
# lease. REST reconciliation runs locally for that worker's grid actors.
GRID_ACTOR_ROUTING_ENABLED=true
GRID_ACTOR_BATCH_SIZE=100
GRID_ACTOR_EVENT_LEASE_SEC=30
GRID_ACTOR_MAX_ATTEMPTS=8

# Optional observability ports and retention. All bind to loopback by default.
PROMETHEUS_PORT=127.0.0.1:9090
ALERTMANAGER_PORT=127.0.0.1:9093
GRAFANA_PORT=127.0.0.1:3000
PROMETHEUS_RETENTION=30d

# PostgreSQL image/data overrides.
# Default compose now uses postgres:18.3-alpine with PGDATA=/var/lib/postgresql/18/docker.
# To reuse an existing 1Panel PostgreSQL 18 data directory, stop the old DB first,
# then point POSTGRES_DATA_SOURCE to the host directory that contains PG_VERSION.
# Example for 1Panel PostgreSQL with:
#   host mount: /opt/1panel/apps/postgresql/postgresql/data -> /var/lib/postgresql
#   PGDATA:     /var/lib/postgresql/18/docker
# use:
POSTGRES_IMAGE=
POSTGRES_DATA_SOURCE=postgres_data
POSTGRES_PGDATA=/var/lib/postgresql/18/docker
POSTGRES_USER=quantdinger
POSTGRES_DB=quantdinger

# Global image source switch for infrastructure images
# Leave empty for official Docker Hub:
IMAGE_PREFIX=
REDIS_IMAGE=
#
# Common alternatives (pick one, keep trailing slash):
# IMAGE_PREFIX=docker.m.daocloud.io/library/
# IMAGE_PREFIX=docker.xuanyuan.me/library/
#
# Important:
# - This file lives in the project root and is the only runtime config file.
# - Existing `backend_api_python/.env` or `backend.env` files are migration inputs only.
# - `IMAGE_PREFIX` applies to postgres, redis, backend base image, and frontend nginx.
# - For slow `docker pull` of base images, use IMAGE_PREFIX or Docker
#   Desktop → Settings → Docker Engine → registry-mirrors (e.g. daocloud).

# Backend Dockerfile region switch (used by docker-compose.yml build):
#   global  = use Debian/PyPI official sources directly, skip Aliyun entirely (default)
#   cn      = use Aliyun apt/PyPI mirrors with fallback to official
BUILD_REGION=global

# Backend Python base image override for local builds.
# docker-compose.yml defaults to docker.1ms.run/library/python:3.12-slim-bookworm
# to reduce first-install failures caused by Docker Hub auth/base-image pulls.
# Set this only when you want a different source.
PYTHON_BASE_IMAGE=docker.1ms.run/library/python:3.12-slim-bookworm
# PYTHON_BASE_IMAGE=docker.xuanyuan.me/library/python:3.12-slim-bookworm

# Recommended install paths:
# - Regular users: use docker-compose.ghcr.yml. It pulls prebuilt backend,
#   frontend, and mobile images and does not build from python:3.12 locally.
# - Developers/local source edits: use docker-compose.yml and set
#   PYTHON_BASE_IMAGE only if Docker Hub is slow.

# ----- Image tags (consumed by both docker-compose.yml and docker-compose.ghcr.yml) -----
#
# Resolution order (highest precedence first):
#   BACKEND_TAG / FRONTEND_TAG  →  IMAGE_TAG  →  compose file default (latest)
#
# Default: compose pulls ghcr.io/.../quantdinger-*:latest on every `up` (pull_policy: always).
# Uncomment to pin a release (GHCR semver tags omit the leading "v", e.g. v5.0.1 → 5.0.1):
# IMAGE_TAG=5.0.1
#
# Advanced — decouple sides (e.g. frontend hotfix against stable backend):
# FRONTEND_TAG=5.0.2
# BACKEND_TAG=5.0.1
#
# Override the GHCR image paths (e.g. for forks):
# BACKEND_IMAGE=ghcr.io/openbyteinc/quantdinger-backend
# FRONTEND_IMAGE=ghcr.io/openbyteinc/quantdinger-frontend

# ============================================================================
# Backend application runtime configuration
# ============================================================================
# Application settings loaded from the project-root `.env`.
# This section is also packaged into backend images as a startup fallback.
#
# This file is organized as:
# 1) first-time deployment settings at the top
# 2) advanced / rarely changed settings at the bottom
# Deployment settings and application settings now share the same `.env`.

# =========================
# Brand / identity (drives logo, footer, version label, legal modals)
# =========================
# Frontend reads these via /api/settings/brand-config — leave any field empty
# to fall back to the bundled QuantDinger defaults. Change here (or via the
# Settings page) to rebrand a deployment without rebuilding the frontend.
BRAND_APP_NAME=QuantDinger
BRAND_COPYRIGHT=© 2025-2026 QuantDinger. All rights reserved.

# Logo / favicon URLs (HTTPS recommended; leave empty to use bundled assets)
BRAND_LOGO_LIGHT_URL=
BRAND_LOGO_DARK_URL=
BRAND_LOGO_COLLAPSED_URL=
BRAND_FAVICON_URL=

# Contact & support links surfaced in the sidebar footer.
BRAND_CONTACT_EMAIL=support@quantdinger.com
BRAND_CONTACT_SUPPORT_URL=https://t.me/quantdinger
BRAND_CONTACT_LIVE_CHAT_URL=https://t.me/quantdinger
BRAND_CONTACT_FEATURE_REQUEST_URL=https://github.com/OpenByteInc/QuantDinger/issues

# Social accounts shown as icons in the sidebar footer. Leave any single
# entry empty to hide that icon.
BRAND_SOCIAL_GITHUB=https://github.com/OpenByteInc/QuantDinger
BRAND_SOCIAL_X=https://x.com/quantdinger_en
BRAND_SOCIAL_DISCORD=https://discord.com/invite/tyx5B6TChr
BRAND_SOCIAL_TELEGRAM=https://t.me/quantdinger
BRAND_SOCIAL_YOUTUBE=https://youtube.com/@quantdinger

# Legal: external URL takes priority; if both URL and inline text are empty,
# the frontend falls back to the built-in i18n copy.
BRAND_LEGAL_USER_AGREEMENT_URL=
BRAND_LEGAL_USER_AGREEMENT_TEXT=
BRAND_LEGAL_PRIVACY_POLICY_URL=
BRAND_LEGAL_PRIVACY_POLICY_TEXT=

# =========================
# Auth (required)
# =========================
# Required: >= 10 bytes for legacy compatibility; 32+ random bytes recommended.
# The API refuses to start while empty or while using the public legacy default.
# Generate: python -c "import secrets; print(secrets.token_hex(32))"
SECRET_KEY=
# Stable key for broker credentials and MFA secrets. Keep this unchanged when
# rotating SECRET_KEY. The container generates and persists one when omitted.
CREDENTIAL_ENCRYPTION_KEY=
ADMIN_USER=quantdinger
# Leaving ADMIN_PASSWORD as 123456 will trigger a first-login change-password reminder.
# Set any non-default value before startup to skip that reminder and initialize safely.
ADMIN_PASSWORD=123456
ADMIN_EMAIL=

# =========================
# Core app
# =========================
DATABASE_URL=postgresql://quantdinger:quantdinger123@postgres:5432/quantdinger
QD_PROCESS_ROLE=legacy
STRATEGY_COMMANDS_ENABLED=false
STRATEGY_COMMAND_STOP_WAIT_SEC=5
STRATEGY_COMMAND_LEASE_SEC=30
STRATEGY_COMMAND_MAX_ATTEMPTS=3
STRATEGY_COMMAND_WORKER_POLL_SEC=0.5
STRATEGY_RUNTIME_LEASE_SEC=30
STRATEGY_COMMAND_RETENTION_DAYS=30
WORKER_HEARTBEAT_RETENTION_DAYS=7

# Celery is enabled by Docker Compose. Keep it disabled for a standalone
# development process that does not run a broker and worker.
CELERY_TASKS_ENABLED=false
# Leave explicit URLs empty to use the host/password/database settings below.
CELERY_BROKER_URL=
CELERY_RESULT_BACKEND=
CELERY_REDIS_HOST=redis-jobs
CELERY_REDIS_PORT=6379
CELERY_BROKER_DB=0
CELERY_RESULT_DB=1
CELERY_CONCURRENCY=2
CELERY_WORKER_PREFETCH=1
CELERY_MAX_TASKS_PER_CHILD=100
CELERY_TASK_SOFT_TIME_LIMIT=3300
CELERY_TASK_TIME_LIMIT=3600
CELERY_VISIBILITY_TIMEOUT=7200
MARKET_CATALOG_SYNC_INTERVAL_SEC=86400
AI_CALIBRATION_INTERVAL_SEC=86400
# FRONTEND_URL: the canonical user-facing URL of the web app.
# - Used for: CORS allow-list, default post-login OAuth redirect target.
# - Comma-separated multi-origin IS supported (the first entry is the
#   default OAuth redirect; every entry is added to the CORS / OAuth
#   allow-list). Prefer the simpler `OAUTH_ALLOWED_REDIRECTS` below for
#   the second / third front-end origin so that this stays a single URL.
# - You do NOT need to add Capacitor / Cordova / Ionic mobile-app origins
#   here (https://localhost, capacitor://localhost, ionic://localhost,
#   http://localhost). The backend whitelists those automatically because
#   they are fixed synthetic origins controlled by the OS, not user input.
# - If your mobile app uses a separate API subdomain like
#   https://api.quantdinger.com, make sure your nginx server_block for that
#   host is reverse-proxying /api/* to the backend port (5000).
# Examples:
#   FRONTEND_URL=https://ai.quantdinger.com
#   FRONTEND_URL=https://ai.quantdinger.com,https://m.quantdinger.com
# Extra front-end origins allowed as OAuth post-login redirect targets.
# Comma-separated, scheme + host (+ optional port). Used when multiple clients
# (e.g. PC web + mobile web) share the same backend. FRONTEND_URL is always
# allowed implicitly; list every additional front-end here.
# Example: OAUTH_ALLOWED_REDIRECTS=https://m.quantdinger.com,https://app.quantdinger.com,com.quantdinger.mobile://login
OAUTH_ALLOWED_REDIRECTS=
# OAuth CSRF state TTL (minutes); stored in Postgres for multi-worker. Default 20, clamped [5,120].
OAUTH_STATE_TTL_MINUTES=20
ENABLE_REGISTRATION=true

# =========================
# Mobile app (in-app version check)
# =========================
# Semver-like string shown to clients; leave empty to avoid "new version" prompts.
MOBILE_APP_LATEST_VERSION=
# APK / install page URL for one-tap update on Android (HTTPS recommended).
MOBILE_APP_DOWNLOAD_URL=https://www.quantdinger.com/download/app.apk

# =========================
# Database bootstrap behaviour
# =========================
# On every backend startup we auto-apply `migrations/init.sql` so a fresh
# install (especially bare-metal / Windows local PG) gets the full schema
# without anyone remembering to `psql -f` first. The file uses
# `CREATE TABLE IF NOT EXISTS` everywhere so re-running is a no-op.
# Set to `true` if you manage schema externally (Flyway, Liquibase, etc.)
# and don't want the backend touching DDL on boot. Permission probing on
# critical tables still runs either way.
SKIP_AUTO_MIGRATE=false

# =========================
# Database connection pool (psycopg2 ThreadedConnectionPool)
# =========================
# DB_POOL_MAX defaults to auto. Most self-hosted deployments should leave it
# as auto; the backend probes PostgreSQL max_connections and picks a safe
# per-process pool size. Advanced operators may set an integer override.
DB_POOL_MIN=5
DB_POOL_MAX=auto
DB_POOL_ACQUIRE_TIMEOUT=10
DB_POOL_HEALTH_CHECK=true
DB_POOL_AUTO_CAP=true
DB_POOL_AUTO_DEFAULT_MAX=50
DB_POOL_RESERVE_FOR_OTHER_CLIENTS=20
DB_APPLICATION_NAME=quantdinger_api

# Docker Compose configures the trading process separately because strategy
# recovery is highly concurrent. Set TRADING_DB_POOL_MAX in the project-root
# .env when the default of 32 needs to be changed. Keep the sum of all process
# pools below PG_MAX_CONNECTIONS.

# Route-level parallel fetch executors.  Each worker may hold one DB
# connection, so keep MARKET_EXECUTOR_WORKERS + PORTFOLIO_EXECUTOR_WORKERS
# well below DB_POOL_MAX.
MARKET_EXECUTOR_WORKERS=6
PORTFOLIO_EXECUTOR_WORKERS=3

# Gunicorn worker/thread model
GUNICORN_WORKERS=1
GUNICORN_THREADS=8

# =========================
# AI / LLM (choose one provider)
# =========================
LLM_PROVIDER=openrouter
# LLM calls are direct by default. Use this only when your model provider
# must be reached through a proxy. This is intentionally separate from PROXY_URL.
LLM_PROXY_URL=
# Advanced: inherit HTTP_PROXY / HTTPS_PROXY / ALL_PROXY for LLM calls.
# Keep false unless the backend can actually reach that proxy endpoint.
LLM_USE_SYSTEM_PROXY=false

# Optional JEV pre-trade decision filter. Configure this from System Settings
# or set the values here. QuantDinger tries JEV first, then the configured LLM.
# If neither provider is configured or both are unavailable, entries are
# allowed and the fail-open outcome is written to the AI decision audit log.
JEV_API_KEY=
JEV_BASE_URL=https://api.typesafe.ai/v1
JEV_MODEL=jev-latest
JEV_TIMEOUT_SECONDS=8
JEV_MIN_CONFIDENCE=0.55
AI_DECISION_TIMEOUT_SECONDS=10

OPENROUTER_API_KEY=
OPENROUTER_MODEL=openai/gpt-5.4
# Optional: dedicated model for AI code generation (fallback to provider default if empty)
AI_CODE_GEN_MODEL=

OPENAI_API_KEY=
OPENAI_MODEL=gpt-5.4

GOOGLE_API_KEY=
GOOGLE_MODEL=gemini-1.5-flash

DEEPSEEK_API_KEY=
DEEPSEEK_MODEL=deepseek-chat

GROK_API_KEY=
GROK_MODEL=grok-beta

# AtlasCloud (set LLM_PROVIDER=atlascloud)
# Official OpenAI-compatible LLM base URL must include /v1.
ATLASCLOUD_API_KEY=
ATLASCLOUD_MODEL=openai/gpt-5.4
ATLASCLOUD_BASE_URL=https://api.atlascloud.ai/v1

# OpenAI-compatible third-party API (set LLM_PROVIDER=custom)
# Local Ollama example (backend must reach this host; Docker Desktop: http://host.docker.internal:11434/v1):
#   CUSTOM_API_URL=http://127.0.0.1:11434/v1
#   CUSTOM_MODEL=llama3.2
# Ollama usually needs no key — leave CUSTOM_API_KEY empty.
CUSTOM_API_URL=
CUSTOM_API_KEY=
CUSTOM_MODEL=

# MiniMax (set LLM_PROVIDER=minimax)
MINIMAX_API_KEY=
MINIMAX_MODEL=MiniMax-M2.7
MINIMAX_BASE_URL=https://api.minimax.io/v1

# =========================
# Common background jobs
# =========================
ENABLE_PENDING_ORDER_WORKER=true
ENABLE_PORTFOLIO_MONITOR=true
DISABLE_RESTORE_RUNNING_STRATEGIES=false
# Private fill streams are the primary source of execution and actual-fee events.
# REST remains enabled as reconnect catch-up and a periodic consistency audit.
ENABLE_PRIVATE_EXECUTION_STREAMS=true
EXECUTION_STREAM_REFRESH_SEC=30
EXECUTION_STREAM_REST_AUDIT_SEC=30
# Only running live accounts receive private fill streams. Overflow accounts
# keep using REST reconciliation, so this should stay below BACKEND_PIDS_LIMIT.
EXECUTION_STREAM_MAX_ADAPTERS=64

# Position sync (pending_order_worker): polls exchange positions for live strategies.
# Many strategies often share one API key — cache + longer interval avoids Binance IP bans.
POSITION_SYNC_ENABLED=true
POSITION_SYNC_INTERVAL_SEC=30
# Reuse one get_positions() result per credential for this many seconds (0 = auto: max(30, INTERVAL)).
POSITION_SYNC_CACHE_TTL_SEC=0
# A fresh flat exchange snapshot may clear a local strategy leg only after the exact
# close-side fill set is attributed and recorded. Set false for emergency rollback.
POSITION_SYNC_PURGE_FLAT_LEDGER=true
# An open/add fill younger than this keeps its leg even if the venue looks flat.
POSITION_SYNC_PURGE_GRACE_SEC=120
# When true, OKX code paths may cancel *all* algo orders (pre-clean before leverage
# setup and the account-wide sweep during 59669 retries). Those sweeps also cancel
# manually placed TP/SL orders, so they are off unless you accept that.
OKX_CANCEL_ALL_ALGO_ORDERS=false
# After HTTP 418 / rate-limit, pause sync for this credential (seconds).
EXCHANGE_SYNC_BACKOFF_SEC=900

# =========================
# Agent Gateway (/api/agent/v1) — see docs/agent/AGENT_QUICKSTART.md
# =========================
# Thread pool size for async agent jobs (backtests, experiment pipelines).
AGENT_JOBS_MAX_WORKERS=4
# Total queued/running lifetime before automatic failure and credit refund.
# Keep this above the longest intended backtest; Celery Beat checks every minute.
AGENT_BILLED_JOB_TIMEOUT_SEC=7200
# Aggregate tenant quota in addition to each token's rate_limit_per_min.
AGENT_TENANT_RATE_LIMIT_PER_MIN=600
# Async-job admission caps. Completed/cancelled jobs do not count.
AGENT_MAX_CONCURRENT_JOBS_PER_TENANT=4
AGENT_MAX_CONCURRENT_JOBS_PER_TOKEN=2
# A crashed request may be retried with the same key after this reservation TTL.
AGENT_IDEMPOTENCY_IN_PROGRESS_TTL_SEC=900
# Default live-trading caps copied onto newly issued Agent Tokens.
AGENT_DEFAULT_MAX_ORDER_NOTIONAL=1000
AGENT_DEFAULT_MAX_DAILY_NOTIONAL=5000
# Hard kill switch for live trading from agent tokens. Even when a token is
# issued with paper_only=false, live order routing remains disabled until this
# flag is true AND a live executor implementation is wired in. Until then,
# `T`-class agent calls always record paper orders in qd_agent_paper_orders.
AGENT_LIVE_TRADING_ENABLED=false
# Deployment topology hint for the Agent Gateway.
#   (unset)        — single-tenant / self-hosted; users manage tokens in Profile.
#   saas / hosted  — multi-tenant hosted instance (e.g. ai.quantdinger.com):
#                    users self-issue tokens (incl. T scope) from Profile → My Agent Token.
#                    paper_only defaults to true; live T requires ack_live_trading_risk
#                    at issuance plus AGENT_LIVE_TRADING_ENABLED on the server.
QUANTDINGER_DEPLOYMENT_MODE=self_hosted

# =========================
# Email / SMTP (optional)
# =========================
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=
SMTP_USE_TLS=true
SMTP_USE_SSL=false

# =========================
# Proxy (optional, sometimes required for exchange OHLCV access)
# =========================
# PROXY_URL is for market data, exchange and broker API traffic. LLM providers do
# not use it by default; configure LLM_PROXY_URL above if an LLM provider needs a proxy.
# Native public exchange clients read PROXY_URL for exchange REST calls. System VPN does
# NOT apply inside Docker; set this when logs show "binance GET ... exchangeInfo" failures.
# Clash: enable "Allow LAN", use HTTP port (often 7890). Docker Desktop on Windows/macOS:
# PROXY_URL=http://host.docker.internal:7890
# PROXY_URL=socks5h://127.0.0.1:10808              # backend run directly on host
# PROXY_URL=socks5h://host.docker.internal:10808     # Docker + Clash SOCKS
PROXY_URL=

# Outbound HTTPS to exchanges when using PROXY_URL (especially SOCKS). If you see
# SSLCertVerificationError / "unable to get local issuer certificate":
# - Prefer: install OS ca-certificates in the image, or point to a PEM bundle:
#   LIVE_TRADING_CA_BUNDLE=/path/to/ca-bundle.pem
#   (REQUESTS_CA_BUNDLE / SSL_CERT_FILE are also honored.)
# - Last resort only: LIVE_TRADING_SSL_VERIFY=false  # disables TLS verify; insecure
#LIVE_TRADING_CA_BUNDLE=
#LIVE_TRADING_SSL_VERIFY=

# =========================
# Local desktop brokers (IBKR)
# =========================
# Interactive Brokers needs TWS/IB Gateway on a
# machine reachable from this API (typically your own PC or a VPS with those apps).
# On a public multi-tenant cloud deployment, set to false so users see a clear message
# instead of broken flows. Crypto exchange API keys are unaffected.
ALLOW_LOCAL_DESKTOP_BROKERS=true

# IBKR: clientId for live orders (strategy worker). Must differ from POST /api/ibkr/connect
# default (1) or TWS will disconnect one of the sessions within seconds.
#IBKR_ORDER_CLIENT_ID=7
# Dedicated IBKR execution/commission stream session; must differ from order/UI sessions.
#IBKR_STREAM_CLIENT_ID=8

# =========================
# Captcha / OAuth (optional)
# =========================
TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=
# Short-lived local auth-page clearance after a successful Turnstile challenge.
TURNSTILE_CLEARANCE_TTL_SECONDS=600

GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_REDIRECT_URI=http://localhost:5000/api/auth/oauth/google/callback

GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GITHUB_REDIRECT_URI=http://localhost:5000/api/auth/oauth/github/callback

# =========================
# Billing / payments
# =========================
BILLING_ENABLED=false
MARKETPLACE_ENABLED=false

# Points unit price
BILLING_COST_BACKTEST=30
BILLING_COST_AI_REVIEW=10
BILLING_COST_AI_ANALYSIS=10
BILLING_COST_AI_CODE_GEN=30

CREDITS_REGISTER_BONUS=100
CREDITS_REFERRAL_BONUS=50
FREE_USER_STRATEGY_LIMIT=5
REFERRAL_PROGRAM_ENABLED=false
REFERRAL_REWARD_RATES=10,5,3
REFERRAL_REWARD_HOLD_DAYS=7
REFERRAL_MIN_WITHDRAWAL_USD=10

# Membership plans
MEMBERSHIP_MONTHLY_PRICE_USD=19.9
MEMBERSHIP_YEARLY_PRICE_USD=199
MEMBERSHIP_LIFETIME_PRICE_USD=499
MEMBERSHIP_MONTHLY_CREDITS=500
MEMBERSHIP_YEARLY_CREDITS=8000
MEMBERSHIP_LIFETIME_MONTHLY_CREDITS=800

# =========================
# USDT payment (v3.0.6+: single fixed address per chain + amount-suffix matching)
# =========================
# How it works (replaces the old xpub HD-derived per-order address model):
#   - One fixed receiving address per chain (your own main wallet).
#   - Every order is identified on-chain by a unique amount suffix in the
#     low decimals, e.g. base $19.9 -> 19.991234 USDT, where .001234 is the
#     unique order tag. Funds land directly in your wallet, no consolidation.
#   - Chains without an address configured are auto-hidden in the UI.
#
# Global switch.
USDT_PAY_ENABLED=false

# Comma-separated list of enabled chains. Any code not in this list is rejected
# at order creation even if its address is configured. Valid codes:
# TRC20 / BEP20 / ERC20 / SOL
USDT_PAY_ENABLED_CHAINS=TRC20,BEP20,ERC20,SOL

# --- Receiving addresses (one per chain). Leave blank to hide that chain ---
# TRON  (base58, starts with T...)
USDT_TRC20_ADDRESS=
# BSC   (EVM 0x..., the same Ethereum-style address)
USDT_BEP20_ADDRESS=
# Ethereum  (EVM 0x...)
USDT_ERC20_ADDRESS=
# Solana  (wallet address; the SPL USDT mint ATA is computed on-chain by the wallet)
USDT_SOL_ADDRESS=

# --- USDT contract / mint per chain (override only if you know what you're doing) ---
USDT_TRC20_CONTRACT=TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t
USDT_BEP20_CONTRACT=0x55d398326f99059fF775485246999027B3197955
USDT_ERC20_CONTRACT=0xdAC17F958D2ee523a2206206994597C13D831ec7
USDT_SOL_MINT=Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB

# =========================
# USDC payment (Circle-issued native USDC on supported scanners)
# =========================
USDC_PAY_ENABLED=false
USDC_PAY_ENABLED_CHAINS=ERC20,SOL

# Optional dedicated receiving addresses. Leave blank to reuse the matching
# USDT address above.
USDC_ERC20_ADDRESS=
USDC_SOL_ADDRESS=

USDC_ERC20_CONTRACT=0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48
USDC_SOL_MINT=EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v

# Stripe Checkout. A per-plan price_... ID is optional. When it is blank, the
# server creates an inline product using the plan's USD price and tax code.
STRIPE_PAY_ENABLED=false
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
# SaaS for personal use. Change this if your Stripe product category differs.
STRIPE_PRODUCT_TAX_CODE=txcd_10103000
STRIPE_SUCCESS_URL=
STRIPE_CANCEL_URL=

# --- Block explorers / RPC endpoints used to reconcile incoming transfers ---
TRONGRID_BASE_URL=https://api.trongrid.io
TRONGRID_API_KEY=

# BSC (BEP20) USDT reconciliation runs on public BSC JSON-RPC by default
# — Etherscan's V2 free plan no longer covers BSC and the legacy v1 host
# is deprecated. The watcher calls eth_getLogs against the USDT contract,
# filtered by Transfer(from, to, value) events, which every public BSC
# node supports natively at no cost. Comma-separated list; leave blank
# to use the curated defaults baked into the code.
BSC_RPC_URLS=https://bsc-dataseed1.binance.org,https://bsc.publicnode.com,https://rpc.ankr.com/bsc

# ERC20 (Ethereum) USDT reconciliation uses Etherscan V2 first because
# its free plan still covers Ethereum mainnet, falling back to public
# Ethereum RPC if the explorer call fails. Set ETHERSCAN_API_KEY to a
# key from https://etherscan.io/myapikey (free tier is enough for ETH).
ETHERSCAN_API_KEY=
ETHERSCAN_V2_BASE_URL=https://api.etherscan.io/v2/api
ETH_RPC_URLS=https://ethereum-rpc.publicnode.com,https://rpc.ankr.com/eth

# Override per-chain reconciliation strategy. Set BEP20_PREFER_EXPLORER=true
# only if you upgrade to an Etherscan API paid plan that covers BSC; leave
# it false (default) for RPC-only reconciliation. Same idea for ERC20.
# BEP20_PREFER_EXPLORER=false
# ERC20_PREFER_EXPLORER=true

# Legacy v1 explorer overrides — only set these if you intentionally pin
# to a deprecated v1 host (api.bscscan.com / api.etherscan.io). Leave them
# commented out for new deployments; the v2 unified API + RPC fallback
# above is preferred.
# ETHERSCAN_BASE_URL=
# BSCSCAN_BASE_URL=
# BSCSCAN_API_KEY=

SOLANA_RPC_URL=https://api.mainnet-beta.solana.com

# --- Amount suffix policy ---
# Number of decimals used for the suffix portion. 6 means ±0.000001 USDT
# granularity, giving a collision space of ~10^5 per (chain, base_price)
# inside the active window. The unique index on (chain, amount_usdt) where
# status IN ('pending','paid') guarantees no two live orders collide.
USDT_AMOUNT_SUFFIX_DECIMALS=6

# --- Confirm / expiry / worker tuning ---
USDT_PAY_CONFIRM_SECONDS=30
USDT_PAY_EXPIRE_MINUTES=30
USDT_WORKER_POLL_INTERVAL=30

# =========================
# Advanced / rarely changed
# =========================

# Network / App tuning
PYTHON_API_HOST=0.0.0.0
PYTHON_API_PORT=5000
PYTHON_API_DEBUG=false
# Interactive OpenAPI browsers (/api/docs/swagger, /api/docs/redoc).
# Defaults to on when PYTHON_API_DEBUG=true; set true explicitly to enable in production.
OPENAPI_ENABLED=false
RATE_LIMIT=100
ENABLE_CACHE=false
ENABLE_REQUEST_LOG=true

# Strategy / execution tuning
PENDING_ORDER_STALE_SEC=90
ORDER_MODE=market
MAKER_WAIT_SEC=10
MAKER_OFFSET_BPS=2
# Spot sizing (also editable in Admin → Settings → Live Trading)
# Close: base-asset fees are recorded net; cap sell size to the full free balance by default.
SPOT_CLOSE_SAFETY_RATIO=1.0
# Open: use only this fraction of allocated USDT/notional on spot buys
SPOT_OPEN_QUOTE_BUFFER=0.995
# User script runtime guardrails prevent one bad strategy from occupying a live
# execution thread indefinitely.
STRATEGY_SCRIPT_CALLBACK_TIMEOUT_SEC=5
STRATEGY_SCRIPT_MAX_CONSECUTIVE_TIMEOUTS=3
STRATEGY_SCRIPT_MAX_BARS_PER_CALL=1000
STRATEGY_SCRIPT_MAX_LOGS_PER_FLUSH=50
STRATEGY_SCRIPT_MAX_LOG_CHARS=500
# Global grid fill poller (ENABLE_GRID_FILL_POLLER=true in app startup).
ENABLE_GRID_FILL_POLLER=true
GRID_FILL_POLL_SEC=3
# Per resting order min interval between exchange status queries (seconds).
GRID_FILL_MIN_ORDER_INTERVAL_SEC=5
# Max orders polled per poller loop (spread load across cycles).
GRID_FILL_MAX_ORDERS_PER_CYCLE=150
# Max exchange API calls per credential per minute (rate-limit guard).
GRID_FILL_MAX_REQ_PER_CREDENTIAL_PER_MIN=120
# Grid: auto-stop after N consecutive order failures (non-fatal errors).
GRID_ORDER_ERROR_STOP_THRESHOLD=5
# Maximum active strategy runtimes admitted by one trading worker.
STRATEGY_MAX_ACTIVE=3000
# Fixed number of cooperative evaluator threads. Active strategies yield back
# to this pool between risk ticks and completed-bar boundaries.
STRATEGY_EVALUATOR_THREADS=16
# Share public price streams only when exchange, market type, API family, and
# instrument identities match. Set false for an immediate per-strategy rollback.
SHARED_PUBLIC_MARKET_FEED_ENABLED=true
# Coalesce REST price fallback calls for the same shared feed over this window.
SHARED_PUBLIC_MARKET_FALLBACK_TTL_SEC=1
# Publish versioned bar-close events and wake matching strategy runtimes. Event
# identity includes venue, market type, instrument, and timeframe.
BAR_CLOSE_EVENT_SCHEDULER_ENABLED=true
# Allow providers a short window to finalize the candle after its time boundary.
BAR_CLOSE_EVENT_GRACE_SEC=0.5
# Safety wake for an idle event-driven runtime if an event is missed.
BAR_EVENT_FALLBACK_WAKE_SEC=300
# Kafka is the inter-process event backbone for bar-driven strategy execution.
# The local event bus remains available for process-local observers and fallback.
KAFKA_BOOTSTRAP_SERVERS=localhost:29092
KAFKA_EVENT_PUBLISH_ENABLED=true
KAFKA_CLIENT_ID=quantdinger-runtime
KAFKA_SECURITY_PROTOCOL=PLAINTEXT
KAFKA_SASL_MECHANISM=PLAIN
KAFKA_SASL_USERNAME=
KAFKA_SASL_PASSWORD=
KAFKA_COMPRESSION_TYPE=zstd
KAFKA_LINGER_MS=5
KAFKA_DELIVERY_TIMEOUT_MS=30000
KAFKA_FLUSH_TIMEOUT_SEC=5
KAFKA_REPLICATION_FACTOR=1
KAFKA_MARKET_PARTITIONS=6
KAFKA_STRATEGY_PARTITIONS=12
KAFKA_ORDER_PARTITIONS=12
KAFKA_DLQ_PARTITIONS=3
KAFKA_HEAP_OPTS=-Xms256m -Xmx768m
KAFKA_OFFSETS_TOPIC_NUM_PARTITIONS=12
KAFKA_TRANSACTION_STATE_LOG_NUM_PARTITIONS=12
KAFKA_TOPIC_MARKET_BAR=qd.market.bar.closed.v1
KAFKA_TOPIC_STRATEGY_LIFECYCLE=qd.strategy.lifecycle.v1
KAFKA_TOPIC_STRATEGY_EVALUATE=qd.strategy.evaluate.v1
KAFKA_TOPIC_ORDER_INTENT=qd.order.intent.v1
KAFKA_TOPIC_ORDER_EVENT=qd.order.event.v1
KAFKA_TOPIC_RUNTIME_DLQ=qd.runtime.dlq.v1
KAFKA_AUDIT_GROUP_ID=quantdinger-runtime-audit-v1
# Stable strategy shards are shared by single-node and clustered deployments.
# Do not change the count after production events exist without a migration.
STRATEGY_SHARD_COUNT=128
STRATEGY_EVALUATION_BATCH_SIZE=250
KAFKA_STRATEGY_DISPATCH_GROUP_ID=quantdinger-strategy-dispatch-v1
KAFKA_DISPATCH_FLUSH_TIMEOUT_SEC=10
# Evaluators consume stable strategy shards with durable inbox deduplication
# and fencing. Active mode owns bar-driven strategy evaluation and execution.
KAFKA_STRATEGY_EVALUATOR_GROUP_ID=quantdinger-strategy-evaluator-active-v1
STRATEGY_EVALUATOR_MODE=active
# Bar-driven strategies run through Kafka evaluators. Grid, martingale, and
# realtime price-trigger strategies remain on their dedicated local runtimes.
STRATEGY_DISTRIBUTED_BAR_ENABLED=true
STRATEGY_EVALUATOR_LEASE_SEC=45
STRATEGY_EVALUATOR_MAX_ATTEMPTS=5
STRATEGY_EVALUATOR_BATCH_WORKERS=16
STRATEGY_EVALUATION_TIMEOUT_SEC=90
KAFKA_MAX_POLL_INTERVAL_MS=900000
# Legacy polling fallback. Active positions, orders, protections, grid, and
# martingale runtimes always keep the configured risk tick.
BAR_IDLE_SCHEDULER_ENABLED=true
BAR_IDLE_WAKE_INTERVAL_SEC=60
SIGNAL_NOTIFY_TIMEOUT_SEC=6

# LLM advanced tuning
OPENROUTER_API_URL=https://openrouter.ai/api/v1/chat/completions
OPENROUTER_TEMPERATURE=0.7
# Shared maximum output-token budget for all LLM providers.
# Providers charge for tokens actually generated, not this full upper bound.
LLM_MAX_TOKENS=16384
OPENROUTER_TIMEOUT=300
OPENROUTER_CONNECT_TIMEOUT=30
OPENAI_BASE_URL=https://api.openai.com/v1
DEEPSEEK_BASE_URL=https://api.deepseek.com/v1
GROK_BASE_URL=https://api.x.ai/v1

# Data sources
DATA_SOURCE_TIMEOUT=30
DATA_SOURCE_RETRY=3
DATA_SOURCE_RETRY_BACKOFF=0.5
FINNHUB_API_KEY=
# Optional free-tier Finnhub helper for US stock quotes, company profile and news.
# Keep FINNHUB_FREE_ONLY=true unless your plan includes paid endpoints such as Economic Calendar/Social Sentiment.
FINNHUB_FREE_ONLY=true
FINNHUB_TIMEOUT=10
FINNHUB_RATE_LIMIT=60
# Optional official international economic calendar provider.
# Leave empty to use the no-key AkShare/WallstreetCN fallback. The legacy Trading Economics guest account is discontinued.
TRADING_ECONOMICS_CLIENT=
TRADING_ECONOMICS_KEY=
TRADING_ECONOMICS_BASE_URL=https://api.tradingeconomics.com
TRADING_ECONOMICS_TIMEOUT=10
# US macro time-series and official macro detail sources.
FRED_API_KEY=
FRED_BASE_URL=https://api.stlouisfed.org/fred
FRED_TIMEOUT=10
BLS_API_KEY=
BLS_BASE_URL=https://api.bls.gov/publicAPI/v2
BLS_TIMEOUT=10
BEA_API_KEY=
BEA_BASE_URL=https://apps.bea.gov/api/data
BEA_TIMEOUT=10
# Public crypto OHLCV/ticker (no API keys). binance supports BTC/USDT.
# In mainland CN / Docker without outbound access to api.binance.com, set PROXY_URL above.
CRYPTO_PUBLIC_DEFAULT_EXCHANGE=binance
CRYPTO_PUBLIC_TIMEOUT=10000
MARKET_CATALOG_AUTO_SYNC=true
AKSHARE_TIMEOUT=30
YFINANCE_TIMEOUT=30
# AI analysis checks the shared fundamental snapshot store before contacting
# external providers. The database TTL defaults to one day; the process-local
# cache avoids repeated reads during one analysis session.
AI_FUNDAMENTAL_DB_TTL_SEC=86400
AI_FUNDAMENTAL_CACHE_TTL_SEC=1800
# Optional identity sent to SEC EDGAR public endpoints. Use an application
# name and monitored contact address for production deployments.
SEC_USER_AGENT=QuantDinger/5.0 open-source-research support@your-domain.com
TIINGO_API_KEY=
TIINGO_TIMEOUT=10

# Crypto derivatives / on-chain data (optional, used by some AI prompts)
COINGLASS_API_KEY=
CRYPTOQUANT_API_KEY=

# Professional analysis report V1.
# community: free/keyless and low-cost sources remain the default.
# professional: requests licensed evidence; the report still downgrades to
# community unless professional-source observations were actually collected.
PROFESSIONAL_REPORT_DATA_TIER=community
# Maximum account-equity loss budget used by deterministic position sizing.
PROFESSIONAL_REPORT_RISK_BUDGET_PCT=1.0
# Optional: broad global headlines are displayed as background and never
# scored directionally without an explicit target-asset relevance tag.
FAST_ANALYSIS_INCLUDE_GLOBAL_NEWS=false

# Optional professional data credentials. Leaving every value empty is valid.
# A configured key does not itself grant customer display/redistribution rights;
# confirm the required commercial licence with each provider.
MASSIVE_API_KEY=
POLYGON_API_KEY=
INTRINIO_API_KEY=
HKEX_DATA_MARKETPLACE_USERNAME=
HKEX_DATA_MARKETPLACE_PASSWORD=
HKEX_OMD_LICENSE_ID=
HKEX_IIS_LICENSE_ID=
LSEG_CLIENT_ID=
LSEG_CLIENT_SECRET=
KAIKO_API_KEY=
COINMETRICS_API_KEY=

# Twelve Data (CN/HK stock K-lines — recommended for overseas servers)
# Free tier: 800 API credits/day, 8 requests/minute. https://twelvedata.com
TWELVE_DATA_API_KEY=

# Adanos Market Sentiment (optional US stock sentiment enrichment)
# If ADANOS_API_KEY is empty, /api/global-market/adanos-sentiment returns enabled=false.
ADANOS_API_KEY=
ADANOS_SENTIMENT_SOURCE=reddit
ADANOS_API_BASE_URL=https://api.adanos.org
ADANOS_API_TIMEOUT=10

# AI search / news
# Recommended order: Tavily -> SearXNG -> GDELT -> SerpAPI -> DuckDuckGo.
SEARCH_PROVIDER=tavily
SEARCH_MAX_RESULTS=10
SEARCH_GOOGLE_API_KEY=
SEARCH_GOOGLE_CX=
SEARCH_BING_API_KEY=
TAVILY_API_KEYS=
SERPAPI_KEYS=
SEARCH_SEARXNG_BASE_URL=
SEARCH_SEARXNG_ENGINES=
SEARCH_SEARXNG_CATEGORIES=general
SEARCH_SEARXNG_LANGUAGE=auto
SEARCH_SEARXNG_TIMEOUT=12
GDELT_BASE_URL=https://api.gdeltproject.org/api/v2/doc/doc
GDELT_TIMEOUT=12
GDELT_MAX_RESULTS=10
ALPHA_VANTAGE_API_KEY=
ALPHA_VANTAGE_BASE_URL=https://www.alphavantage.co/query
ALPHA_VANTAGE_TIMEOUT=12
ALPHA_VANTAGE_NEWS_LIMIT=20

# SMS / phone (optional)
TWILIO_ACCOUNT_SID=
TWILIO_AUTH_TOKEN=
TWILIO_FROM_NUMBER=

# Security / verification tuning
SECURITY_IP_MAX_ATTEMPTS=10
SECURITY_IP_WINDOW_MINUTES=5
SECURITY_IP_BLOCK_MINUTES=15
SECURITY_ACCOUNT_MAX_ATTEMPTS=5
SECURITY_ACCOUNT_WINDOW_MINUTES=60
SECURITY_ACCOUNT_BLOCK_MINUTES=30
VERIFICATION_CODE_EXPIRE_MINUTES=10
VERIFICATION_CODE_RATE_LIMIT=60
VERIFICATION_CODE_IP_HOURLY_LIMIT=10
VERIFICATION_CODE_MAX_ATTEMPTS=5
VERIFICATION_CODE_LOCK_MINUTES=30

# AI analysis tuning
ENABLE_CONFIDENCE_CALIBRATION=false
ENABLE_AI_ENSEMBLE=false
AI_ENSEMBLE_MODELS=openai/gpt-5.4,openai/gpt-4o-mini
ENABLE_REFLECTION_WORKER=false
REFLECTION_WORKER_INTERVAL_SEC=86400
REFLECTION_MIN_AGE_DAYS=7
REFLECTION_VALIDATE_LIMIT=200
AI_CALIBRATION_MARKETS=Crypto
AI_CALIBRATION_LOOKBACK_DAYS=30
AI_CALIBRATION_MIN_SAMPLES=80
AI_ANALYSIS_CONSENSUS_TIMEFRAMES=1D,4H

# Redis cache (auto-configured by docker-compose; set CACHE_ENABLED=true to use)
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_DB=0
CACHE_ENABLED=true

# Internal
INTERNAL_API_KEY=

# Market visibility (which markets appear in the watchlist picker /
# Agent API catalog / home AI radar).
#
# Primary knob (recommended):
#   ENABLED_MARKETS — CSV whitelist. When set, ONLY these markets are
#   visible everywhere. Unknown values are ignored. Empty = whitelist
#   disabled (falls back to the legacy SHOW_* flags below).
#   Valid values: Crypto, USStock, CNStock, HKStock, Forex, Futures, MOEX
#   Examples:
#     ENABLED_MARKETS=Crypto,USStock           # crypto + US stocks only
#     ENABLED_MARKETS=Crypto                   # crypto-only deployment
#     ENABLED_MARKETS=                         # unset → legacy flags apply
# ENABLED_MARKETS=
#
# Legacy flags (kept for back-compat; ignored when ENABLED_MARKETS is set):
#   SHOW_CN_STOCK (default false) — China A-shares
#   SHOW_HK_STOCK (default true)  — Hong Kong stocks
# All other known markets default to visible.
SHOW_CN_STOCK=false
# SHOW_HK_STOCK=true
# Per-process REST completion of private-stream fill snapshots.
# Counts snapshots; a venue snapshot may use multiple HTTP calls.
EXECUTION_FILL_SNAPSHOT_MIN_SEC=2
EXECUTION_FILL_SNAPSHOT_MAX_PER_MIN=30
# Durable grid actor routing and retry controls.