.env.example

APP_NAME="Cbox ID"
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://localhost

# ── Cbox ID ─────────────────────────────────────────────────────────────────
# REQUIRED. Master key for envelope encryption (signing keys, sealed secrets).
# Generate one and paste it here — losing it makes sealed secrets unrecoverable:
#   php -r "echo base64_encode(random_bytes(32)).PHP_EOL;"
CBOX_ID_CRYPTO_KEY=

# Token issuer / OIDC discovery base URL. Defaults to APP_URL when blank.
# The shared secret that makes GET /health/ready reachable. WITHOUT IT READINESS
# ANSWERS 403 IN PRODUCTION: the endpoint falls back to "are we running locally",
# which is false everywhere that matters — so the one probe that checks the
# database, cache, queue and storage cannot be called, and an instance with a bad
# password or an unapplied migration deploys green because /up (liveness) asserts
# nothing by design. Set it, and point the platform's readiness probe at
# /health/ready?token=…
HEALTH_TOKEN=

CBOX_ID_ISSUER=

# WebAuthn / passkeys: registrable domain + exact browser origin.
CBOX_ID_WEBAUTHN_RP_ID=localhost
CBOX_ID_WEBAUTHN_ORIGIN="${APP_URL}"

# Multi-tenancy is a mode you switch ON. The default shape of this product is a
# single-tenant identity provider: one install, one IdP, one host. Turning this on
# adds the account plane that provisions workspaces and IdPs, tenant subdomains,
# and billing.
#
# It also decides whether the host bulkheads exist: in the single-tenant shape every
# host is the subject and operator plane. Leave this UNSET only on an existing
# install — unset falls back to inferring the mode from BASE_DOMAINS below, which is
# a compatibility default, not a design.
CBOX_ID_MULTI_TENANT=false

# Where the ACCOUNT console lives when multi-tenancy is on — sign in, manage
# workspaces/IdPs, billing. Its own setting because it is its own fact: multi-tenancy
# without subdomains is a real shape (every tenant on its own domain, resolved by exact
# match, BASE_DOMAINS empty), and there the account host cannot be derived from anything.
# Leave unset in the subdomain shape and it falls back to the first base domain.
CBOX_ID_CONSOLE_HOST=

# Environments (multi-tenant planes). `DEFAULT` is the fallback plane key for a
# single-tenant/on-prem install. `BASE_DOMAINS` (comma list) enables subdomain →
# environment resolution ONLY under those domains (e.g. auth.example.com).
CBOX_ID_ENVIRONMENT_DEFAULT=
CBOX_ID_ENVIRONMENT_BASE_DOMAINS=

# Prometheus metrics. OFF, and refused from every address when on unless you name one —
# an empty allow-list means "everybody" to the underlying package, and this endpoint
# arrived transitively rather than by choice. Set both together or not at all.
PROMETHEUS_ENABLED=false
PROMETHEUS_ALLOWED_IPS=

# Self-service signup: open | invite_only | closed.
CBOX_ID_SIGNUP_MODE=open

# The Frontend API: publishable keys, the origin allow-list, and the embedded sign-in
# endpoints an SDK on a customer's own page calls. OFF unless you say otherwise — it is the
# one channel where an anonymous cross-origin caller can offer a password, and a channel
# that appears on upgrade is one nobody reviewed. Turn it on and mint a key under
# Developers → Frontend keys; a key is useless from any origin its owner did not name.
CBOX_ID_FRONTEND_API=false

# Bot protection for signup (optional). Cloudflare Turnstile is shown ONLY on a signup
# the risk scorer challenges, and only when RISK_MODE=enforce. Leave both empty and the
# feature does not exist: no widget, no third-party script, no CSP exception.
CBOX_ID_TURNSTILE_SITE_KEY=
CBOX_ID_TURNSTILE_SECRET_KEY=

# How long a recorded risk decision is kept, in days. `risk_decisions` is the durable
# trail every score is written to, and the evidence an enforcement threshold is set
# from — see docs/security/adaptive-risk.md for the queries. Swept daily by
# `model:prune`. Leave EMPTY to keep the trail indefinitely.
CBOX_ID_RISK_TRAIL_RETENTION_DAYS=90

# REST management API rate limits, in requests per minute PER API KEY (not per IP —
# a CI runner behind a shared NAT gets its own allowance instead of sharing one with
# every other tenant on that address). CBOX_ID_API_RATE_LIMIT_IP_MULTIPLIER is the
# abuse backstop: a per-IP ceiling at this multiple of the plane budget, which bounds
# a flood of distinct INVALID credentials. Set it to 0 to disable the backstop.
CBOX_ID_API_RATE_LIMIT_ORGANIZATION=120
CBOX_ID_API_RATE_LIMIT_ENVIRONMENT=240
CBOX_ID_API_RATE_LIMIT_VAULT=120
CBOX_ID_API_RATE_LIMIT_APPS=60
CBOX_ID_API_RATE_LIMIT_IP_MULTIPLIER=10

# Entitlements. `open` (the default) means an unset entitlement is GRANTED: no
# billing plane, no limits, every feature available — which is what a self-hosted
# deployment wants. Writing an entitlement by hand still works and still wins, so
# per-organization differentiation (including revoking with `enabled: false`) is
# available if you want it.
#
# Set `metered` only where a billing transport is actually wired: it restores
# deny-by-default, and the billing projection becomes the only thing that grants.
CBOX_ID_ENTITLEMENTS=open

# The namespaced keys the SSO/SCIM console screens read. Under `metered` these must
# match what your billing system pushes.
CBOX_ID_ENTITLEMENT_SSO=cbox-id-sso
CBOX_ID_ENTITLEMENT_SCIM=cbox-id-scim

# Admin Portal setup links (the "invite your IT admin" flow): how
# long a single-use link stays redeemable, in minutes.
CBOX_ID_PORTAL_TTL_MINUTES=30

# Analytics event store. `none` (the default) writes nothing and the dashboards read
# the platform's own usage counters. `database` stores one row per delivered domain
# event in `id_analytics_events` and reads the dashboards from there — the right
# answer at low volume, and the only one available with no column store to point at.
# A ClickHouse DSN (below) always wins over this.
#
# `database` is a ROW store: growth shows up as dashboard latency, not wrong numbers,
# and that latency is the signal to move to ClickHouse. RETENTION_DAYS is enforced by
# the daily `model:prune`; this is the one table that grows with TRAFFIC rather than
# with tenants, so do not run it without the scheduler.
CBOX_ID_ANALYTICS_STORE=none
CBOX_ID_ANALYTICS_ENABLED=false

# Trusted devices + push approvals. Off by default: with no mobile app enrolled
# there is nothing to notify, and the CIBA push decorator should not sit in the
# login path doing nothing. Turning it on without a transport is still safe.
CBOX_ID_DEVICES_ENABLED=false
CBOX_ID_DEVICES_TRANSPORT=none
CBOX_ID_ANALYTICS_RETENTION_DAYS=365

# Optional column store for high volume. Set a DSN and both the sink and the reader
# switch to ClickHouse; leave it empty and the app never speaks to one.
CBOX_ID_ANALYTICS_CLICKHOUSE_DSN=

# Whole-product branding (optional — override the wordmark/hero without editing
# Blade). Leave TRUST_LINE empty unless the claim is actually true for you.
CBOX_ID_BRAND_NAME="Cbox ID"
CBOX_ID_BRAND_TAGLINE="One identity layer for every app you ship."
CBOX_ID_BRAND_TRUST_LINE=
# ─────────────────────────────────────────────────────────────────────────────

APP_LOCALE=en
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file
# APP_MAINTENANCE_STORE=database

# PHP_CLI_SERVER_WORKERS=4

BCRYPT_ROUNDS=12

LOG_CHANNEL=stack
LOG_STACK=single
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

DB_CONNECTION=sqlite
# DB_HOST=127.0.0.1
# DB_PORT=3306
# DB_DATABASE=laravel
# DB_USERNAME=root
# DB_PASSWORD=

SESSION_DRIVER=database
SESSION_LIFETIME=120
# Left UNSET on purpose, like SESSION_SECURE_COOKIE below: config/session.php defaults
# this to true everywhere except APP_ENV=local/testing. Setting it to false here would
# ship an unencrypted session payload to every deployment that copied this file.
# SESSION_ENCRYPT=true
SESSION_PATH=/
SESSION_DOMAIN=null
# --- Session hardening -------------------------------------------------------
# In production (APP_ENV=production over HTTPS) set ALL of the following:
#   SESSION_SECURE_COOKIE=true   — cookie only sent over HTTPS
#   SESSION_ENCRYPT=true         — encrypt the session payload at rest
#   SESSION_SAME_SITE=strict     — mitigates CSRF (relax to 'lax' only if a
#                                  cross-site OIDC redirect flow needs it)
# Leave UNSET (not blank): config/session.php defaults `secure` to true everywhere
# except APP_ENV=local/testing, so the cookie still works over plain http://localhost
# in dev while staying Secure in production. A blank `SESSION_SECURE_COOKIE=` would
# force it OFF and ship an insecure session cookie in production — never set it empty.
# SESSION_SECURE_COOKIE=true
SESSION_HTTP_ONLY=true
SESSION_SAME_SITE=lax

BROADCAST_CONNECTION=log
FILESYSTEM_DISK=local
QUEUE_CONNECTION=database

# Use REDIS in anything but a throwaway local install (docker-compose.yml already
# does). The platform leans hard on the cache: JWKS and verification keys, host →
# environment resolution on EVERY request, the entitlement hot path, the active
# inline-hook set on every token mint. On the `database` store each of those becomes
# a query against the `cache` table — which is the very round trip the caching exists
# to remove, so `database` quietly undoes it and adds write contention on top.
# `database` is the safe zero-dependency default for a first `php artisan serve`,
# and nothing more than that.
CACHE_STORE=database
# CACHE_PREFIX=

MEMCACHED_HOST=127.0.0.1

REDIS_CLIENT=phpredis
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

MAIL_MAILER=log
MAIL_SCHEME=null
MAIL_HOST=127.0.0.1
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_FROM_ADDRESS="hello@example.com"
MAIL_FROM_NAME="${APP_NAME}"

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_USE_PATH_STYLE_ENDPOINT=false

VITE_APP_NAME="${APP_NAME}"

# Where the console's "Read the guide" links point. The admin guides live in this
# repo under docs/guides/, so the default is the canonical GitHub view of them —
# a working link from the first deploy, with no docs site to stand up first.
# Point it at a rendered site and drop the suffix once one exists; blank it on an
# air-gapped deployment to hide every outbound link (the in-app help still works).
DOCS_BASE_URL=https://github.com/cboxdk/cbox-id/blob/main/docs
DOCS_LINK_SUFFIX=.md