<?php

return [

    /*
    | Hostnames the operator console (/admin) may be served on.
    |
    | The Proxmox hosts and the admin console must never be publicly reachable.
    | The primary control belongs in the reverse proxy (only expose the public
    | hostnames); this is defence in depth INSIDE the app, so a proxy
    | misconfiguration cannot silently expose the console on a public domain.
    |
    | Comma-separated in ADMIN_HOSTS. EMPTY = no host restriction (dev default),
    | so nobody gets locked out by simply upgrading.
    |
    | Example (production):
    |   ADMIN_HOSTS=admin.clupilot.com
    */
    // Lowercased: DNS names are case-insensitive and Symfony's getHost() always
    // returns lowercase, so ADMIN_HOSTS=Admin.Example.com must still match.
    'hosts' => array_values(array_filter(array_map(
        fn ($host) => strtolower(trim($host)),
        explode(',', (string) env('ADMIN_HOSTS', ''))
    ))),

    /*
    | Key for VPN configs stored at rest (32 bytes, base64). Separate from
    | APP_KEY on purpose — see App\Services\Wireguard\ConfigVault. Empty means
    | storing configs is switched off, and the console says so rather than
    | quietly writing credentials in the clear.
    |
    | Generate with:  head -c 32 /dev/urandom | base64
    */
    'vpn_config_key' => env('VPN_CONFIG_KEY', ''),

    /*
    | Networks that count as "us" while the public site is hidden
    | (PublicSiteGate). The WireGuard management subnet by default, so anyone on
    | the VPN sees the real site while the outside world sees a placeholder.
    |
    | Note this is compared against the CLIENT address, which is only correct
    | because TrustProxies is configured — behind an untrusted proxy every
    | request would look like it came from the proxy.
    */
    'trusted_ranges' => array_values(array_filter(array_map(
        'trim',
        explode(',', (string) env('TRUSTED_RANGES', '10.66.0.0/24,127.0.0.1')),
    ))),

];