# Database
DB_HOST=localhost
DB_PORT=3306
DB_NAME=
DB_USER=
DB_PASS=
DB_SESSION_WAIT_TIMEOUT=

# Absolute deployment web root; leave empty to auto-detect public/, public_html/, www/, or htdocs/.
PUBLIC_PATH=

# Optional pre-bootstrap development gate. Generate the hash offline with:
# php -r "echo password_hash('replace-me', PASSWORD_DEFAULT), PHP_EOL;"
DEV_LOCK_ENABLED=0
DEV_LOCK_PASSWORD_HASH=

# Outgoing email defaults. Values saved in Settings > Email override these.
# "native" delegates to the local PHP/hosting mail transport.
MAIL_TRANSPORT=native
MAIL_FALLBACK_TRANSPORT=
MAIL_FROM_ADDRESS=
MAIL_FROM_NAME=Jyavani
MAIL_REPLY_TO=
MAIL_LOG=failures

# reCAPTCHA (v2 checkbox)
RECAPTCHA_SITEKEY=
RECAPTCHA_SECRET=

# Web Debug 1 for activate
APP_DEBUG=1

# Session / Cookie
SESSION_SAVE_PATH=
# Use a native Linux path when the project is served from /mnt/c.
THEME_OPERATION_LOCK_DIR=
# Plugin state also needs a native Linux path when DrvFS cannot fsync/chmod atomically.
PLUGIN_DISABLED_JSON=
# Update snapshots need atomic rename support; use a native Linux path on WSL /mnt projects.
UPDATE_STATUS_FILE=
# Optional signed local extension baseline. Configure all three; never deploy the private key.
SITE_HEALTH_DEPLOYMENT_MANIFEST_PATH=
SITE_HEALTH_DEPLOYMENT_PUBLIC_KEY=
SITE_HEALTH_DEPLOYMENT_SOURCE_REVISION=
SESSION_LIFETIME=604800
SESSION_IDLE_TIMEOUT=0
SESSION_COOKIE_SAMESITE=Lax

# Session cookie name (set sesuai proyek)
SESSION_NAME=app_session

# Cookie domain (kosongkan untuk host-only)
SESSION_COOKIE_DOMAIN=

# Paths where cookies are valid (use root)
SESSION_COOKIE_PATH=/

# Disable PHP automatic session cookie (we manage auth cookie manually on login)
SESSION_PHP_COOKIE_DISABLED=1

# Security / Debug. Production HTTPS: FORCE_HTTPS=1 and ALLOW_INSECURE=0.
# Local HTTP development requires the explicit 0/1 combination below.
SESSION_DEBUG=0
FORCE_HTTPS=0

# Allow insecure cookies even if FORCE_HTTPS=1 (dev only)
SESSION_ALLOW_INSECURE_COOKIES=1

# Strong random secret for stateless CSRF; generate sendiri
SESSION_SECRET=

# Token secret for private file signed URLs (optional — falls back to SESSION_SECRET)
PRIVATE_FILE_TOKEN_SECRET=

# Plugin install.sh runner (hard-capped by Core at 900 seconds / 1 MiB output)
PLUGIN_INSTALL_TIMEOUT_SECONDS=120
PLUGIN_INSTALL_OUTPUT_LIMIT=65536
