# Packaged backend fallback configuration.

# Repository deployments use the project-root `.env.example` as the canonical template.

#

# This file is organized as:

# 1) first-time deployment settings at the top

# 2) advanced / rarely changed settings at the bottom

# Do not maintain a second runtime env file in repository deployments.

# =========================

# Brand / identity (drives logo, footer, version label, legal modals)

# =========================

# Frontend reads these via /api/settings/brand-config — leave any field empty

# to fall back to the bundled QuantDinger defaults. Change here (or via the

# Settings page) to rebrand a deployment without rebuilding the frontend.

BRAND_APP_NAME=QuantDinger

BRAND_COPYRIGHT=© 2025-2026 QuantDinger. All rights reserved.

# Logo / favicon URLs (HTTPS recommended; leave empty to use bundled assets)

BRAND_LOGO_LIGHT_URL=

BRAND_LOGO_DARK_URL=

BRAND_LOGO_COLLAPSED_URL=

BRAND_FAVICON_URL=

# Contact & support links surfaced in the sidebar footer.

BRAND_CONTACT_EMAIL=support@quantdinger.com

BRAND_CONTACT_SUPPORT_URL=https://t.me/quantdinger

BRAND_CONTACT_LIVE_CHAT_URL=https://t.me/quantdinger

BRAND_CONTACT_FEATURE_REQUEST_URL=https://github.com/OpenByteInc/QuantDinger/issues

# Social accounts shown as icons in the sidebar footer. Leave any single

# entry empty to hide that icon.

BRAND_SOCIAL_GITHUB=https://github.com/OpenByteInc/QuantDinger

BRAND_SOCIAL_X=https://x.com/quantdinger_en

BRAND_SOCIAL_DISCORD=https://discord.com/invite/tyx5B6TChr

BRAND_SOCIAL_TELEGRAM=https://t.me/quantdinger

BRAND_SOCIAL_YOUTUBE=https://youtube.com/@quantdinger

# Legal: external URL takes priority; if both URL and inline text are empty,

# the frontend falls back to the built-in i18n copy.

BRAND_LEGAL_USER_AGREEMENT_URL=

BRAND_LEGAL_USER_AGREEMENT_TEXT=

BRAND_LEGAL_PRIVACY_POLICY_URL=

BRAND_LEGAL_PRIVACY_POLICY_TEXT=

# =========================

# Auth (required)

# =========================

# Required: >= 10 bytes for legacy compatibility; 32+ random bytes recommended.

# The API refuses to start while empty or while using the public legacy default.

# Generate: python -c "import secrets; print(secrets.token_hex(32))"

SECRET_KEY=

# Stable key for broker credentials and MFA secrets. Keep this unchanged when

# rotating SECRET_KEY. The container generates and persists one when omitted.

CREDENTIAL_ENCRYPTION_KEY=

ADMIN_USER=quantdinger

# Leaving ADMIN_PASSWORD as 123456 will trigger a first-login change-password reminder.

# Set any non-default value before startup to skip that reminder and initialize safely.

ADMIN_PASSWORD=123456

ADMIN_EMAIL=

# =========================

# Core app

# =========================

DATABASE_URL=postgresql://quantdinger:quantdinger123@postgres:5432/quantdinger

QD_PROCESS_ROLE=legacy

STRATEGY_COMMANDS_ENABLED=false

STRATEGY_COMMAND_STOP_WAIT_SEC=5

STRATEGY_COMMAND_LEASE_SEC=30

STRATEGY_COMMAND_MAX_ATTEMPTS=3

STRATEGY_COMMAND_WORKER_POLL_SEC=0.5

STRATEGY_RUNTIME_LEASE_SEC=30

STRATEGY_COMMAND_RETENTION_DAYS=30

WORKER_HEARTBEAT_RETENTION_DAYS=7

# Celery is enabled by Docker Compose. Keep it disabled for a standalone

# development process that does not run a broker and worker.

CELERY_TASKS_ENABLED=false

# Leave explicit URLs empty to use the host/password/database settings below.

CELERY_BROKER_URL=

CELERY_RESULT_BACKEND=

CELERY_REDIS_HOST=redis-jobs

CELERY_REDIS_PORT=6379

CELERY_REDIS_PASSWORD=

CELERY_BROKER_DB=0

CELERY_RESULT_DB=1

CELERY_CONCURRENCY=2

CELERY_WORKER_PREFETCH=1

CELERY_MAX_TASKS_PER_CHILD=100

CELERY_TASK_SOFT_TIME_LIMIT=3300

CELERY_TASK_TIME_LIMIT=3600

CELERY_VISIBILITY_TIMEOUT=7200

MARKET_CATALOG_SYNC_INTERVAL_SEC=86400

AI_CALIBRATION_INTERVAL_SEC=86400

# FRONTEND_URL: the canonical user-facing URL of the web app.

# - Used for: CORS allow-list, default post-login OAuth redirect target.

# - Comma-separated multi-origin IS supported (the first entry is the

# default OAuth redirect; every entry is added to the CORS / OAuth

# allow-list). Prefer the simpler `OAUTH_ALLOWED_REDIRECTS` below for

# the second / third front-end origin so that this stays a single URL.

# - You do NOT need to add Capacitor / Cordova / Ionic mobile-app origins

# here (https://localhost, capacitor://localhost, ionic://localhost,

# http://localhost). The backend whitelists those automatically because

# they are fixed synthetic origins controlled by the OS, not user input.

# - If your mobile app uses a separate API subdomain like

# https://api.quantdinger.com, make sure your nginx server_block for that

# host is reverse-proxying /api/* to the backend port (5000).

# Examples:

# FRONTEND_URL=https://ai.quantdinger.com

# FRONTEND_URL=https://ai.quantdinger.com,https://m.quantdinger.com

FRONTEND_URL=http://localhost:8888,http://localhost:8889

# Extra front-end origins allowed as OAuth post-login redirect targets.

# Comma-separated, scheme + host (+ optional port). Used when multiple clients

# (e.g. PC web + mobile web) share the same backend. FRONTEND_URL is always

# allowed implicitly; list every additional front-end here.

# Example: OAUTH_ALLOWED_REDIRECTS=https://m.quantdinger.com,https://app.quantdinger.com,com.quantdinger.mobile://login

OAUTH_ALLOWED_REDIRECTS=

# OAuth CSRF state TTL (minutes); stored in Postgres for multi-worker. Default 20, clamped [5,120].

OAUTH_STATE_TTL_MINUTES=20

ENABLE_REGISTRATION=true

# =========================

# Mobile app (in-app version check)

# =========================

# Semver-like string shown to clients; leave empty to avoid "new version" prompts.

MOBILE_APP_LATEST_VERSION=

# APK / install page URL for one-tap update on Android (HTTPS recommended).

MOBILE_APP_DOWNLOAD_URL=https://www.quantdinger.com/download/app.apk

# =========================

# Database bootstrap behaviour

# =========================

# On every backend startup we auto-apply `migrations/init.sql` so a fresh

# install (especially bare-metal / Windows local PG) gets the full schema

# without anyone remembering to `psql -f` first. The file uses

# `CREATE TABLE IF NOT EXISTS` everywhere so re-running is a no-op.

# Set to `true` if you manage schema externally (Flyway, Liquibase, etc.)

# and don't want the backend touching DDL on boot. Permission probing on

# critical tables still runs either way.

SKIP_AUTO_MIGRATE=false

# =========================

# Database connection pool (psycopg2 ThreadedConnectionPool)

# =========================

# DB_POOL_MAX defaults to auto. Most self-hosted deployments should leave it

# as auto; the backend probes PostgreSQL max_connections and picks a safe

# per-process pool size. Advanced operators may set an integer override.

DB_POOL_MIN=5

DB_POOL_MAX=auto

DB_POOL_ACQUIRE_TIMEOUT=10

DB_POOL_HEALTH_CHECK=true

DB_POOL_AUTO_CAP=true

DB_POOL_AUTO_DEFAULT_MAX=50

DB_POOL_RESERVE_FOR_OTHER_CLIENTS=20

DB_APPLICATION_NAME=quantdinger_api

# Docker Compose configures the trading process separately because strategy

# recovery is highly concurrent. Set TRADING_DB_POOL_MAX in the project-root

# .env when the default of 32 needs to be changed. Keep the sum of all process

# pools below PG_MAX_CONNECTIONS.

# Route-level parallel fetch executors. Each worker may hold one DB

# connection, so keep MARKET_EXECUTOR_WORKERS + PORTFOLIO_EXECUTOR_WORKERS

# well below DB_POOL_MAX.

MARKET_EXECUTOR_WORKERS=6

PORTFOLIO_EXECUTOR_WORKERS=3

# Gunicorn worker/thread model

GUNICORN_WORKERS=1

GUNICORN_THREADS=8

# =========================

# AI / LLM (choose one provider)

# =========================

LLM_PROVIDER=openrouter

# LLM calls are direct by default. Use this only when your model provider

# must be reached through a proxy. This is intentionally separate from PROXY_URL.

LLM_PROXY_URL=

# Advanced: inherit HTTP_PROXY / HTTPS_PROXY / ALL_PROXY for LLM calls.

# Keep false unless the backend can actually reach that proxy endpoint.

LLM_USE_SYSTEM_PROXY=false

# Optional JEV pre-trade decision filter. Configure this from System Settings

# or set the values here. QuantDinger tries JEV first, then the configured LLM.

# If neither provider is configured or both are unavailable, entries are

# allowed and the fail-open outcome is written to the AI decision audit log.

JEV_API_KEY=

JEV_BASE_URL=https://api.typesafe.ai/v1

JEV_MODEL=jev-latest

JEV_TIMEOUT_SECONDS=8

JEV_MIN_CONFIDENCE=0.55

AI_DECISION_TIMEOUT_SECONDS=10

OPENROUTER_API_KEY=

OPENROUTER_MODEL=openai/gpt-5.4

# Optional: dedicated model for AI code generation (fallback to provider default if empty)

AI_CODE_GEN_MODEL=

OPENAI_API_KEY=

OPENAI_MODEL=gpt-5.4

GOOGLE_API_KEY=

GOOGLE_MODEL=gemini-1.5-flash

DEEPSEEK_API_KEY=

DEEPSEEK_MODEL=deepseek-chat

GROK_API_KEY=

GROK_MODEL=grok-beta

# AtlasCloud (set LLM_PROVIDER=atlascloud)

# Official OpenAI-compatible LLM base URL must include /v1.

ATLASCLOUD_API_KEY=

ATLASCLOUD_MODEL=openai/gpt-5.4

ATLASCLOUD_BASE_URL=https://api.atlascloud.ai/v1

# OpenAI-compatible third-party API (set LLM_PROVIDER=custom)

# Local Ollama example (backend must reach this host; Docker Desktop: http://host.docker.internal:11434/v1):

# CUSTOM_API_URL=http://127.0.0.1:11434/v1

# CUSTOM_MODEL=llama3.2

# Ollama usually needs no key — leave CUSTOM_API_KEY empty.

CUSTOM_API_URL=

CUSTOM_API_KEY=

CUSTOM_MODEL=

# MiniMax (set LLM_PROVIDER=minimax)

MINIMAX_API_KEY=

MINIMAX_MODEL=MiniMax-M2.7

MINIMAX_BASE_URL=https://api.minimax.io/v1

# =========================

# Common background jobs

# =========================

ENABLE_PENDING_ORDER_WORKER=true

ENABLE_PORTFOLIO_MONITOR=true

DISABLE_RESTORE_RUNNING_STRATEGIES=false

# Private fill streams are the primary source of execution and actual-fee events.

# REST remains enabled as reconnect catch-up and a periodic consistency audit.

ENABLE_PRIVATE_EXECUTION_STREAMS=true

EXECUTION_STREAM_REFRESH_SEC=30

EXECUTION_STREAM_REST_AUDIT_SEC=30

# Only running live accounts receive private fill streams. Overflow accounts

# keep using REST reconciliation, so this should stay below BACKEND_PIDS_LIMIT.

EXECUTION_STREAM_MAX_ADAPTERS=64

# Position sync (pending_order_worker): polls exchange positions for live strategies.

# Many strategies often share one API key — cache + longer interval avoids Binance IP bans.

POSITION_SYNC_ENABLED=true

POSITION_SYNC_INTERVAL_SEC=30

# Reuse one get_positions() result per credential for this many seconds (0 = auto: max(30, INTERVAL)).

POSITION_SYNC_CACHE_TTL_SEC=0

# A fresh flat exchange snapshot may clear a local strategy leg only after the exact

# close-side fill set is attributed and recorded. Set false for emergency rollback.

POSITION_SYNC_PURGE_FLAT_LEDGER=true

# An open/add fill younger than this keeps its leg even if the venue looks flat.

POSITION_SYNC_PURGE_GRACE_SEC=120

# When true, OKX code paths may cancel *all* algo orders (pre-clean before leverage

# setup and the account-wide sweep during 59669 retries). Those sweeps also cancel

# manually placed TP/SL orders, so they are off unless you accept that.

OKX_CANCEL_ALL_ALGO_ORDERS=false

# After HTTP 418 / rate-limit, pause sync for this credential (seconds).

EXCHANGE_SYNC_BACKOFF_SEC=900

# =========================

# Agent Gateway (/api/agent/v1) — see docs/agent/AGENT_QUICKSTART.md

# =========================

# Thread pool size for async agent jobs (backtests, experiment pipelines).

AGENT_JOBS_MAX_WORKERS=4

# Total queued/running lifetime before automatic failure and credit refund.

# Keep this above the longest intended backtest; Celery Beat checks every minute.

AGENT_BILLED_JOB_TIMEOUT_SEC=7200

# Aggregate tenant quota in addition to each token's rate_limit_per_min.

AGENT_TENANT_RATE_LIMIT_PER_MIN=600

# Async-job admission caps. Completed/cancelled jobs do not count.

AGENT_MAX_CONCURRENT_JOBS_PER_TENANT=4

AGENT_MAX_CONCURRENT_JOBS_PER_TOKEN=2

# A crashed request may be retried with the same key after this reservation TTL.

AGENT_IDEMPOTENCY_IN_PROGRESS_TTL_SEC=900

# Default live-trading caps copied onto newly issued Agent Tokens.

AGENT_DEFAULT_MAX_ORDER_NOTIONAL=1000

AGENT_DEFAULT_MAX_DAILY_NOTIONAL=5000

# Hard kill switch for live trading from agent tokens. Even when a token is

# issued with paper_only=false, live order routing remains disabled until this

# flag is true AND a live executor implementation is wired in. Until then,

# `T`-class agent calls always record paper orders in qd_agent_paper_orders.

AGENT_LIVE_TRADING_ENABLED=false

# Deployment topology hint for the Agent Gateway.

# (unset) — single-tenant / self-hosted; users manage tokens in Profile.

# saas / hosted — multi-tenant hosted instance (e.g. ai.quantdinger.com):

# users self-issue tokens (incl. T scope) from Profile → My Agent Token.

# paper_only defaults to true; live T requires ack_live_trading_risk

# at issuance plus AGENT_LIVE_TRADING_ENABLED on the server.

QUANTDINGER_DEPLOYMENT_MODE=self_hosted

# =========================

# Email / SMTP (optional)

# =========================

SMTP_HOST=

SMTP_PORT=587

SMTP_USER=

SMTP_PASSWORD=

SMTP_FROM=

SMTP_USE_TLS=true

SMTP_USE_SSL=false

# =========================

# Proxy (optional, sometimes required for exchange OHLCV access)

# =========================

# PROXY_URL is for market data, exchange and broker API traffic. LLM providers do

# not use it by default; configure LLM_PROXY_URL above if an LLM provider needs a proxy.

# Native public exchange clients read PROXY_URL for exchange REST calls. System VPN does

# NOT apply inside Docker; set this when logs show "binance GET ... exchangeInfo" failures.

# Clash: enable "Allow LAN", use HTTP port (often 7890). Docker Desktop on Windows/macOS:

# PROXY_URL=http://host.docker.internal:7890

# PROXY_URL=socks5h://127.0.0.1:10808 # backend run directly on host

# PROXY_URL=socks5h://host.docker.internal:10808 # Docker + Clash SOCKS

PROXY_URL=

# Outbound HTTPS to exchanges when using PROXY_URL (especially SOCKS). If you see

# SSLCertVerificationError / "unable to get local issuer certificate":

# - Prefer: install OS ca-certificates in the image, or point to a PEM bundle:

# LIVE_TRADING_CA_BUNDLE=/path/to/ca-bundle.pem

# (REQUESTS_CA_BUNDLE / SSL_CERT_FILE are also honored.)

# - Last resort only: LIVE_TRADING_SSL_VERIFY=false # disables TLS verify; insecure

#LIVE_TRADING_CA_BUNDLE=

#LIVE_TRADING_SSL_VERIFY=

# =========================

# Local desktop brokers (IBKR)

# =========================

# Interactive Brokers needs TWS/IB Gateway on a

# machine reachable from this API (typically your own PC or a VPS with those apps).

# On a public multi-tenant cloud deployment, set to false so users see a clear message

# instead of broken flows. Crypto exchange API keys are unaffected.

ALLOW_LOCAL_DESKTOP_BROKERS=true

# IBKR: clientId for live orders (strategy worker). Must differ from POST /api/ibkr/connect

# default (1) or TWS will disconnect one of the sessions within seconds.

#IBKR_ORDER_CLIENT_ID=7

# Dedicated IBKR execution/commission stream session; must differ from order/UI sessions.

#IBKR_STREAM_CLIENT_ID=8

# =========================

# Captcha / OAuth (optional)

# =========================

TURNSTILE_SITE_KEY=

TURNSTILE_SECRET_KEY=

# Short-lived local auth-page clearance after a successful Turnstile challenge.

TURNSTILE_CLEARANCE_TTL_SECONDS=600

GOOGLE_CLIENT_ID=

GOOGLE_CLIENT_SECRET=

GOOGLE_REDIRECT_URI=http://localhost:5000/api/auth/oauth/google/callback

GITHUB_CLIENT_ID=

GITHUB_CLIENT_SECRET=

GITHUB_REDIRECT_URI=http://localhost:5000/api/auth/oauth/github/callback

# =========================

# Billing / payments

# =========================

BILLING_ENABLED=false

MARKETPLACE_ENABLED=false

# Points unit price

BILLING_COST_BACKTEST=30

BILLING_COST_AI_REVIEW=10

BILLING_COST_AI_ANALYSIS=10

BILLING_COST_AI_CODE_GEN=30

CREDITS_REGISTER_BONUS=100

CREDITS_REFERRAL_BONUS=50

FREE_USER_STRATEGY_LIMIT=5

REFERRAL_PROGRAM_ENABLED=false

REFERRAL_REWARD_RATES=10,5,3

REFERRAL_REWARD_HOLD_DAYS=7

REFERRAL_MIN_WITHDRAWAL_USD=10

# Membership plans

MEMBERSHIP_MONTHLY_PRICE_USD=19.9

MEMBERSHIP_YEARLY_PRICE_USD=199

MEMBERSHIP_LIFETIME_PRICE_USD=499

MEMBERSHIP_MONTHLY_CREDITS=500

MEMBERSHIP_YEARLY_CREDITS=8000

MEMBERSHIP_LIFETIME_MONTHLY_CREDITS=800

# =========================

# USDT payment (v3.0.6+: single fixed address per chain + amount-suffix matching)

# =========================

# How it works (replaces the old xpub HD-derived per-order address model):

# - One fixed receiving address per chain (your own main wallet).

# - Every order is identified on-chain by a unique amount suffix in the

# low decimals, e.g. base $19.9 -> 19.991234 USDT, where .001234 is the

# unique order tag. Funds land directly in your wallet, no consolidation.

# - Chains without an address configured are auto-hidden in the UI.

#

# Global switch.

USDT_PAY_ENABLED=false

# Comma-separated list of enabled chains. Any code not in this list is rejected

# at order creation even if its address is configured. Valid codes:

# TRC20 / BEP20 / ERC20 / SOL

USDT_PAY_ENABLED_CHAINS=TRC20,BEP20,ERC20,SOL

# --- Receiving addresses (one per chain). Leave blank to hide that chain ---

# TRON (base58, starts with T...)

USDT_TRC20_ADDRESS=

# BSC (EVM 0x..., the same Ethereum-style address)

USDT_BEP20_ADDRESS=

# Ethereum (EVM 0x...)

USDT_ERC20_ADDRESS=

# Solana (wallet address; the SPL USDT mint ATA is computed on-chain by the wallet)

USDT_SOL_ADDRESS=

# --- USDT contract / mint per chain (override only if you know what you're doing) ---

USDT_TRC20_CONTRACT=TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t

USDT_BEP20_CONTRACT=0x55d398326f99059fF775485246999027B3197955

USDT_ERC20_CONTRACT=0xdAC17F958D2ee523a2206206994597C13D831ec7

USDT_SOL_MINT=Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB

# =========================

# USDC payment (Circle-issued native USDC on supported scanners)

# =========================

USDC_PAY_ENABLED=false

USDC_PAY_ENABLED_CHAINS=ERC20,SOL

# Optional dedicated receiving addresses. Leave blank to reuse the matching

# USDT address above.

USDC_ERC20_ADDRESS=

USDC_SOL_ADDRESS=

USDC_ERC20_CONTRACT=0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48

USDC_SOL_MINT=EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v

# Stripe Checkout. A per-plan price_... ID is optional. When it is blank, the

# server creates an inline product using the plan's USD price and tax code.

STRIPE_PAY_ENABLED=false

STRIPE_SECRET_KEY=

STRIPE_WEBHOOK_SECRET=

# SaaS for personal use. Change this if your Stripe product category differs.

STRIPE_PRODUCT_TAX_CODE=txcd_10103000

STRIPE_SUCCESS_URL=

STRIPE_CANCEL_URL=

# --- Block explorers / RPC endpoints used to reconcile incoming transfers ---

TRONGRID_BASE_URL=https://api.trongrid.io

TRONGRID_API_KEY=

# BSC (BEP20) USDT reconciliation runs on public BSC JSON-RPC by default

# — Etherscan's V2 free plan no longer covers BSC and the legacy v1 host

# is deprecated. The watcher calls eth_getLogs against the USDT contract,

# filtered by Transfer(from, to, value) events, which every public BSC

# node supports natively at no cost. Comma-separated list; leave blank

# to use the curated defaults baked into the code.

BSC_RPC_URLS=https://bsc-dataseed1.binance.org,https://bsc.publicnode.com,https://rpc.ankr.com/bsc

# ERC20 (Ethereum) USDT reconciliation uses Etherscan V2 first because

# its free plan still covers Ethereum mainnet, falling back to public

# Ethereum RPC if the explorer call fails. Set ETHERSCAN_API_KEY to a

# key from https://etherscan.io/myapikey (free tier is enough for ETH).

ETHERSCAN_API_KEY=

ETHERSCAN_V2_BASE_URL=https://api.etherscan.io/v2/api

ETH_RPC_URLS=https://ethereum-rpc.publicnode.com,https://rpc.ankr.com/eth

# Override per-chain reconciliation strategy. Set BEP20_PREFER_EXPLORER=true

# only if you upgrade to an Etherscan API paid plan that covers BSC; leave

# it false (default) for RPC-only reconciliation. Same idea for ERC20.

# BEP20_PREFER_EXPLORER=false

# ERC20_PREFER_EXPLORER=true

# Legacy v1 explorer overrides — only set these if you intentionally pin

# to a deprecated v1 host (api.bscscan.com / api.etherscan.io). Leave them

# commented out for new deployments; the v2 unified API + RPC fallback

# above is preferred.

# ETHERSCAN_BASE_URL=

# BSCSCAN_BASE_URL=

# BSCSCAN_API_KEY=

SOLANA_RPC_URL=https://api.mainnet-beta.solana.com

# --- Amount suffix policy ---

# Number of decimals used for the suffix portion. 6 means ±0.000001 USDT

# granularity, giving a collision space of ~10^5 per (chain, base_price)

# inside the active window. The unique index on (chain, amount_usdt) where

# status IN ('pending','paid') guarantees no two live orders collide.

USDT_AMOUNT_SUFFIX_DECIMALS=6

# --- Confirm / expiry / worker tuning ---

USDT_PAY_CONFIRM_SECONDS=30

USDT_PAY_EXPIRE_MINUTES=30

USDT_WORKER_POLL_INTERVAL=30

# =========================

# Advanced / rarely changed

# =========================

# Network / App tuning

PYTHON_API_HOST=0.0.0.0

PYTHON_API_PORT=5000

PYTHON_API_DEBUG=false

# Interactive OpenAPI browsers (/api/docs/swagger, /api/docs/redoc).

# Defaults to on when PYTHON_API_DEBUG=true; set true explicitly to enable in production.

OPENAPI_ENABLED=false

RATE_LIMIT=100

ENABLE_CACHE=false

ENABLE_REQUEST_LOG=true

# Strategy / execution tuning

PENDING_ORDER_STALE_SEC=90

ORDER_MODE=market

MAKER_WAIT_SEC=10

MAKER_OFFSET_BPS=2

# Spot sizing (also editable in Admin → Settings → Live Trading)

# Close: base-asset fees are recorded net; cap sell size to the full free balance by default.

SPOT_CLOSE_SAFETY_RATIO=1.0

# Open: use only this fraction of allocated USDT/notional on spot buys

SPOT_OPEN_QUOTE_BUFFER=0.995

# User script runtime guardrails prevent one bad strategy from occupying a live

# execution thread indefinitely.

STRATEGY_SCRIPT_CALLBACK_TIMEOUT_SEC=5

STRATEGY_SCRIPT_MAX_CONSECUTIVE_TIMEOUTS=3

STRATEGY_SCRIPT_MAX_BARS_PER_CALL=1000

STRATEGY_SCRIPT_MAX_LOGS_PER_FLUSH=50

STRATEGY_SCRIPT_MAX_LOG_CHARS=500

# Global grid fill poller (ENABLE_GRID_FILL_POLLER=true in app startup).

ENABLE_GRID_FILL_POLLER=true

GRID_FILL_POLL_SEC=3

# Per resting order min interval between exchange status queries (seconds).

GRID_FILL_MIN_ORDER_INTERVAL_SEC=5

# Max orders polled per poller loop (spread load across cycles).

GRID_FILL_MAX_ORDERS_PER_CYCLE=150

# Max exchange API calls per credential per minute (rate-limit guard).

GRID_FILL_MAX_REQ_PER_CREDENTIAL_PER_MIN=120

# Grid: auto-stop after N consecutive order failures (non-fatal errors).

GRID_ORDER_ERROR_STOP_THRESHOLD=5

# Maximum active strategy runtimes admitted by one trading worker.

STRATEGY_MAX_ACTIVE=3000

# Fixed number of cooperative evaluator threads. Active strategies yield back

# to this pool between risk ticks and completed-bar boundaries.

STRATEGY_EVALUATOR_THREADS=16

# Share public price streams only when exchange, market type, API family, and

# instrument identities match. Set false for an immediate per-strategy rollback.

SHARED_PUBLIC_MARKET_FEED_ENABLED=true

# Coalesce REST price fallback calls for the same shared feed over this window.

SHARED_PUBLIC_MARKET_FALLBACK_TTL_SEC=1

# Publish versioned bar-close events and wake matching strategy runtimes. Event

# identity includes venue, market type, instrument, and timeframe.

BAR_CLOSE_EVENT_SCHEDULER_ENABLED=true

# Allow providers a short window to finalize the candle after its time boundary.

BAR_CLOSE_EVENT_GRACE_SEC=0.5

# Safety wake for an idle event-driven runtime if an event is missed.

BAR_EVENT_FALLBACK_WAKE_SEC=300

# Kafka is the inter-process event backbone for bar-driven strategy execution.

# The local event bus remains available for process-local observers and fallback.

KAFKA_BOOTSTRAP_SERVERS=localhost:29092

KAFKA_EVENT_PUBLISH_ENABLED=true

KAFKA_CLIENT_ID=quantdinger-runtime

KAFKA_SECURITY_PROTOCOL=PLAINTEXT

KAFKA_SASL_MECHANISM=PLAIN

KAFKA_SASL_USERNAME=

KAFKA_SASL_PASSWORD=

KAFKA_COMPRESSION_TYPE=zstd

KAFKA_LINGER_MS=5

KAFKA_DELIVERY_TIMEOUT_MS=30000

KAFKA_FLUSH_TIMEOUT_SEC=5

KAFKA_REPLICATION_FACTOR=1

KAFKA_MARKET_PARTITIONS=6

KAFKA_STRATEGY_PARTITIONS=12

KAFKA_ORDER_PARTITIONS=12

KAFKA_DLQ_PARTITIONS=3

KAFKA_HEAP_OPTS=-Xms256m -Xmx768m

KAFKA_OFFSETS_TOPIC_NUM_PARTITIONS=12

KAFKA_TRANSACTION_STATE_LOG_NUM_PARTITIONS=12

KAFKA_TOPIC_MARKET_BAR=qd.market.bar.closed.v1

KAFKA_TOPIC_STRATEGY_LIFECYCLE=qd.strategy.lifecycle.v1

KAFKA_TOPIC_STRATEGY_EVALUATE=qd.strategy.evaluate.v1

KAFKA_TOPIC_ORDER_INTENT=qd.order.intent.v1

KAFKA_TOPIC_ORDER_EVENT=qd.order.event.v1

KAFKA_TOPIC_RUNTIME_DLQ=qd.runtime.dlq.v1

KAFKA_AUDIT_GROUP_ID=quantdinger-runtime-audit-v1

# Stable strategy shards are shared by single-node and clustered deployments.

# Do not change the count after production events exist without a migration.

STRATEGY_SHARD_COUNT=128

STRATEGY_EVALUATION_BATCH_SIZE=250

KAFKA_STRATEGY_DISPATCH_GROUP_ID=quantdinger-strategy-dispatch-v1

KAFKA_DISPATCH_FLUSH_TIMEOUT_SEC=10

# Evaluators consume stable strategy shards with durable inbox deduplication

# and fencing. Active mode owns bar-driven strategy evaluation and execution.

KAFKA_STRATEGY_EVALUATOR_GROUP_ID=quantdinger-strategy-evaluator-active-v1

STRATEGY_EVALUATOR_MODE=active

# Bar-driven strategies run through Kafka evaluators. Grid, martingale, and

# realtime price-trigger strategies remain on their dedicated local runtimes.

STRATEGY_DISTRIBUTED_BAR_ENABLED=true

STRATEGY_EVALUATOR_LEASE_SEC=45

STRATEGY_EVALUATOR_MAX_ATTEMPTS=5

STRATEGY_EVALUATOR_BATCH_WORKERS=16

STRATEGY_EVALUATION_TIMEOUT_SEC=90

KAFKA_MAX_POLL_INTERVAL_MS=900000

# Legacy polling fallback. Active positions, orders, protections, grid, and

# martingale runtimes always keep the configured risk tick.

BAR_IDLE_SCHEDULER_ENABLED=true

BAR_IDLE_WAKE_INTERVAL_SEC=60

SIGNAL_NOTIFY_TIMEOUT_SEC=6

# LLM advanced tuning

OPENROUTER_API_URL=https://openrouter.ai/api/v1/chat/completions

OPENROUTER_TEMPERATURE=0.7

# Shared maximum output-token budget for all LLM providers.

# Providers charge for tokens actually generated, not this full upper bound.

LLM_MAX_TOKENS=16384

OPENROUTER_TIMEOUT=300

OPENROUTER_CONNECT_TIMEOUT=30

OPENAI_BASE_URL=https://api.openai.com/v1

DEEPSEEK_BASE_URL=https://api.deepseek.com/v1

GROK_BASE_URL=https://api.x.ai/v1

MINIMAX_BASE_URL=https://api.minimax.io/v1

# Data sources

DATA_SOURCE_TIMEOUT=30

DATA_SOURCE_RETRY=3

DATA_SOURCE_RETRY_BACKOFF=0.5

FINNHUB_API_KEY=

# Optional free-tier Finnhub helper for US stock quotes, company profile and news.

# Keep FINNHUB_FREE_ONLY=true unless your plan includes paid endpoints such as Economic Calendar/Social Sentiment.

FINNHUB_FREE_ONLY=true

FINNHUB_TIMEOUT=10

FINNHUB_RATE_LIMIT=60

# Optional official international economic calendar provider.

# Leave empty to use the no-key AkShare/WallstreetCN fallback. The legacy Trading Economics guest account is discontinued.

TRADING_ECONOMICS_CLIENT=

TRADING_ECONOMICS_KEY=

TRADING_ECONOMICS_BASE_URL=https://api.tradingeconomics.com

TRADING_ECONOMICS_TIMEOUT=10

# US macro time-series and official macro detail sources.

FRED_API_KEY=

FRED_BASE_URL=https://api.stlouisfed.org/fred

FRED_TIMEOUT=10

BLS_API_KEY=

BLS_BASE_URL=https://api.bls.gov/publicAPI/v2

BLS_TIMEOUT=10

BEA_API_KEY=

BEA_BASE_URL=https://apps.bea.gov/api/data

BEA_TIMEOUT=10

# Public crypto OHLCV/ticker (no API keys). binance supports BTC/USDT.

# In mainland CN / Docker without outbound access to api.binance.com, set PROXY_URL above.

CRYPTO_PUBLIC_DEFAULT_EXCHANGE=binance

CRYPTO_PUBLIC_TIMEOUT=10000

MARKET_CATALOG_AUTO_SYNC=true

AKSHARE_TIMEOUT=30

YFINANCE_TIMEOUT=30

# AI analysis checks the shared fundamental snapshot store before contacting

# external providers. The database TTL defaults to one day; the process-local

# cache avoids repeated reads during one analysis session.

AI_FUNDAMENTAL_DB_TTL_SEC=86400

AI_FUNDAMENTAL_CACHE_TTL_SEC=1800

# Optional identity sent to SEC EDGAR public endpoints. Use an application

# name and monitored contact address for production deployments.

SEC_USER_AGENT=QuantDinger/5.0 open-source-research support@your-domain.com

TIINGO_API_KEY=

TIINGO_TIMEOUT=10

# Crypto derivatives / on-chain data (optional, used by some AI prompts)

COINGLASS_API_KEY=

CRYPTOQUANT_API_KEY=

# Professional analysis report V1.

# community: free/keyless and low-cost sources remain the default.

# professional: requests licensed evidence; the report still downgrades to

# community unless professional-source observations were actually collected.

PROFESSIONAL_REPORT_DATA_TIER=community

# Maximum account-equity loss budget used by deterministic position sizing.

PROFESSIONAL_REPORT_RISK_BUDGET_PCT=1.0

# Optional: broad global headlines are displayed as background and never

# scored directionally without an explicit target-asset relevance tag.

FAST_ANALYSIS_INCLUDE_GLOBAL_NEWS=false

# Optional professional data credentials. Leaving every value empty is valid.

# A configured key does not itself grant customer display/redistribution rights;

# confirm the required commercial licence with each provider.

MASSIVE_API_KEY=

POLYGON_API_KEY=

INTRINIO_API_KEY=

HKEX_DATA_MARKETPLACE_USERNAME=

HKEX_DATA_MARKETPLACE_PASSWORD=

HKEX_OMD_LICENSE_ID=

HKEX_IIS_LICENSE_ID=

LSEG_CLIENT_ID=

LSEG_CLIENT_SECRET=

KAIKO_API_KEY=

COINMETRICS_API_KEY=

# Twelve Data (CN/HK stock K-lines — recommended for overseas servers)

# Free tier: 800 API credits/day, 8 requests/minute. https://twelvedata.com

TWELVE_DATA_API_KEY=

# Adanos Market Sentiment (optional US stock sentiment enrichment)

# If ADANOS_API_KEY is empty, /api/global-market/adanos-sentiment returns enabled=false.

ADANOS_API_KEY=

ADANOS_SENTIMENT_SOURCE=reddit

ADANOS_API_BASE_URL=https://api.adanos.org

ADANOS_API_TIMEOUT=10

# AI search / news

# Recommended order: Tavily -> SearXNG -> GDELT -> SerpAPI -> DuckDuckGo.

SEARCH_PROVIDER=tavily

SEARCH_MAX_RESULTS=10

SEARCH_GOOGLE_API_KEY=

SEARCH_GOOGLE_CX=

SEARCH_BING_API_KEY=

TAVILY_API_KEYS=

SERPAPI_KEYS=

SEARCH_SEARXNG_BASE_URL=

SEARCH_SEARXNG_ENGINES=

SEARCH_SEARXNG_CATEGORIES=general

SEARCH_SEARXNG_LANGUAGE=auto

SEARCH_SEARXNG_TIMEOUT=12

GDELT_BASE_URL=https://api.gdeltproject.org/api/v2/doc/doc

GDELT_TIMEOUT=12

GDELT_MAX_RESULTS=10

ALPHA_VANTAGE_API_KEY=

ALPHA_VANTAGE_BASE_URL=https://www.alphavantage.co/query

ALPHA_VANTAGE_TIMEOUT=12

ALPHA_VANTAGE_NEWS_LIMIT=20

# SMS / phone (optional)

TWILIO_ACCOUNT_SID=

TWILIO_AUTH_TOKEN=

TWILIO_FROM_NUMBER=

# Security / verification tuning

SECURITY_IP_MAX_ATTEMPTS=10

SECURITY_IP_WINDOW_MINUTES=5

SECURITY_IP_BLOCK_MINUTES=15

SECURITY_ACCOUNT_MAX_ATTEMPTS=5

SECURITY_ACCOUNT_WINDOW_MINUTES=60

SECURITY_ACCOUNT_BLOCK_MINUTES=30

VERIFICATION_CODE_EXPIRE_MINUTES=10

VERIFICATION_CODE_RATE_LIMIT=60

VERIFICATION_CODE_IP_HOURLY_LIMIT=10

VERIFICATION_CODE_MAX_ATTEMPTS=5

VERIFICATION_CODE_LOCK_MINUTES=30

# AI analysis tuning

ENABLE_CONFIDENCE_CALIBRATION=false

ENABLE_AI_ENSEMBLE=false

AI_ENSEMBLE_MODELS=openai/gpt-5.4,openai/gpt-4o-mini

ENABLE_REFLECTION_WORKER=false

REFLECTION_WORKER_INTERVAL_SEC=86400

REFLECTION_MIN_AGE_DAYS=7

REFLECTION_VALIDATE_LIMIT=200

AI_CALIBRATION_MARKETS=Crypto

AI_CALIBRATION_LOOKBACK_DAYS=30

AI_CALIBRATION_MIN_SAMPLES=80

AI_ANALYSIS_CONSENSUS_TIMEFRAMES=1D,4H

# Redis cache (auto-configured by docker-compose; set CACHE_ENABLED=true to use)

REDIS_HOST=redis

REDIS_PORT=6379

REDIS_PASSWORD=

REDIS_DB=0

REDIS_CACHE_NAMESPACE=quantdinger:cache:v1

CACHE_ENABLED=true

# Internal

INTERNAL_API_KEY=

# Market visibility (which markets appear in the watchlist picker /

# Agent API catalog / home AI radar).

#

# Primary knob (recommended):

# ENABLED_MARKETS — CSV whitelist. When set, ONLY these markets are

# visible everywhere. Unknown values are ignored. Empty = whitelist

# disabled (falls back to the legacy SHOW_* flags below).

# Valid values: Crypto, USStock, CNStock, HKStock, Forex, Futures, MOEX

# Examples:

# ENABLED_MARKETS=Crypto,USStock # crypto + US stocks only

# ENABLED_MARKETS=Crypto # crypto-only deployment

# ENABLED_MARKETS= # unset → legacy flags apply

# ENABLED_MARKETS=

#

# Legacy flags (kept for back-compat; ignored when ENABLED_MARKETS is set):

# SHOW_CN_STOCK (default false) — China A-shares

# SHOW_HK_STOCK (default true) — Hong Kong stocks

# All other known markets default to visible.

SHOW_CN_STOCK=false

# SHOW_HK_STOCK=true

# Per-process REST completion of private-stream fill snapshots.

# Counts snapshots; a venue snapshot may use multiple HTTP calls.

EXECUTION_FILL_SNAPSHOT_MIN_SEC=2

EXECUTION_FILL_SNAPSHOT_MAX_PER_MIN=30

# Durable grid actor routing and retry controls.

GRID_ACTOR_ROUTING_ENABLED=true

GRID_ACTOR_BATCH_SIZE=100

GRID_ACTOR_EVENT_LEASE_SEC=30

GRID_ACTOR_MAX_ATTEMPTS=8