fix: remove unused GIGL keys, harden prod Compose env, complete DEPLOYMENT.md (#1021)

Closes #978 — remove GIGL_API_BASE_URL and GIGL_API_TOKEN from
ConfigService.Config and the all-snapshot getter; update the stale
GIGL_API_TOKEN comment in logistics.service.ts to LOGISTICS_API_KEY.

Closes #983 — fix hardcoded 'trustlink' password in app-prod's
DATABASE_URL; now uses ${POSTGRES_PASSWORD} to match db-prod.

Closes #982 — pass every production-required variable to app-prod:
PRESIGN_SECRET, SYSTEM_SIGNER_SECRET, CONTRACT_ID, FRONTEND_URL,
EVIDENCE_STORAGE_BASE_URL, CONTACT_ENCRYPTION_KEY,
CREDENTIAL_ENCRYPTION_KEY, STELLAR_WEBHOOK_SECRET, SENTRY_DSN,
SOROBAN_RPC_URL, plus STELLAR_NETWORK, ALLOWED_ORIGINS, API_BASE_URL,
and the optional SendGrid/Twilio variables.

Closes #981 — update DEPLOYMENT.md Environment Rules to list every
variable the config schema requires in production (PRESIGN_SECRET,
SYSTEM_SIGNER_SECRET, CONTRACT_ID, FRONTEND_URL,
EVIDENCE_STORAGE_BASE_URL, CONTACT_ENCRYPTION_KEY, SOROBAN_RPC_URL,
SENTRY_DSN); mark SENDGRID_FROM_EMAIL and TWILIO_FROM_NUMBER as
conditionally required; update the docker .env example so it would
pass schema validation.

Co-authored-by: Dev Fashman <jajafwangshak86@gmail.com>

Author: Lekan101

DEPLOYMENT.md

@@ -23,18 +23,28 @@ Set all required variables before running migrations or starting the service:
 - `PORT`
 - `DATABASE_URL`
 - `SEP10_JWT_SECRET`
+- `SYSTEM_SIGNER_SECRET` — Stellar secret key used for transaction signing
 - `ADMIN_ADDRESS`
 - `STELLAR_NETWORK`
-- `STELLAR_WEBHOOK_SECRET`
+- `STELLAR_WEBHOOK_SECRET` — required in production; validates inbound Stellar webhook payloads
 - `REDIS_URL`
 - `ALLOWED_ORIGINS`
 - `API_BASE_URL`
-- `SENDGRID_API_KEY`
-- `TWILIO_ACCOUNT_SID`
-- `TWILIO_AUTH_TOKEN`
+- `PRESIGN_SECRET` — signs evidence pre-signed URLs; must be stable across restarts and replicas
+- `CONTRACT_ID` — Soroban escrow contract ID
+- `FRONTEND_URL` — required in production
+- `EVIDENCE_STORAGE_BASE_URL` — public base URL evidence objects are served from
+- `CONTACT_ENCRYPTION_KEY` — 64-character hex string (32 bytes); required in production
+- `CREDENTIAL_ENCRYPTION_KEY` — 64-character hex string (32 bytes); required in production
+- `SOROBAN_RPC_URL` — required in production; no safe default RPC endpoint exists
+- `SENTRY_DSN` — required in production; error reporting endpoint URL
+- `SENDGRID_API_KEY` *(optional)* — enable email notifications
+- `SENDGRID_FROM_EMAIL` — **required when `SENDGRID_API_KEY` is set**; verified sender address
+- `TWILIO_ACCOUNT_SID` *(optional)* — enable SMS notifications
+- `TWILIO_AUTH_TOKEN` — required when `TWILIO_ACCOUNT_SID` is set
+- `TWILIO_FROM_NUMBER` — **required when `TWILIO_ACCOUNT_SID` is set**; E.164 format
 - `OTEL_ENABLED`
 - `OTEL_EXPORTER_OTLP_ENDPOINT`
-- `CREDENTIAL_ENCRYPTION_KEY` (64-character hex string for logistics API key encryption)
 
 Keep secrets in the deployment platform secret manager. Do not bake them into images, workflow files, or migration scripts.
 
@@ -53,14 +63,33 @@ The `docker-compose.yml` includes a production profile optimized for production
 1. Create a `.env` file with production secrets:
    ```bash
    SEP10_JWT_SECRET=your-production-jwt-secret-at-least-32-chars
-   ADMIN_ADDRESS=your-admin-stellar-address
+   SYSTEM_SIGNER_SECRET=Sxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+   ADMIN_ADDRESS=Gxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    POSTGRES_PASSWORD=your-secure-postgres-password
-   CREDENTIAL_ENCRYPTION_KEY=64-character-hex-string-for-encryption
+   PRESIGN_SECRET=your-cryptographically-random-presign-secret
+   CONTRACT_ID=your-soroban-contract-id
+   FRONTEND_URL=https://app.yourdomain.com
+   EVIDENCE_STORAGE_BASE_URL=https://storage.yourdomain.com
+   CONTACT_ENCRYPTION_KEY=64-character-hex-string-for-contact-encryption
+   CREDENTIAL_ENCRYPTION_KEY=64-character-hex-string-for-credential-encryption
+   STELLAR_NETWORK=MAINNET
+   STELLAR_WEBHOOK_SECRET=your-stellar-webhook-secret
+   SENTRY_DSN=https://xxxx@sentry.io/yyyy
+   SOROBAN_RPC_URL=https://your-soroban-rpc-endpoint
+   ALLOWED_ORIGINS=https://app.yourdomain.com
+   API_BASE_URL=https://api.yourdomain.com
    OTEL_ENABLED=false
    OTEL_EXPORTER_OTLP_ENDPOINT=
+   # Optional — enable email notifications
+   # SENDGRID_API_KEY=SG.xxxx
+   # SENDGRID_FROM_EMAIL=noreply@yourdomain.com
+   # Optional — enable SMS notifications
+   # TWILIO_ACCOUNT_SID=ACxxxx
+   # TWILIO_AUTH_TOKEN=xxxx
+   # TWILIO_FROM_NUMBER=+15550001234
    ```
 
-2. Ensure the `CREDENTIAL_ENCRYPTION_KEY` is exactly 64 hex characters (32 bytes). Generate one with:
+2. Generate 64-character hex keys for `CONTACT_ENCRYPTION_KEY` and `CREDENTIAL_ENCRYPTION_KEY` with:
    ```bash
    node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
    ```

docker-compose.yml

@@ -77,13 +77,31 @@ services:
       - "3000:3000"
     environment:
       - NODE_ENV=production
-      - DATABASE_URL=postgresql://trustlink:trustlink@db-prod:5432/trustlink_db
+      - DATABASE_URL=postgresql://trustlink:${POSTGRES_PASSWORD}@db-prod:5432/trustlink_db
       - REDIS_URL=redis://redis-prod:6379
       - SEP10_JWT_SECRET=${SEP10_JWT_SECRET}
       - ADMIN_ADDRESS=${ADMIN_ADDRESS}
+      - PRESIGN_SECRET=${PRESIGN_SECRET}
+      - SYSTEM_SIGNER_SECRET=${SYSTEM_SIGNER_SECRET}
+      - CONTRACT_ID=${CONTRACT_ID}
+      - FRONTEND_URL=${FRONTEND_URL}
+      - EVIDENCE_STORAGE_BASE_URL=${EVIDENCE_STORAGE_BASE_URL}
+      - CONTACT_ENCRYPTION_KEY=${CONTACT_ENCRYPTION_KEY}
+      - CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY}
+      - STELLAR_WEBHOOK_SECRET=${STELLAR_WEBHOOK_SECRET}
+      - SENTRY_DSN=${SENTRY_DSN}
+      - SOROBAN_RPC_URL=${SOROBAN_RPC_URL}
+      - STELLAR_NETWORK=${STELLAR_NETWORK:-MAINNET}
       - OTEL_ENABLED=${OTEL_ENABLED:-false}
       - OTEL_EXPORTER_OTLP_ENDPOINT=${OTEL_EXPORTER_OTLP_ENDPOINT}
       - OTEL_SERVICE_NAME=trustlink-backend
+      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS}
+      - API_BASE_URL=${API_BASE_URL}
+      - SENDGRID_API_KEY=${SENDGRID_API_KEY}
+      - SENDGRID_FROM_EMAIL=${SENDGRID_FROM_EMAIL}
+      - TWILIO_ACCOUNT_SID=${TWILIO_ACCOUNT_SID}
+      - TWILIO_AUTH_TOKEN=${TWILIO_AUTH_TOKEN}
+      - TWILIO_FROM_NUMBER=${TWILIO_FROM_NUMBER}
     depends_on:
       db-prod:
         condition: service_healthy

src/config/config.service.ts

@@ -71,8 +71,6 @@ export interface Config {
   GIT_SHA?: string;
   EVIDENCE_UPLOAD_LIMIT?: number;
   EVIDENCE_UPLOAD_TTL?: number;
-  GIGL_API_BASE_URL?: string;
-  GIGL_API_TOKEN?: string;
   SOROBAN_RPC_URL?: string;
   /** Always present: the config schema applies a validated default of 5000. */
   SOROBAN_POLL_INTERVAL_MS: number;
@@ -171,12 +169,6 @@ export class ConfigService {
       ),
       LOG_LEVEL: this.nestConfigService.get('LOG_LEVEL', { infer: true }),
       API_BASE_URL: this.nestConfigService.get('API_BASE_URL', { infer: true }),
-      GIGL_API_BASE_URL: this.nestConfigService.get('GIGL_API_BASE_URL', {
-        infer: true,
-      }),
-      GIGL_API_TOKEN: this.nestConfigService.get('GIGL_API_TOKEN', {
-        infer: true,
-      }),
       SOROBAN_POLL_INTERVAL_MS: this.get('SOROBAN_POLL_INTERVAL_MS'),
       SOROBAN_RPC_TIMEOUT_MS: this.get('SOROBAN_RPC_TIMEOUT_MS'),
       WEBHOOK_EVENT_RETENTION_DAYS: this.get('WEBHOOK_EVENT_RETENTION_DAYS'),

src/logistics/logistics.service.ts

@@ -57,7 +57,7 @@ export class LogisticsService implements OnModuleInit {
   /**
    * Loads the logistics API key at startup, preferring a previously rotated
    * value persisted in `ProviderCredential` (issue #499) over the
-   * `GIGL_API_TOKEN` environment variable. The environment variable remains
+   * `LOGISTICS_API_KEY` environment variable. The environment variable remains
    * the fallback for a first boot with nothing stored yet.
    */
   private async loadPersistedApiKey(): Promise<void> {