matitos
2a88f55689
The deploy job hard-failed without CRYPTO_API_TOKEN, and /api/ws (which skips Basic auth) relied on that token. Drop the requirement: the app now works with no token at all, matching the backend guard that was always a no-op when unset. When a token is configured it still protects /api and /api/ws; when it is not, /api/ws is as open as the rest of the API, which the Traefik Basic auth still guards for everything else. Adds tests for the tokenless API and WebSocket.
65 lines
1.9 KiB
Bash
65 lines
1.9 KiB
Bash
# --- Core ---
|
|
APP_NAME=Crypto Trader
|
|
ENV=dev
|
|
# API host/port
|
|
HOST=0.0.0.0
|
|
PORT=8000
|
|
|
|
# --- Persistence ---
|
|
# SQLite by default. Point at Postgres with e.g.
|
|
# postgresql+psycopg://user:pass@localhost:5432/trader
|
|
DATABASE_URL=sqlite:///./data/trader.db
|
|
|
|
# --- Trading defaults ---
|
|
# paper = simulated fills against live market data (safe default)
|
|
# live = real orders via the exchange
|
|
MODE=paper
|
|
EXCHANGE=binance
|
|
SYMBOL=BTC/USDT
|
|
TIMEFRAME=5m
|
|
# How often the engine polls for new candles, in seconds
|
|
POLL_INTERVAL=5
|
|
# Candles fetched per tick and kept for indicators
|
|
CANDLE_LIMIT=200
|
|
|
|
# Paper broker
|
|
STARTING_BALANCE=10000
|
|
FEE_BPS=10
|
|
SLIPPAGE_BPS=5
|
|
|
|
# --- Exchange credentials (only needed for MODE=live) ---
|
|
EXCHANGE_API_KEY=
|
|
EXCHANGE_API_SECRET=
|
|
# Set true for testnet/sandbox where supported
|
|
EXCHANGE_SANDBOX=false
|
|
|
|
# --- Risk controls (0 disables a limit) ---
|
|
# Halt + flatten if the day's loss reaches this amount in quote currency
|
|
MAX_DAILY_LOSS=0
|
|
# Halt + flatten if equity falls this percent from its peak
|
|
MAX_DRAWDOWN_PCT=0
|
|
# Cap a single position at this fraction of equity (1.0 = all-in)
|
|
MAX_POSITION_PCT=1.0
|
|
# Max new entries per UTC day (0 = unlimited)
|
|
MAX_TRADES_PER_DAY=0
|
|
|
|
# --- API token (optional) ---
|
|
# When set, /api and the /api/ws live feed require this token. The frontend
|
|
# nginx injects it server-side, so the browser never sees it. Leave empty for
|
|
# no token; the app works fully without it. (The Traefik Basic auth still
|
|
# guards the UI in the deployed stack.)
|
|
API_TOKEN=
|
|
API_TOKEN_HEADER=X-API-Token
|
|
|
|
# --- Notifications (optional) ---
|
|
# Telegram: message @BotFather to create a bot, then get the chat id from
|
|
# https://api.telegram.org/bot<token>/getUpdates after messaging the bot.
|
|
TELEGRAM_BOT_TOKEN=
|
|
TELEGRAM_CHAT_ID=
|
|
# Generic webhook: receives POST {"level": "...", "text": "..."}
|
|
NOTIFY_WEBHOOK_URL=
|
|
|
|
# --- Web ---
|
|
# Comma separated list, or * in dev
|
|
CORS_ORIGINS=*
|