# =====================================================================
#  Nexa Admin â€” environment configuration
#
#  Copy to .env and fill in. NEVER commit .env to version control.
#  This file lives above the DocumentRoot, so no URL can reach it.
# =====================================================================

APP_NAME="Nexa Admin"

# local | production
# 'local' shows full error detail; 'production' shows a generic page and a
# reference ID, with the detail written to storage/logs.
APP_ENV=local

APP_URL=http://nexa.local

# Timestamps are STORED in UTC and converted for display (TDD Â§11.1).
APP_TIMEZONE=UTC
APP_DISPLAY_TIMEZONE=Asia/Dhaka

APP_LOCALE=en

# Bumped on release; appended to asset URLs for cache busting in production.
APP_RELEASE=1.0.0

MAINTENANCE_MODE=false

# ---------------------------------------------------------------------
# Database
# ---------------------------------------------------------------------
# The application MUST NOT connect as root (TDD Â§15.1). Create a dedicated
# user with SELECT, INSERT, UPDATE, DELETE only â€” no DROP, ALTER, CREATE
# or FILE. See database/setup.sql.
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=nexa_admin
DB_USERNAME=nexa_app
DB_PASSWORD=iAq2k4DoFWTtfXxkhfqg5bm59GbjCo3o
# Migration credentials. Holds DDL rights (CREATE/ALTER/DROP) that the
# runtime user deliberately lacks, so the credentials an attacker reaches
# first cannot alter the schema. Used only to apply database/migrations/*.
DB_MIGRATE_USERNAME=nexa_migrate
DB_MIGRATE_PASSWORD=yi2eSaRNzKjNG9xWrRdp2jWRbaPvstnQ

# ---------------------------------------------------------------------
# Logging
# ---------------------------------------------------------------------
# debug | info | notice | warning | error | critical | alert | emergency
LOG_LEVEL=debug

# Logs every query to storage/logs/query-*.log. Local only â€” noisy.
LOG_QUERIES=false

# ---------------------------------------------------------------------
# Security
# ---------------------------------------------------------------------
# The Content-Security-Policy is ENFORCED as of Phase 7.5. The views were
# measured and contain zero inline event handlers and zero inline <script>
# blocks, so script-src needs no 'unsafe-inline'. See config/security.php
# for why style-src still does.
#
# Set to true only to fall back to observation mode while investigating a
# violation report.
CSP_REPORT_ONLY=false

# ---------------------------------------------------------------------
# Mail (Phase 3 â€” password reset)
# ---------------------------------------------------------------------
MAIL_HOST=
MAIL_PORT=587
MAIL_USERNAME=
MAIL_PASSWORD=
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=noreply@nexa.local
MAIL_FROM_NAME="Nexa Admin"

# ---------------------------------------------------------------------
# Public / admin surfaces (Phase 9A)
# ---------------------------------------------------------------------
# Both resolve to 127.0.0.1 natively. Port is ignored when matching, so
# these hold for `php -S 0.0.0.0:8123` and for an Apache vhost alike.
APP_PUBLIC_URL=http://site.localhost
APP_ADMIN_URL=http://admin.localhost
APP_DEFAULT_SURFACE=admin
