sentinel-node-tester/.env.example at master · Sentinel-Bluebuilder/sentinel-node-tester · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
# Sentinel Node Tester — Environment Configuration
# Copy to .env and fill in your values:  cp .env.example .env

# ⚠ COST WARNING: Each node test costs ~40 P2P for 1GB bandwidth.
#   Full audit of ~1000 nodes ≈ 700-800 P2P (~$2-3 USD).
#   Get P2P tokens via Osmosis DEX: https://app.osmosis.zone
#   Token name: P2P (chain denom: udvpn, 1 P2P = 1,000,000 udvpn)

# ⚠ ADMIN: WireGuard requires Administrator (Windows) or sudo (macOS/Linux).
#   Without admin, only V2Ray nodes (~70%) will be testable.
#   Windows: launch via SentinelAudit.vbs (auto-elevates)
#   macOS/Linux: sudo node server.js

# ─── REQUIRED ────────────────────────────────────────────────────────────────

# Your Sentinel wallet mnemonic (12 or 24 words)
# Create one: https://wallet.sentinel.co or any Cosmos wallet (prefix: sent1)
MNEMONIC=your twelve word mnemonic phrase goes here replace with real words

# ─── Chain ───────────────────────────────────────────────────────────────────

# Primary RPC endpoint for broadcasting transactions.
# Default: busurnode (verified 2026-05-02, ~125ms). rpc.sentinel.co was the
# old default but has been stuck behind tip while reporting catching_up=false,
# returning stale balances. The full audited list is in core/constants.js.
RPC=https://rpc-sentinel.busurnode.com

# Optional: comma-separated LCD fallback endpoints (used only if RPC fails)
# LCD_ENDPOINTS=https://lcd-sentinel.busurnode.com,https://api.sentinel.suchnode.net

# Token denomination (do not change)
DENOM=udvpn

# Gas price (do not change)
GAS_PRICE=0.2udvpn

# ─── Audit behavior ──────────────────────────────────────────────────────────

# Gigabytes per node session (1 = minimum, recommended for testing)
GIGABYTES_PER_NODE=1

# Megabytes to download during speed test (10 = quick, 50 = thorough)
TEST_MB=10

# Maximum nodes to test (0 = all online nodes, ~1000)
MAX_NODES=0

# Delay between node tests in milliseconds
NODE_DELAY_MS=5000

# Optional: comma-separated DNS servers used when probing nodes
# DNS_SERVERS=1.1.1.1,8.8.8.8

# ─── Server ──────────────────────────────────────────────────────────────────

# HTTP port
PORT=3001

# Bind address. 127.0.0.1 = local only (default, safest).
# Set to 0.0.0.0 to expose on the network — only do this with ADMIN_TOKEN set.
LISTEN_HOST=127.0.0.1

# ─── Admin auth & public dashboard ───────────────────────────────────────────

# Set PUBLIC_MODE=true to expose a read-only public dashboard at /.
# When PUBLIC_MODE=true you MUST also set ADMIN_TOKEN — the server will refuse
# to start without it to prevent accidental open access to admin routes.
#
# Generate a strong token:  openssl rand -hex 32
# Windows alternative:      node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
#
# ⚠ This token also seeds the admin-session cookie HMAC. Rotating it logs out
#   every existing admin session. Use ≥32 bytes of entropy — short tokens
#   weaken cookie integrity, not just login auth.
ADMIN_TOKEN=
PUBLIC_MODE=false
ADMIN_PATH=/admin

# Set INSECURE_COOKIE=true to allow the admin session cookie over plain HTTP.
# Default (false) issues Secure cookies — required when serving over HTTPS in
# production. Only flip to true for local development on http://localhost.
INSECURE_COOKIE=false

# Set ENABLE_HSTS=true behind a TLS-terminating proxy to send a strict-transport
# header on admin responses. Default off.
ENABLE_HSTS=false

# ─── Public-triggered test (optional, off by default) ────────────────────────
# When ALLOW_PUBLIC_TEST=true the public dashboard exposes a Start/Stop button
# wired to a pre-configured plan or subscription. Leave disabled unless you
# explicitly want unauthenticated visitors to be able to spend your wallet.
# SECURITY: the per-IP rate limit on this route derives the client IP from
# `req.ip` with `trust proxy=1`, which trusts exactly one X-Forwarded-For hop.
# Only enable this BEHIND a real reverse proxy that terminates/sets XFF — if the
# tester is exposed directly, a client can spoof XFF and bypass the limiter.
ALLOW_PUBLIC_TEST=false
PUBLIC_TEST_PLAN_ID=
PUBLIC_TEST_SUB_ID=
PUBLIC_TEST_SUB_GRANTER=