APP_NAME=Clusev
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://10.10.90.136

APP_LOCALE=de
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=de_DE

APP_MAINTENANCE_DRIVER=file
BCRYPT_ROUNDS=12

LOG_CHANNEL=stack
LOG_STACK=single
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

# ── Database (MariaDB) ───────────────────────────────────────────────
DB_CONNECTION=mariadb
DB_HOST=mariadb
DB_PORT=3306
DB_DATABASE=clusev
DB_USERNAME=clusev
DB_PASSWORD=change-me-strong
# mariadb container only (compose), not read by Laravel:
DB_ROOT_PASSWORD=change-me-strong-root

# ── Cache / Queue via Redis · Session via database ───────────────────
REDIS_CLIENT=phpredis
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_PASSWORD=null

CACHE_STORE=redis
QUEUE_CONNECTION=redis
# database = sessions are listable/revocable in Settings (Redis stays for cache/queue)
SESSION_DRIVER=database
SESSION_LIFETIME=120
SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null

# ── Broadcasting (Laravel Reverb) ────────────────────────────────────
BROADCAST_CONNECTION=reverb
REVERB_APP_ID=changeme
REVERB_APP_KEY=changeme
REVERB_APP_SECRET=changeme
# client-facing (browser connects to the host-exposed port):
REVERB_HOST=10.10.90.136
REVERB_PORT=8080
REVERB_SCHEME=http
# server bind (inside the container):
REVERB_SERVER_HOST=0.0.0.0
REVERB_SERVER_PORT=8080

VITE_REVERB_APP_KEY="${REVERB_APP_KEY}"
VITE_REVERB_HOST="${REVERB_HOST}"
VITE_REVERB_PORT="${REVERB_PORT}"
VITE_REVERB_SCHEME="${REVERB_SCHEME}"

MAIL_MAILER=log
FILESYSTEM_DISK=local

# ── Docker Compose knobs (host ports / uid / image) ──────────────────
APP_PORT=80
VITE_PORT=5173
REVERB_HOST_PORT=8080
DB_PORT=3306
# Containers run as this host user (must own the bind-mount). nexxo=1002 on this VM.
HOST_UID=1002
HOST_GID=1002
# GHCR namespace for prod images (ghcr.io/<owner>/clusev):
GHCR_OWNER=OWNER
IMAGE_TAG=latest

# ── Reverse proxy / TLS (prod — written by install.sh) ───────────────
# Single knob: APP_DOMAIN empty -> Caddy serves plain HTTP on APP_PORT (bare-IP).
#              APP_DOMAIN set   -> Caddy auto-issues a Let's Encrypt cert + forces HTTPS.
# Changing the panel domain later = re-run install.sh with the new domain.
APP_DOMAIN=
APP_SCHEME=http
ACME_EMAIL=
# Deployed commit + branch, shown on the Version page. install.sh fills these from the host's
# .git (the prod image ships none) — leave empty; in dev the page reads .git directly.
CLUSEV_BUILD_SHA=
CLUSEV_BUILD_BRANCH=
# Update source for the in-app version check. install.sh derives this from the clone origin
# (git remote get-url origin). Leave empty to disable the check. Never put a private repo URL in a
# tracked file — only here in the per-deployment .env.
CLUSEV_REPOSITORY=
# Display timezone for dashboard times (DB stays UTC). install.sh sets this from the host; UTC default.
APP_TIMEZONE=UTC
# External reverse-proxy TLS: set to the upstream proxy's address/CIDR so Caddy trusts its
# X-Forwarded-Proto. Leave as 127.0.0.1/32 (trust nothing) when Caddy terminates TLS itself.
TRUSTED_PROXY_CIDR=127.0.0.1/32
# Derived from APP_DOMAIN by install.sh (":${APP_PORT}" vs "https://${APP_DOMAIN}"):
SITE_ADDRESS=:80
# Prod image: locally-built tag, or a pinned GHCR digest (ghcr.io/<owner>/clusev@sha256:..).
CLUSEV_IMAGE=clusev-app:prod
# HMAC key for the (v1.x) in-dashboard self-updater intent file — separate from APP_KEY.
UPDATE_HMAC_KEY=

# ── Optional demo server (seeded by FleetSeeder) ─────────────────────
# Leave HOST empty for an empty fleet (add servers at runtime). With a host set,
# the seeder creates one real server + an encrypted credential. Never committed.
CLUSEV_DEMO_SSH_NAME=demo-01
CLUSEV_DEMO_SSH_HOST=
CLUSEV_DEMO_SSH_PORT=22
CLUSEV_DEMO_SSH_USER=root
CLUSEV_DEMO_SSH_PASSWORD=
# CLUSEV_DEMO_SSH_KEY=   # private-key PEM instead of a password (preferred)