APP_NAME=Clusev
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://10.10.90.136

APP_LOCALE=de
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=de_DE

APP_MAINTENANCE_DRIVER=file
BCRYPT_ROUNDS=12

LOG_CHANNEL=stack
LOG_STACK=single
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

# ── Database (MariaDB) ───────────────────────────────────────────────
DB_CONNECTION=mariadb
DB_HOST=mariadb
DB_PORT=3306
DB_DATABASE=clusev
DB_USERNAME=clusev
DB_PASSWORD=change-me-strong
# mariadb container only (compose), not read by Laravel:
DB_ROOT_PASSWORD=change-me-strong-root

# ── Cache / Queue / Session via Redis ────────────────────────────────
REDIS_CLIENT=phpredis
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_PASSWORD=null

CACHE_STORE=redis
QUEUE_CONNECTION=redis
SESSION_DRIVER=redis
SESSION_LIFETIME=120
SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null

# ── Broadcasting (Laravel Reverb) ────────────────────────────────────
BROADCAST_CONNECTION=reverb
REVERB_APP_ID=changeme
REVERB_APP_KEY=changeme
REVERB_APP_SECRET=changeme
# client-facing (browser connects to the host-exposed port):
REVERB_HOST=10.10.90.136
REVERB_PORT=8080
REVERB_SCHEME=http
# server bind (inside the container):
REVERB_SERVER_HOST=0.0.0.0
REVERB_SERVER_PORT=8080

VITE_REVERB_APP_KEY="${REVERB_APP_KEY}"
VITE_REVERB_HOST="${REVERB_HOST}"
VITE_REVERB_PORT="${REVERB_PORT}"
VITE_REVERB_SCHEME="${REVERB_SCHEME}"

MAIL_MAILER=log
FILESYSTEM_DISK=local

# ── Docker Compose knobs (host ports / uid / image) ──────────────────
APP_PORT=80
VITE_PORT=5173
REVERB_HOST_PORT=8080
DB_PORT=3306
# Containers run as this host user (must own the bind-mount). nexxo=1002 on this VM.
HOST_UID=1002
HOST_GID=1002
# GHCR namespace for prod images (ghcr.io/<owner>/clusev):
GHCR_OWNER=OWNER
IMAGE_TAG=latest

# ── Reverse proxy / TLS (prod — written by install.sh) ───────────────
# Single knob: APP_DOMAIN empty -> Caddy serves plain HTTP on APP_PORT (bare-IP).
#              APP_DOMAIN set   -> Caddy gets a Let's Encrypt cert + forces HTTPS.
APP_DOMAIN=
APP_SCHEME=http
ACME_EMAIL=
# Derived from APP_DOMAIN by install.sh (":${APP_PORT}" vs "https://${APP_DOMAIN}"):
SITE_ADDRESS=:80
# Prod image: locally-built tag, or a pinned GHCR digest (ghcr.io/<owner>/clusev@sha256:..).
CLUSEV_IMAGE=clusev-app:prod
# HMAC key for the (v1.x) in-dashboard self-updater intent file — separate from APP_KEY.
UPDATE_HMAC_KEY=

# ── Optional demo server (seeded by FleetSeeder) ─────────────────────
# Leave HOST empty for an empty fleet (add servers at runtime). With a host set,
# the seeder creates one real server + an encrypted credential. Never committed.
CLUSEV_DEMO_SSH_NAME=demo-01
CLUSEV_DEMO_SSH_HOST=
CLUSEV_DEMO_SSH_PORT=22
CLUSEV_DEMO_SSH_USER=root
CLUSEV_DEMO_SSH_PASSWORD=
# CLUSEV_DEMO_SSH_KEY=   # private-key PEM instead of a password (preferred)