Configuration and Environments

Configuration and Environments

Configuration is environment-overridable, and a Spring profile (SPRING_PROFILES_ACTIVE) selects per-environment behavior. The same image runs every environment — the profile is chosen at deploy time.

Profiles

Profile	Rate-limit backend	Forwarded headers
local (default)	in-memory	off
dev, qa, sandbox, prod	Redis	framework (honors X-Forwarded-*)

Base config is application.yaml; per-environment overrides are application-{dev,qa,sandbox,prod}.yaml.

Environment variables

Variable	Purpose	Default
JWT_SECRET	HS256 signing key, ≥ 32 bytes (required; app fails fast otherwise)	dev/test injected
SPRING_PROFILES_ACTIVE	active profile	local
RATELIMIT_ENABLED	toggle rate limiting	true
RATELIMIT_BACKEND	memory or redis	per profile
RATELIMIT_TRUST_XFF	trust X-Forwarded-For for the client IP	false
REDIS_HOST / REDIS_PORT	Redis location (Redis profiles)	localhost / 6379
CORS_ALLOWED_ORIGINS	comma-separated allowed browser origins	http://localhost:5173

Notes

• Forwarded headers are enabled only in deployed profiles so generated URLs (e.g. the OpenAPI server URL) use the external https host behind the TLS-terminating proxy. It's off in local/tests so it doesn't strip X-Forwarded-For before the rate limiter — see Troubleshooting.
• CORS is only needed for cross-origin callers (e.g. the local SPA at :5173). The deployed SPA is same-origin, but its own origin is still added to the allow-list because ES module scripts are fetched in CORS mode.
• Branches dev / qa / sandbox / prod track the deployment environments (same code; the profile picks the behavior).