homeos/database/seeders/DatabaseSeeder.php

<?php

namespace Database\Seeders;

use App\Models\User;
use Illuminate\Database\Seeder;
use Illuminate\Support\Facades\Hash;

class DatabaseSeeder extends Seeder
{
    /**
     * Seed the application's database.
     *
     * Admin credentials come from the (gitignored) .env so no secret is committed.
     */
    public function run(): void
    {
        // The admin password must be explicit outside local/testing — never silently seed a
        // known credential in production. The dev fallback only applies to local/testing.
        $adminPassword = env('HOMEOS_ADMIN_PASSWORD');

        if (blank($adminPassword)) {
            if (! app()->environment('local', 'testing')) {
                throw new \RuntimeException('HOMEOS_ADMIN_PASSWORD must be set to seed the admin account outside local/testing.');
            }

            $adminPassword = 'homeos-dev';
        }

        User::updateOrCreate(
            ['email' => env('HOMEOS_ADMIN_EMAIL', 'admin@homeos.local')],
            [
                'name' => env('HOMEOS_ADMIN_NAME', 'Admin'),
                'password' => Hash::make($adminPassword),
                'email_verified_at' => now(),
            ],
        );

        // Demo household is development-only — never inject mock devices/warnings into
        // a real (production) deployment via `migrate --seed`.
        if (app()->environment('local', 'testing')) {
            $this->call(DemoHomeSeeder::class);
        }
    }
}