APP_NAME="Pireon Admin"
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://localhost:8000

APP_LOCALE=es
APP_FALLBACK_LOCALE=es
APP_FAKER_LOCALE=es_ES

APP_MAINTENANCE_DRIVER=file
# APP_MAINTENANCE_STORE=database

# PHP_CLI_SERVER_WORKERS=4

BCRYPT_ROUNDS=12

LOG_CHANNEL=stack
LOG_STACK=single
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

DB_CONNECTION=sqlite
# DB_HOST=127.0.0.1
# DB_PORT=3306
# DB_DATABASE=laravel
# DB_USERNAME=root
# DB_PASSWORD=

SESSION_DRIVER=database
SESSION_LIFETIME=120
SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null

BROADCAST_CONNECTION=log
FILESYSTEM_DISK=local
QUEUE_CONNECTION=database

CACHE_STORE=database
# CACHE_PREFIX=

MEMCACHED_HOST=127.0.0.1

REDIS_CLIENT=phpredis
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

MAIL_MAILER=log
MAIL_SCHEME=null
MAIL_HOST=127.0.0.1
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_FROM_ADDRESS="hello@example.com"
MAIL_FROM_NAME="${APP_NAME}"

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_USE_PATH_STYLE_ENDPOINT=false

VITE_APP_NAME="${APP_NAME}"

###############################################################################
# Pireon OAuth2 identity server
#
# Register this app as an OAuth client at https://oauth.pireon.dev and paste the
# credentials here. The redirect URI must match the one registered there exactly.
###############################################################################
PIREON_SERVER=https://oauth.pireon.dev
PIREON_CLIENT_ID=
PIREON_CLIENT_SECRET=
PIREON_REDIRECT_URI="${APP_URL}/auth/callback"
PIREON_SCOPES=account:read

# «Entrar con Pireon» (Authorization Code + PKCE) under the login form. A Pireon
# client allows one grant type: the one above is the password client, so
# register another for authorization_code with the redirect URI above and put
# it here; the button shows up once it is set. PIREON_REDIRECT_LOGIN=true shows
# it with the client above instead (when that one allows authorization_code).
PIREON_REDIRECT_CLIENT_ID=
PIREON_REDIRECT_CLIENT_SECRET=
# PIREON_REDIRECT_LOGIN=

# Webhooks at ${APP_URL}/api/v1/webhooks/pireon (user.deactivated, token.revoked):
# register it on each client and paste the secret each one returns. Empty: the
# endpoint refuses everything and a revocation waits for the cache below.
PIREON_WEBHOOK_SECRET=
PIREON_REDIRECT_WEBHOOK_SECRET=

# Grants. The panel's sign-in form uses the password grant, so turning this off
# locks everyone out of the panel as well as out of POST /api/v1/auth/token.
PIREON_PASSWORD_GRANT=true

# How long an API bearer token stays valid here after being revoked upstream.
PIREON_INTROSPECTION_TTL=60
PIREON_HTTP_TIMEOUT=10

# Role granted on a user's first sign-in.
PIREON_DEFAULT_ROLE=viewer

# Refuse sessions for accounts the identity server reports as inactive or
# still awaiting administrator approval.
PIREON_REQUIRE_ACTIVE=true
PIREON_REQUIRE_APPROVED=true

###############################################################################
# Public site (separate, server-rendered application)
###############################################################################
SITE_URL=http://localhost:4321

# Frontend i18n routers serve the default locale without a prefix. Turn this
# on only if yours prefixes every locale.
SITE_PREFIX_DEFAULT_LOCALE=false

# Shared secret letting the frontend render unpublished content.
# Leave empty to disable previews entirely. Generate one with:
#   php -r "echo bin2hex(random_bytes(24)), PHP_EOL;"
SITE_PREVIEW_TOKEN=

# Seconds a shared cache may serve a public response without revalidating.
SITE_CACHE_SECONDS=60

# Requests per minute on the public API. With SSR every visitor's page view
# arrives from the frontend's IP, so this is a budget for the WHOLE site at
# once. Add that IP to SITE_TRUSTED_IPS to bypass the limit entirely.
SITE_RATE_LIMIT=600
SITE_TRUSTED_IPS=

# Shared secret the frontend presents when reporting addresses it could not
# resolve (X-Ingest-Token). Those reports are what turns Redirects from
# something only this side can write into a list of links actually broken out
# there. Leave empty to disable the endpoint — empty never means "anyone may
# report". Generate one with:
#   php -r "echo bin2hex(random_bytes(24)), PHP_EOL;"
SITE_INGEST_TOKEN=

# Reports per minute, and paths per request.
SITE_TELEMETRY_RATE_LIMIT=60
SITE_TELEMETRY_MAX_BATCH=50

# Submissions — the only public write endpoints. Set to false to close the
# forms without deploying; the frontend reads the flag from /site and hides
# them rather than showing a form that would be refused.
SITE_ACCEPT_SUBMISSIONS=true

# Field name no human fills in. Anything arriving with it set is filed as
# spam — filed, not dropped, so a browser autofill cannot lose a real message.
SITE_HONEYPOT_FIELD=website

# Per e-mail address, per minute; and across the whole site, per hour. There is
# deliberately no per-IP budget: with SSR every submission arrives from the
# frontend's address.
SITE_SUBMISSION_RATE_LIMIT=3
SITE_SUBMISSION_HOURLY_LIMIT=60
SITE_SUBMISSION_DEDUPE_MINUTES=1440

# Also e-mail the panel users who can read the inbox (needs a working mailer).
SITE_SUBMISSION_MAIL=false

###############################################################################
# Images
###############################################################################
# Disk uploads live on. It has to be one with public URLs: the frontend is a
# separate application on another host. `public` needs `php artisan storage:link`
# once. If you have uploads from before this setting existed they are on the
# private `local` disk — either move them to storage/app/public or set this to
# `local`, which is served through the application's own /storage route.
MEDIA_DISK=public

# Images above this many pixels are recorded with their dimensions but not
# resampled: resizing one costs more memory than it is worth, and it is nearly
# always a mistake rather than an intention.
MEDIA_MAX_PIXELS=50000000

###############################################################################
# Git repositories — self-hosted Gitea
###############################################################################
GIT_PROVIDER=gitea

# Instance root, WITHOUT /api/v1 — the driver appends it.
GITEA_URL=https://git.example.org

# Only needed for private repositories, or if the instance requires sign-in to
# read. Gitea → Settings → Applications. Narrowest useful scopes:
# read:repository, read:issue.
GITEA_TOKEN=

# Organisation used when a repository is entered as a bare name.
GITEA_ORG=

# Optional: only for mirrors or the odd repository hosted on GitHub.
GITHUB_TOKEN=
GITHUB_ORG=

# hourly | daily | or a raw cron expression
GIT_SYNC_CRON=hourly
GIT_SYNC_TTL=55
GIT_MAX_ISSUES=25
GIT_HTTP_TIMEOUT=15

###############################################################################
# TaskStream — the issue tracker
###############################################################################
# `taskstream: true` on POST /v1/projects opens a public board there too.
# Both default to production.
TASKSTREAM_API_URL=https://api.taskstream.pireon.dev
TASKSTREAM_WEB_URL=https://taskstream.pireon.dev

# A Pireon personal access token (oauth.pireon.dev/tokens), only used when the
# caller signs in with a machine token (pmt_…), which TaskStream cannot read.
# People with a Pireon token have theirs passed on instead. Empty: machine
# tokens cannot ask for a board.
TASKSTREAM_TOKEN=
TASKSTREAM_HTTP_TIMEOUT=10