###############################################################################
# PropertyHUB -- PRODUCTION environment for https://propertyhubeg.com (cPanel)
#
# CONTAINS PASSWORDS. Git-ignored. Never put it in the release zip and never
# commit it. Send it to IT privately; on the server it is saved as
# /home/propertyhub/propertyhub/.env (named exactly `.env`).
#
# Still to fill in ON THE SERVER, marked TODO below:
#   1. APP_KEY              -> run `php artisan key:generate --force` once,
#                              then back the key up OFF the server. Losing it
#                              makes every admin's 2FA secret unreadable.
#   2. DB_HOST / DB_PORT    -> pending IT's PostgreSQL answer (needs 13+,
#                              built on 16). 127.0.0.1:5432 if installed locally.
#   3. ADMIN_SEED_PASSWORD  -> first deploy only, 10+ characters, then delete
#                              the value and run `php artisan config:cache`.
#
# After ANY edit to this file on the server: php artisan config:cache
###############################################################################

APP_NAME=PropertyHUB
APP_ENV=production
# TODO 1 -- generated on the server by `php artisan key:generate --force`.
APP_KEY=
APP_DEBUG=false
APP_URL=https://propertyhubeg.com

# Empty on purpose: the site is at the domain root, so assets load from /build.
ASSET_URL=

# BR-01 -- the clock is UTC; business dates are Africa/Cairo. Never change APP_TIMEZONE.
APP_TIMEZONE=UTC
TIMEZONE_BUSINESS=Africa/Cairo

APP_LOCALE=ar
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=ar_EG

# One origin serves the portal, the dashboard and /api/v1.
FRONTEND_PORTAL_URL=https://propertyhubeg.com
FRONTEND_ADMIN_URL=https://propertyhubeg.com
SANCTUM_STATEFUL_DOMAINS=propertyhubeg.com,www.propertyhubeg.com

# MUST stay empty (host-only cookie). Redirect www to the bare domain (or the
# reverse) in cPanel so visitors always land on one host.
SESSION_DOMAIN=
# NFR-27 -- the site is HTTPS-only, so the session cookie is Secure.
SESSION_SECURE_COOKIE=true
ADMIN_SESSION_IDLE_MINUTES=30
ADMIN_SESSION_ABSOLUTE_HOURS=12

# nginx sits in front of Apache on this host. If the audit log shows every
# visitor as 127.0.0.1 after go-live, set this to 127.0.0.1.
TRUSTED_PROXIES=

# Daily files, kept 14 days -- the account quota is 4 GB.
LOG_CHANNEL=stack
LOG_STACK=daily
LOG_DAILY_DAYS=14
LOG_LEVEL=info

# --- Database ----------------------------------------------------------------
DB_CONNECTION=pgsql
# TODO 2 -- pending IT's PostgreSQL answer.
DB_HOST=127.0.0.1
DB_PORT=5432
DB_DATABASE=propertyhub_dbhub
DB_USERNAME=propertyhub_user_hub
DB_PASSWORD="aj)[rO6yZ]ZY3vO{"

# --- Cache / Queue / Session -------------------------------------------------
# No Redis and no queue worker on cPanel. Mail and reindexing run inline (sync);
# photo encoding (FR-124) is queued in the database and the every-minute cron
# (`schedule:run`) drains it. Without that cron, photos never get resized.
CACHE_STORE=database
QUEUE_CONNECTION=sync
MEDIA_QUEUE_CONNECTION=database
SESSION_DRIVER=database
SESSION_LIFETIME=120

# Unused until IT offers Redis.
REDIS_CLIENT=predis
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_PASSWORD=null

# --- Search --------------------------------------------------------------------
# Empty = FR-103's PostgreSQL search. No Meilisearch on this host.
MEILISEARCH_HOST=
MEILISEARCH_KEY=
MEILISEARCH_INDEX_PREFIX=properties

# --- Media ---------------------------------------------------------------------
# `php artisan storage:link` once after the first deploy.
FILESYSTEM_DISK=public
MEDIA_PRIVATE_DISK=local
MEDIA_ORIGINALS_DISK=local
MEDIA_URL=https://propertyhubeg.com/storage
PROPERTY_MEDIA_MAX_MB=12

CSP_IMAGE_HOSTS=
CSP_FRAME_HOSTS=

# --- Mail --------------------------------------------------------------------
# cPanel mailbox on this same server, implicit TLS on 465.
MAIL_MAILER=smtp
MAIL_HOST=mail.propertyhubeg.com
MAIL_PORT=465
MAIL_SCHEME=smtps
MAIL_USERNAME="info@propertyhubeg.com"
MAIL_PASSWORD="ET46iy0fobgSi-JR"
MAIL_TIMEOUT=10
MAIL_FROM_ADDRESS="info@propertyhubeg.com"
MAIL_FROM_NAME="Property Hub EG"

# --- Google sign-in (FR-55) -- off until a client id is issued -----------------
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_REDIRECT_URI=https://propertyhubeg.com/api/v1/auth/google/callback

# --- Security ----------------------------------------------------------------
AUTH_THROTTLE_ATTEMPTS=5
AUTH_THROTTLE_DECAY_SECONDS=60
AUTH_LOCKOUT_BASE_SECONDS=60
AUTH_LOCKOUT_MAX_SECONDS=3600
AUTH_VERIFY_LINK_MINUTES=1440
AUTH_RESET_LINK_MINUTES=60
AUTH_PASSWORD_MIN_LENGTH=10
AUTH_PASSWORD_BREACH_CHECK=true
AUTH_2FA_REQUIRED_ROLES=admin

# --- First administrator (StaffSeeder) -- FIRST DEPLOY ONLY ----------------------
# TODO 3 -- choose a password (10+ characters) just before `php artisan db:seed --force`.
# Left empty, the seeder skips with a warning and nobody can sign in.
# Afterwards: sign in, enrol the authenticator app (NFR-25), DELETE the value
# below, and run `php artisan config:cache`.
ADMIN_SEED_NAME="System Administrator"
ADMIN_SEED_EMAIL=info@propertyhubeg.com
ADMIN_SEED_PASSWORD=

# --- Domain defaults (all overridable in Settings) ---------------------------
BASE_CURRENCY=EGP
BOOKING_HOLD_WINDOW_HOURS=24
BOOKING_AUTO_CONFIRM_ON_EXPIRY=false
CATERING_CUTOFF_TIME=18:00
CATERING_DELIVERY_TIME=14:00
WEEKEND_DAYS=4,5
SUPPORTED_LOCALES=ar,en
ADMIN_BILINGUAL=true

# --- Inertia SSR -- OFF at launch (no permanent Node process on cPanel) ---------
# Do NOT switch this on without running workers: SSR enabled but down answers
# search-engine crawlers 503 on every public page.
INERTIA_SSR_ENABLED=false
INERTIA_SSR_URLS=http://127.0.0.1:13714/render,http://127.0.0.1:13724/render
INERTIA_SSR_HEALTH_URLS=http://127.0.0.1:13715/health,http://127.0.0.1:13725/health
INERTIA_SSR_TIMEOUT_MS=3000
INERTIA_SSR_RENDER_BUDGET_MS=120

# --- Full-page cache (C-1a) -- off at launch ---------------------------------
FULL_PAGE_CACHE_STORE=false
FULL_PAGE_CACHE_SERVE=false
FULL_PAGE_CACHE_TTL=300

# --- FR-62 owner-submission CAPTCHA (Cloudflare Turnstile) -- off until keys ---
TURNSTILE_SITE_KEY=
TURNSTILE_SECRET=

# --- Privacy retention (NFR-34) ----------------------------------------------
PRIVACY_RETENTION_LEAD_MONTHS=36
PRIVACY_RETENTION_UNVERIFIED_SUBMISSION_DAYS=90
PRIVACY_RETENTION_ANALYTICS_MONTHS=14
PRIVACY_RETENTION_LOGIN_ATTEMPT_MONTHS=12
PRIVACY_RETENTION_MAIL_DELIVERY_MONTHS=12

# --- Observability -----------------------------------------------------------
AUDIT_RETENTION_MONTHS=24
MAINTENANCE_MODE_MESSAGE=
