# ---------------------------------------------------------------------------
# iya.ru platform — environment configuration template
# Copy to `.env` (never commit the real .env) and adjust.
# Every value can also be provided as a real environment variable; real env
# vars always win over this file.
# ---------------------------------------------------------------------------

# --- application -----------------------------------------------------------
APP_ENV=development                 # production | staging | development
APP_DEBUG=true
APP_KEY=d790b821e8673150216247031777d438346ed398e913e15179bdb86e7ca7eed8                           # 64 hex chars; generate: php bin/iya key:generate
APP_URL=https://iya.ru
APP_NAME=iya.ru
APP_VERSION_AUTO=true
DEFAULT_TIMEZONE=UTC
DEFAULT_LOCALE=en
SUPPORTED_LOCALES=en,ru,uk,be,de,fr,es,it,pt,nl,pl,tr,ar,he,fa,hi,bn,zh,ja,ko,vi,th,sv,no,da,fi,cs,sk,sl,ro,hu,el,bg,hr,sr,lt,lv,et,is,ga,mt,fil

# --- domains ---------------------------------------------------------------
APEX_DOMAIN=iya.ru
WWW_DOMAIN=www.iya.ru
SWARM_HOST=agent-swarm.iya.ru
# comma separated: language subdomains, system names, reserved words
RESERVED_SUBDOMAINS=www,api,admin,app,dashboard,mail,email,smtp,imap,pop,pop3,ftp,files,static,assets,cdn,dev,staging,test,beta,new,old,help,support,docs,doc,status,stats,analytics,agent,agents,agent-swarm,swarm,bot,bots,llm,ai,about,aboutus,contact,login,logout,register,signup,signin,auth,oauth,oauth2,user,users,account,accounts,profile,me,my,settings,security,privacy,terms,tos,legal,billing,pay,payment,pricing,plans,blog,news,press,media,careers,jobs,shop,store,buy,sell,market,marketplace,forum,community,chat,telegram,discord,slack,webhook,webhooks,events,queue,worker,cron,monitor,monitoring,metrics,grafana,kibana,phpmyadmin,mysql,db,database,cache,redis,memcached,search,elastic,git,gitlab,github,svn,jenkins,ci,cd,deploy,backup,bak,tmp,temp,cache2,ns1,ns2,ns3,ns4,dns,ns,vpn,proxy,tor,onion,ip,ips,geo,geoip,whois,ping,traceroute,net,network,host,hosts,server,servers,root,superuser,sysadmin,administrator,god,null,undefined,nan,true,false,yes,no,on,off,public,private,secret,hidden,anonymous,anon,guest,demo,example,sample,template,test1,test2,localhost,localdomain,broadcasthost,iana,ietf,rfc,ipv4,ipv6,ssl,tls,http,https,ws,wss,robots,sitemap,favicon,manifest,sw,serviceworker,pwa,offline,online,redirect,go,link,links,short,shortener,url,uri,page,pages,site,web,webmaster,postmaster,hostmaster,abuse,noc,security,info,information,data,export,import,upload,downloads,download,api1,api2,v1,v2,v3,lang,langs,language,languages,translate,i18n,l10n,theme,themes,dark,light

# --- database --------------------------------------------------------------
# sqlite (development / zero-ops) or mysql (production)
DB_DRIVER=sqlite
DB_SQLITE_PATH=var/data/iya.sqlite3
DB_HOST=127.0.0.1
DB_PORT=3306
DB_NAME=iya
DB_USER=iya
DB_PASS=
DB_CHARSET=utf8mb4
DB_COLLATION=utf8mb4_0900_ai_ci
DB_SOCKET=

# --- trusted proxies / client IP (CRITICAL) --------------------------------
# Only these peers may supply X-Forwarded-For / X-Real-IP / CF-Connecting-IP.
# Leave empty => the socket peer address is used (ip_method=direct).
TRUSTED_PROXIES=127.0.0.0/8,::1/128,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
TRUST_PROXY_HEADER_XFF=true
TRUST_PROXY_HEADER_REAL_IP=true
TRUST_PROXY_HEADER_CF=true
IP_INTERNAL_HEADER=X-Internal-Client-IP
GEOIP_DRIVER=offline               # offline | ipapi | maxmind
GEOIP_TOKEN=
GEOIP_DATABASE=var/data/GeoLite2-City.mmdb
GEOIP_CACHE_TTL=604800
# --- IP intelligence (AbuseIPDB) -------------------------------------------
# Runtime config lives in the settings table (Admin → Settings); the env key
# below is only a headless fallback for the API key.
ABUSEIPDB_KEY=
IP_HASH_PEPPER=                    # defaults to APP_KEY when empty

# --- security --------------------------------------------------------------
SESSION_NAME=iya_session
SESSION_LIFETIME=1209600
COOKIE_DOMAIN=
COOKIE_SECURE=false
COOKIE_SAMESITE=Lax
PASSWORD_ALGO=argon2id
ARGON2_MEMORY_COST=65536
ARGON2_TIME_COST=4
ARGON2_THREADS=1
ADMIN_IP_ALLOWLIST=
ADMIN_REQUIRE_2FA=false   # dev convenience; production must keep true
CSRF_EXEMPT_PATHS=/api/,/tracker/,/theme/,/lang/,/embed/
CSP_ENABLED=true
CSP_REPORT_URI=
HSTS_MAX_AGE=31536000
HSTS_INCLUDE_SUBDOMAINS=true
HSTS_PRELOAD=false
PERMISSIONS_POLICY=geolocation=(), microphone=(), camera=(), payment=(), usb=(), interest-cohort=()
REFERRER_POLICY=strict-origin-when-cross-origin
ENABLE_CAPTCHA=false
CAPTCHA_DRIVER=hcaptcha
CAPTCHA_SITE_KEY=
CAPTCHA_SECRET=
BRUTEFORCE_MAX_ATTEMPTS=8
BRUTEFORCE_WINDOW=900
BRUTEFORCE_LOCKOUT=1800

# --- rate limits (requests per window seconds) -----------------------------
RATE_LIMIT_DEFAULT=600:60
RATE_LIMIT_AUTH=20:900
RATE_LIMIT_API=600:60
# dev-relaxed for repeatable smoke runs; production default is 20:3600
RATE_LIMIT_SWARM_REGISTER=10000:3600
RATE_LIMIT_SWARM_WRITE=600:60
RATE_LIMIT_SWARM_READ=3000:60
RATE_LIMIT_TRACK=120:60
RATE_LIMIT_REDIRECT=600:60

# --- privacy / analytics ---------------------------------------------------
PRIVACY_MODE_DEFAULT=standard      # minimal | standard | extended | anonymous
PRIVACY_CONSENT_REQUIRED=true
VISIT_RETENTION_DAYS=730
VISIT_RAW_RETENTION_DAYS=90
ANONYMIZE_IP_AFTER_DAYS=30
ROLLUP_INTERVAL=300
REALTIME_WINDOW=3600
SSE_WINDOW_SEC=30                # seconds per SSE connection (client auto-reconnects)
TRACKER_ENABLED=true
TRACKER_RESPECT_DNT=true
TRACKER_RESPECT_GPC=true
VISIT_CAPTURE_ENABLED=true         # master switch for the analytics pipeline
VISIT_UNIQUE_WINDOW=1800           # seconds; a visitor counts as unique once per window
VISIT_FILTER_BOTS=false            # true => bot visits are stored with status 'filtered'
THREAT_DETECTION_ENABLED=true      # request scanner (legacy HackDetectionService, reorganised)
THREAT_SUSPICIOUS_SCORE=5          # score >= this marks a visit 'suspicious'
THREAT_BLOCK_SCORE=12              # score >= this marks a visit 'blocked'
THREAT_BODY_SCAN_BYTES=16384       # cap for body inspection on the hot path

# --- links / tenants -------------------------------------------------------
LINKS_PER_PAGE=25
MAX_LINKS_FREE=500
MAX_SUBDOMAINS_FREE=1
SUBDOMAIN_MIN_LENGTH=3
SUBDOMAIN_MAX_LENGTH=32
LINK_SLUG_MAX_LENGTH=96
ALLOW_CUSTOM_DOMAINS=false
SCREENSHOT_ENABLED=false

# --- agent swarm -----------------------------------------------------------
SWARM_ENABLED=true
SWARM_MAX_DEPTH=6
SWARM_TOKEN_TTL_DAYS=3650
SWARM_ALLOW_ANONYMOUS_REGISTER=true
SWARM_MESSAGE_MAX_BYTES=65536
SWARM_SECTION_MAX_PER_AGENT=200
SWARM_PUBLIC_CATALOG=true

# --- outbound / notifications ---------------------------------------------
MAIL_DRIVER=log                    # log | smtp | sendmail
MAIL_HOST=
MAIL_PORT=587
MAIL_USER=
MAIL_PASS=
MAIL_FROM=no-reply@iya.ru
MAIL_FROM_NAME=iya.ru
MAIL_ENCRYPTION=tls
TELEGRAM_ENABLED=false
TELEGRAM_BOT_TOKEN=
WEBHOOK_ENABLED=true
WEBHOOK_TIMEOUT=8
WEBHOOK_BLOCK_PRIVATE=true
SSRF_BLOCK_PRIVATE=true

# --- oauth (disabled unless client id/secret are set) ----------------------
OAUTH_GOOGLE_ENABLED=false
OAUTH_GOOGLE_CLIENT_ID=
OAUTH_GOOGLE_CLIENT_SECRET=
OAUTH_GITHUB_ENABLED=false
OAUTH_GITHUB_CLIENT_ID=
OAUTH_GITHUB_CLIENT_SECRET=
OAUTH_YANDEX_ENABLED=false
OAUTH_YANDEX_CLIENT_ID=
OAUTH_YANDEX_CLIENT_SECRET=
OAUTH_VK_ENABLED=false
OAUTH_VK_CLIENT_ID=
OAUTH_VK_CLIENT_SECRET=

# --- feature flags (comma separated list of enabled flags) -----------------
FEATURE_FLAGS=dashboard,analytics,swarm,teams,qr,export,pwa,billing-readonly

# --- maintenance -----------------------------------------------------------
MAINTENANCE_MODE=false
COMING_SOON=false

# --- development helpers ---------------------------------------------------
DEV_ALLOW_HOST_OVERRIDE=true       # allows ?_host= in non-production only
DEV_SEED_DEMO=false

TARGET_CHECK_BUDGET=0
