# -----------------------------------------------------------------------------
# Reseller Portal - environment template
# Copy to .env and adjust. NEVER commit .env (it holds secrets).
# -----------------------------------------------------------------------------

APP_NAME="Reseller Portal"
# local | staging | production
APP_ENV=local
# Generate with: php artisan key:generate
APP_KEY=base64:YQprOJK/zHc+aK82xdG26nmhyk4CQZoDzPnF1WtaAwo=
# MUST be false in production (never expose stack traces / SQL / paths)
APP_DEBUG=true
APP_URL=http://127.0.0.1:8000

APP_LOCALE=en
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file

# Default display timezone used until changed in Administration > Settings.
# All timestamps are STORED in UTC; this only affects how they are displayed.
PORTAL_TIMEZONE=America/New_York

# Password hashing: argon2id (preferred) or bcrypt
HASH_DRIVER=argon2id
BCRYPT_ROUNDS=12

LOG_CHANNEL=stack
LOG_STACK=daily
LOG_DEPRECATIONS_CHANNEL=null
# Use "warning" or "error" in production
LOG_LEVEL=debug
LOG_SECURITY_STACK=security_file

# MySQL 8.x (production target) or MariaDB 10.4+ (XAMPP) - both use the mysql driver
DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=sub_reseller_portal
DB_USERNAME=root
DB_PASSWORD=

# Sessions are stored in the database (no Redis). SESSION_LIFETIME is the hard
# idle cap in minutes; the in-app idle/absolute timeouts are set in Settings.
SESSION_DRIVER=database
SESSION_LIFETIME=120
SESSION_ENCRYPT=true
SESSION_PATH=/
SESSION_DOMAIN=null
# Production (HTTPS): SESSION_SECURE_COOKIE=true
SESSION_SECURE_COOKIE=false
SESSION_HTTP_ONLY=true
SESSION_SAME_SITE=lax

BROADCAST_CONNECTION=log
FILESYSTEM_DISK=local
# Database queue (no Redis). Run "php artisan queue:work" if jobs are queued.
QUEUE_CONNECTION=database

# Database or file cache only (no Redis)
CACHE_STORE=database
# CACHE_PREFIX=

# Development: emails (e.g. password reset links) are written to storage/logs
MAIL_MAILER=log
MAIL_SCHEME=null
MAIL_HOST=127.0.0.1
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_FROM_ADDRESS="no-reply@example.com"
MAIL_FROM_NAME="${APP_NAME}"

# Send HSTS header (only effective over HTTPS). Enable in production.
SECURITY_HSTS=false

VITE_APP_NAME="${APP_NAME}"
