selfhost.example.env

# ─────────────────────────────────────────────────────────────────────────────
# RAZEX9 self-hosted router — configuration
#
# Copy to raze.env, fill in the three REQUIRED values, run.
# Every value here is read ONCE at startup: changing any of them needs a restart.
#
# Design rule: besides the license key there is NO dependency on Raze
# infrastructure. This binary talks to exactly three things — the license hub,
# YOUR RPC endpoint, and YOUR Yellowstone gRPC endpoint.
# ─────────────────────────────────────────────────────────────────────────────

# ── REQUIRED ────────────────────────────────────────────────────────────────

# Your license key. Setting it is what puts the binary in self-host mode.
# It is ALSO your API credential (unless you set WRAPPER_API_KEY below).
# An empty value = not set = fleet mode, no license gate.
RAZE_SELF_HOST_LICENSE_KEY=rzl_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Your Solana RPC. Used for account reads (cold lookups + background warmers),
# blockhashes and lookup-table reads. NOT used for pricing.
# Missing or empty ⇒ the binary exits 78 at startup.
# Use a paid endpoint: see "Sizing your RPC" in README.md.
RPC_URL=https://your-rpc-endpoint

# Your Yellowstone gRPC endpoint. This is the price source: the pool state is
# kept live from this subscription. Missing or empty ⇒ exit 78.
GRPC_ENDPOINT=https://your-yellowstone-endpoint

# Token for the gRPC endpoint, if your provider requires one. Optional.
#GRPC_TOKEN=


# ── STRONGLY RECOMMENDED ────────────────────────────────────────────────────

# Where the router keeps its state on disk. The default is ./cache — RELATIVE
# to the process working directory, which under systemd is / unless you set
# WorkingDirectory=. Always give an absolute path, create it, and make it
# writable by the service user.
# Note: a trailing / is stripped, and an empty value falls back to ./cache.
RAZE_CACHE_DIR=/var/lib/raze-router

# Bind address of the trading API. The default is 0.0.0.0:8082 — EVERY
# interface. POST /swap/sol/buy and /swap/sol/sell answer without any
# credential, so on a reachable port anyone can spend your RPC quota and have
# the fees go to Raze. Bind loopback and put your own proxy in front, or
# firewall the port.
BIND_ADDR=127.0.0.1:8082

# Secret used to HMAC-sign route tickets (the `routeTicket` in a quote, which
# /swap/sol/instructions and /swap/sol/buy can redeem to build EXACTLY the plan
# you were quoted instead of re-quoting). Any random string; it never leaves
# your box. Without it the feature is simply off.
RAZE_TICKET_SECRET=change-me-to-any-random-string


# ── OPTIONAL ────────────────────────────────────────────────────────────────

# License hub. You do NOT need to set this — the default is correct.
# Setting it to the empty string detaches from any hub, which fails CLOSED:
# every /swap/* route returns 403 forever.
#RAZE_HUB_URL=https://hub.raze.bot

# How often the license is re-verified, in seconds. 0 / negative / non-numeric
# are ignored and fall back to 300. The gate tolerates an unreachable hub for
# 5 consecutive failures and closes on the 6th (~30 min at the default).
#RAZE_SELF_HOST_VERIFY_INTERVAL_SECS=300

# Your own API credential. If set, it becomes the ONLY accepted credential and
# your license key stops working as an API header (it is still what the hub
# verifies). Useful if you would rather not put the license on every request.
#WRAPPER_API_KEY=

# Prometheus /metrics port. Bound to 127.0.0.1 in self-host mode and NOT
# configurable to anything else — it sits outside the license gate. A
# non-numeric value is ignored silently. If the port is taken you lose only
# the metrics; the router keeps serving.
#PROMETHEUS_PORT=9093

# How often the pool snapshot is written to RAZE_CACHE_DIR.
#SNAPSHOT_INTERVAL_SECS=60

# Bind the port immediately instead of waiting for the first route index.
# Default (unset) is the safer behaviour: no port until the router can answer.
#RAZE_SERVE_BEFORE_READY=1
#RAZE_READY_BIND_TIMEOUT_SECS=120


# ── OPTIONAL: run your own on-chain router ──────────────────────────────────
# The RAZEX9 instance every route is built against. Unset = ours, which is
# already deployed and needs no configuration.
#
# The program source ships in program/ under Apache-2.0, and the router derives
# the config PDA, the swap-authority pool and the invoked program from whatever
# id it is given — so deploying your own copy and naming it here is all it
# takes. Your instance keeps its own admin, venue allowlist and pause switch.
# See program/README.md §6.
#
# Read once at startup. An invalid pubkey stops the process instead of falling
# back, so a typo cannot quietly route your swaps through another program.
#RAZE_ROUTER_PROGRAM=

# ── OPTIONAL: reuse Raze's lookup tables, read-only ─────────────────────────
# Only with the exact peer URL Raze gives you — see README.md §9.
# Your builds already use the two STATIC tables with no configuration at all.

# WARNING: RAZE_ALT_AUTOEXTEND is ON when absent or empty. Write the 0.
# With no ALT signer it is inert today, but if you ever set ALT_PRIVATE_KEY /
# ALT_KEYPAIR_PATH, an unset value makes the router create and extend tables
# with YOUR SOL — and silently disables the read-only sync below.
#RAZE_ALT_AUTOEXTEND=0
#RAZE_ALT_SYNC_PEER_URL=
#RAZE_ALT_SYNC_INTERVAL_SECS=60


# ── DO NOT SET ──────────────────────────────────────────────────────────────
#
# RAZE_SNAPSHOT_SEED_URL       the boot seeder DOES run in self-host and points
#                              at a fleet-only endpoint you cannot reach; it
#                              blocks startup for up to 120 s before giving up.
# JWT_SECRET                   makes the auth layer accept any HS256 bearer
#                              signed with it — a second door you did not ask for.
# AUTHENTICATOR_PRIVATE_KEY    dead legacy config; no code reads it.
# ALT_PRIVATE_KEY / ALT_KEYPAIR_PATH
#                              the only private key this binary can load. It
#                              never signs a trade — it pays rent for lookup
#                              tables you choose to create. Leave unset.
#
# Inert here (their consumers are not started in self-host mode):
# API_BACKEND_URL, STREAMING_HTTP_URL, MIGRATION_WS_URL, INTERNAL_SERVICE_SECRET,
# SERVICE_SYNC_KEY, RAZE_ROLE, RAZE_FEED.