Environment Configuration

Environment Variables Schema

// infrastructure/config/env.schema.ts
import { z } from "zod";

export const envSchema = z.object({
  // Application
  NODE_ENV: z.enum(["development", "staging", "production"]),
  PORT: z.coerce.number().default(3000),
  API_PREFIX: z.string().default("api/v1"),

  // Database
  DATABASE_URL: z.string().url(),
  DATABASE_POOL_MIN: z.coerce.number().default(2),
  DATABASE_POOL_MAX: z.coerce.number().default(10),

  // Redis (optional)
  REDIS_URL: z.string().url().optional(),

  // JWT
  JWT_SECRET: z.string().min(32),
  JWT_ACCESS_EXPIRES_IN: z.string().default("15m"),
  JWT_REFRESH_EXPIRES_IN: z.string().default("7d"),

  // Payments (Stripe)
  STRIPE_SECRET_KEY: z.string().optional(),
  STRIPE_WEBHOOK_SECRET: z.string().optional(),

  // Payments (YooKassa)
  YOOKASSA_SHOP_ID: z.string().optional(),
  YOOKASSA_SECRET_KEY: z.string().optional(),

  // Notifications
  SENDGRID_API_KEY: z.string().optional(),
  SENDGRID_FROM_EMAIL: z.string().email().optional(),
  TWILIO_ACCOUNT_SID: z.string().optional(),
  TWILIO_AUTH_TOKEN: z.string().optional(),
  TWILIO_FROM_NUMBER: z.string().optional(),

  // Storage
  S3_BUCKET: z.string().optional(),
  S3_REGION: z.string().optional(),
  S3_ACCESS_KEY: z.string().optional(),
  S3_SECRET_KEY: z.string().optional(),

  // Frontend URL (for CORS)
  FRONTEND_URL: z.string().url(),

  // Feature flags
  FEATURE_INVESTMENTS_ENABLED: z.coerce.boolean().default(true),
  FEATURE_ECOMMERCE_ENABLED: z.coerce.boolean().default(true),
});

export type Env = z.infer<typeof envSchema>;

---

Configuration Service

// infrastructure/config/config.service.ts
@Injectable()
export class ConfigService {
  private readonly env: Env;

  constructor() {
    const result = envSchema.safeParse(process.env);

    if (!result.success) {
      const errors = result.error.flatten().fieldErrors;
      console.error("Invalid environment variables:");
      Object.entries(errors).forEach(([key, messages]) => {
        console.error(`  ${key}: ${messages?.join(", ")}`);
      });
      process.exit(1);
    }

    this.env = result.data;
  }

  get<K extends keyof Env>(key: K): Env[K] {
    return this.env[key];
  }

  get isProduction(): boolean {
    return this.env.NODE_ENV === "production";
  }

  get isDevelopment(): boolean {
    return this.env.NODE_ENV === "development";
  }

  get database() {
    return {
      url: this.env.DATABASE_URL,
      poolMin: this.env.DATABASE_POOL_MIN,
      poolMax: this.env.DATABASE_POOL_MAX,
    };
  }

  get jwt() {
    return {
      secret: this.env.JWT_SECRET,
      accessExpiresIn: this.env.JWT_ACCESS_EXPIRES_IN,
      refreshExpiresIn: this.env.JWT_REFRESH_EXPIRES_IN,
    };
  }

  get payments() {
    return {
      stripe: this.env.STRIPE_SECRET_KEY
        ? {
            secretKey: this.env.STRIPE_SECRET_KEY,
            webhookSecret: this.env.STRIPE_WEBHOOK_SECRET,
          }
        : null,
      yookassa: this.env.YOOKASSA_SHOP_ID
        ? {
            shopId: this.env.YOOKASSA_SHOP_ID,
            secretKey: this.env.YOOKASSA_SECRET_KEY,
          }
        : null,
    };
  }
}

---

Example .env Files

Development (.env.example)

# .env.example (commit this)
NODE_ENV=development
PORT=3000
API_PREFIX=api/v1

# Database
DATABASE_URL=postgresql://user:password@localhost:5432/iwm_dev

# JWT (generate with: openssl rand -base64 32)
JWT_SECRET=your-secret-here-min-32-chars
JWT_ACCESS_EXPIRES_IN=15m
JWT_REFRESH_EXPIRES_IN=7d

# Frontend
FRONTEND_URL=http://localhost:5173

# Optional integrations (leave empty in dev)
STRIPE_SECRET_KEY=
YOOKASSA_SHOP_ID=
SENDGRID_API_KEY=

Production (.env.production)

# .env.production (DO NOT commit, use secrets manager)
NODE_ENV=production
DATABASE_URL=postgresql://...  # From secrets manager
JWT_SECRET=...                  # From secrets manager
STRIPE_SECRET_KEY=sk_live_...   # From secrets manager

---

Related Documents

• Security
• API Standards