|
1 | | -### .env.example |
2 | | -### Copy this file to .env.local (or .env.development or .env.production) |
3 | | -### Set the values as needed. |
4 | | -### Do not commit .env.local to version control, as it may contain sensitive information. |
5 | | -### In production, API_BASE_PATH must be set, other variables are optional. |
6 | | -### In development, the variables are used to launch the API and the Unit Test server, |
7 | | -### and to help them connect to each other. |
8 | | - |
9 | | -### Set the same value for WS_PORT in the Unit Test frontend project folder. |
10 | | -### For more information, see https://github.com/Liturgical-Calendar/LiturgicalCalendarAPI/blob/development/public/LitCalTestServer.php |
| 1 | +# Copy this file to .env.local (or .env.development or .env.production) |
| 2 | +# Do not commit .env.local to version control, as it may contain sensitive information. |
| 3 | +# In production, API_BASE_PATH must be set; other variables are optional. |
| 4 | +# In development, the variables are used to launch the API and the Unit Test server. |
| 5 | + |
| 6 | +# valid values: development, test, staging, production |
| 7 | +APP_ENV=development |
| 8 | + |
| 9 | +## |
| 10 | +# WebSocket Configuration |
| 11 | +# Set the same value for WS_PORT in the Unit Test frontend project folder |
| 12 | +# See: https://github.com/Liturgical-Calendar/LiturgicalCalendarAPI/blob/development/public/LitCalTestServer.php |
| 13 | +## |
11 | 14 | WS_PORT=8080 |
| 15 | +# Maximum concurrent HTTP requests for WebSocket server (default: 10 in production, 4 in development) |
| 16 | +# Reduce this on memory-constrained servers to prevent overwhelming the API |
| 17 | +WS_MAX_CONCURRENCY=10 |
12 | 18 |
|
13 | | -# Set the protocol to use for the API (default: "http") |
| 19 | +## |
| 20 | +# API Configuration |
| 21 | +# These variables control where the API launches and how the Unit Test server connects to it |
| 22 | +## |
14 | 23 | API_PROTOCOL=http |
15 | | - |
16 | | -# Set the hostname or IP address to use for the API (default: "localhost") |
17 | 24 | API_HOST=localhost |
18 | | - |
19 | | -# Set the port number to use for the API (default: "8000") |
20 | | -# This will determine the port on which 'composer start' will launch the API. |
21 | | -# It will also instruct the Unit Test server on the port on which it should look for the API. |
22 | | -# If launching the API from VSCode tasks, make sure to set the same value in the tasks.json file. |
| 25 | +# This determines the port on which 'composer start' will launch the API |
| 26 | +# It also instructs the Unit Test server on which port to look for the API |
| 27 | +# If launching from VSCode tasks, set the same value in tasks.json |
23 | 28 | API_PORT=8000 |
| 29 | +# API Base Path - required in production or if dev server is not launched from public folder |
| 30 | +# The API cannot infer whether its path is `/api/` or `/api/{version}/` |
| 31 | +# In local development, leave empty (API runs at root) |
| 32 | +# In production, typically /api/dev or /api/v5 |
| 33 | +API_BASE_PATH= |
24 | 34 |
|
25 | | -# Set the base path for the API (default: "/") |
26 | | -# Required in production or if the development server is not launched from the public folder. |
27 | | -# This value is needed for the Unit Test server to connect to the API, |
28 | | -# and for the API to know the base path which it cannot infer otherwise. |
29 | | -# It cannot know if the API path is `/`, `/api/` or `/api/{version}/`. |
30 | | -# Please include a trailing slash for the API_BASE_PATH in any case. |
31 | | -API_BASE_PATH=/ |
32 | | - |
33 | | -# Valid values: development | test | staging | production (optional) |
34 | | -APP_ENV=development |
35 | | - |
| 35 | +## |
36 | 36 | # JWT Authentication Configuration |
37 | | -# IMPORTANT: Change JWT_SECRET to a strong random string in production (minimum 32 characters) |
38 | | -# Generate a secure 64-character hex string with: php -r "echo bin2hex(random_bytes(32));" |
| 37 | +# Generate a secure 64-character hex string: php -r "echo bin2hex(random_bytes(32));" |
| 38 | +## |
39 | 39 | JWT_ALGORITHM=HS256 |
40 | 40 | JWT_EXPIRY=3600 |
41 | 41 | JWT_REFRESH_EXPIRY=604800 |
| 42 | +# IMPORTANT: Change to a strong random string in production (minimum 32 characters) |
42 | 43 | JWT_SECRET=change-this-to-a-secure-random-string-in-production-minimum-32-chars |
43 | 44 |
|
44 | | -# Admin User Credentials (for initial JWT implementation) |
45 | | -# IMPORTANT: Change these in production! |
46 | | -# Generate password hash with: php -r "echo password_hash('your-password', PASSWORD_ARGON2ID);" |
47 | | -# In development/test environments, if ADMIN_PASSWORD_HASH is missing or invalid, |
48 | | -# authentication falls back to the default password "password". |
49 | | -# In staging/production, a valid ADMIN_PASSWORD_HASH is required. |
50 | | -ADMIN_PASSWORD_HASH=CHANGE_ME_GENERATE_WITH_password_hash |
| 45 | +## |
| 46 | +# Admin User Credentials |
| 47 | +# Generate password hash: php -r "echo password_hash('your-password', PASSWORD_ARGON2ID);" |
| 48 | +# In dev/test: falls back to default password "password" if hash is missing/invalid |
| 49 | +# In staging/production: a valid ADMIN_PASSWORD_HASH is required |
| 50 | +## |
51 | 51 | ADMIN_USERNAME=admin |
| 52 | +ADMIN_PASSWORD_HASH=CHANGE_ME_GENERATE_WITH_password_hash |
| 53 | + |
| 54 | +## |
| 55 | +# CORS Configuration |
| 56 | +# Comma-separated list of allowed origins for credentialed CORS requests (auth endpoints) |
| 57 | +# Use '*' to allow all origins (not recommended for production with cookie-based auth) |
| 58 | +# Example: https://example.com,https://admin.example.com |
| 59 | +## |
| 60 | +CORS_ALLOWED_ORIGINS=* |
| 61 | + |
| 62 | +## |
| 63 | +# Rate Limiting for Authentication |
| 64 | +# Protects against brute-force attacks on the /auth/login endpoint |
| 65 | +## |
| 66 | +# Maximum failed login attempts before lockout (default: 5) |
| 67 | +RATE_LIMIT_LOGIN_ATTEMPTS=5 |
| 68 | +# Time window in seconds for tracking attempts (default: 900 = 15 minutes) |
| 69 | +RATE_LIMIT_LOGIN_WINDOW=900 |
| 70 | +# Path for rate limit data files (default: system temp directory) |
| 71 | +# RATE_LIMIT_STORAGE_PATH=/var/lib/litcal/rate_limits |
| 72 | + |
| 73 | +## |
| 74 | +# HTTPS Enforcement |
| 75 | +# In staging/production, auth endpoints require HTTPS by default |
| 76 | +# Set to "false" to disable (e.g., if TLS is terminated at load balancer) |
| 77 | +# When using a reverse proxy, ensure it sets X-Forwarded-Proto header |
| 78 | +## |
| 79 | +HTTPS_ENFORCEMENT=true |
| 80 | + |
| 81 | +## |
| 82 | +# Redis Configuration (for WebSocket server caching) |
| 83 | +# Uses Redis (or APCu fallback) for caching |
| 84 | +# Configure either Unix socket OR TCP connection (socket takes precedence) |
| 85 | +# If not configured, defaults to TCP 127.0.0.1:6379 |
| 86 | +## |
| 87 | +# Unix socket connection (recommended for local Redis): |
| 88 | +# REDIS_SOCKET=/var/run/redis/redis.sock |
| 89 | +# TCP connection: |
| 90 | +# REDIS_HOST=127.0.0.1 |
| 91 | +# REDIS_PORT=6379 |
0 commit comments