# ─── Environment ────────────────────────────────────────────────────────────
# 'dev' enables error display. 'prod' is silent.
APP_ENV=dev

# Public base URL used by base_url() helpers and email links.
APP_BASE_URL=https://fitme3070.pt/

# ─── Branding ───────────────────────────────────────────────────────────────
# Selects assets/css/branding-<BRAND>.css for both the backoffice header and
# the public site head. Files are committed; falls back to `fitme3070`.
BRAND=fitme3070

# ─── Database (local fitme3070) ─────────────────────────────────────────────
DB_HOST=127.0.0.1
DB_PORT=3306
DB_NAME=fitme3070
DB_USER=root
DB_PASS=

# ─── Email / SMTP ───────────────────────────────────────────────
# This app sends its own mail again (PHPMailer over SMTP) — nothing is relayed
# through the hub any more. Anything set here WINS over the same setting in
# Sistema → Comunicações, so leave these blank if you want to manage SMTP from
# the backoffice. Empty SMTP_HOST falls back to PHP's mail().
SMTP_HOST=
SMTP_PORT=587
SMTP_SECURE=tls
SMTP_USERNAME=
SMTP_PASSWORD=

# ─── Encryption key for settings stored in the DB ─────────────────────────
# smtp_password / twilio_token are AES-256-GCM encrypted at rest so they are not
# readable in a database dump. Without a key they are stored in plain text and
# the Comunicações page warns about it. Any long random string works.
# (BACKUP_TOKEN is used as a fallback when this is unset.)
APP_SECRET_KEY=

# ─── Twilio (SMS / WhatsApp) — optional ───────────────────────────────
# Leave empty unless the sms/whatsapp channels are actually used. Email works
# without them.
TWILIO_SID=
TWILIO_TOKEN=
TWILIO_SMS_FROM=
TWILIO_WHATSAPP_FROM=

# ─── Dev safety nets (ignored when APP_ENV=prod) ───────────────────────
# EMAIL_DEV_REDIRECT — send every message here instead of the real recipient.
# EMAIL_DEV_PRINT    — skip SMTP entirely, log to logs/message_dev.log. Wins.
EMAIL_DEV_REDIRECT=
EMAIL_DEV_PRINT=false

# ─── Cron ────────────────────────────────────────────────────────
# cron.php drains the message queue every 5 minutes. Over the shell no token is
# needed. Over HTTP it is the only protection, and cron.php answers 404 until it
# is set to something other than replace_me:
#   */5 * * * * curl -fsS "https://fitme3070.pt/cron.php?token=<CRON_TOKEN>"
CRON_TOKEN=replace_me

# ─── Hub social content endpoint (api/hub-content.php) ─────────────────────────
# Shared secret the hub social-post generator signs its pull requests with.
# Generated on id.andmore.pt → Plataformas → fitme3070 → "Gerar segredo de
# conteúdo", and registered there as this platform's content_secret with the
# content_endpoint pointing at {APP_BASE_URL}api/hub-content.php. Empty disables
# the endpoint (503).
HUB_CONTENT_SECRET=

# ─── Git HTTP authentication (views/sysadmin/platform_update.php) ──────────────
GIT_HTTP_USERNAME=
GIT_HTTP_TOKEN=