.env.example

APP_ENV=local
# Generate with: php artisan key:generate
APP_KEY=
APP_DEBUG=false
APP_TIMEZONE=UTC
APP_URL=http://localhost
VITE_APP_URL=http://localhost

APP_LOCALE=en
APP_FALLBACK_LOCALE=en
APP_FAKER_LOCALE=en_US

APP_MAINTENANCE_DRIVER=file
APP_MAINTENANCE_STORE=database

BCRYPT_ROUNDS=12

DB_CONNECTION=sqlite
DB_DATABASE=database/database.sqlite
# Deployed environments use mysql and need the following instead:
# DB_CONNECTION=mysql
# DB_HOST=127.0.0.1
# DB_PORT=3306
# DB_USERNAME=
# DB_PASSWORD=
# Used only by the opt-in mysql_testing connection in phpunit.xml
# DB_DATABASE_TESTING=

REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_PASSWORD=

CACHE_STORE=array
SESSION_DRIVER=array
# QUEUE_CONNECTION, not QUEUE_DRIVER: the old Laravel 4/5 name is ignored by the
# framework. Must not be 'sync' on any deployed environment.
QUEUE_CONNECTION=sync

SCOUT_DRIVER=null
ALGOLIA_APP_ID=
ALGOLIA_KEY=
ALGOLIA_SECRET=

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=eu-west-1
AWS_BUCKET=
AWS_URL=

LOG_CHANNEL=stack
LOG_STACK=single

# Set to true on live to see Nova form errors in API response (DevTools → Network → failed request → Response)
NOVA_SHOW_ERRORS=false

LOCALES=al,ba,bg,cs,da,de,el,en,es,et,fi,fr,hr,hu,it,lt,lv,me,mk,nl,pl,pt,ro,rs,sk,sl,sv

ADMIN_EMAIL=admin@codeweek.test

SESSION_ENCRYPT=false
SESSION_PATH=/
SESSION_DOMAIN=null

AUTH_MODEL=App\User

# ---------------------------------------------------------------------------
# Mail. Required in every deployed environment; the app sends certificates,
# contact form submissions and moderation notices.
# ---------------------------------------------------------------------------
MAIL_MAILER=smtp
MAIL_HOST=
MAIL_PORT=587
MAIL_USERNAME=
MAIL_PASSWORD=
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=
MAIL_FROM_NAME="EU Code Week"
# Falls back to ADMIN_EMAIL when unset
CONTACT_FORM_RECIPIENT_EMAIL=

# ---------------------------------------------------------------------------
# Social login. LoginController allowlists twitter, github, google, facebook.
# ---------------------------------------------------------------------------
TWITTER_CLIENT_ID=
TWITTER_CLIENT_SECRET=
TWITTER_REDIRECT=
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GITHUB_REDIRECT=
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GOOGLE_REDIRECT=
FACEBOOK_CLIENT_ID=
FACEBOOK_CLIENT_SECRET=
FACEBOOK_REDIRECT=

# ---------------------------------------------------------------------------
# Maps and geolocation
# ---------------------------------------------------------------------------
MAPS_MAPBOX_ACCESS_TOKEN=
MAP_TILES=
MAXMIND_USER_ID=
MAXMIND_LICENSE_KEY=
IPAPI_KEY=

# ---------------------------------------------------------------------------
# Certificates. PDFLATEX_PATH must point at a real pdflatex binary or the
# whole certificate pipeline fails. See docs/handover/08-certificates.md
#
# CERTIFICATE_ADMIN_EMAILS is a comma-separated allowlist for
# /admin/certificate-backend/*. No role grants access, so if this is blank
# the certificate backend is closed to everyone.
# ---------------------------------------------------------------------------
PDFLATEX_PATH=
CERTIFICATE_ADMIN_EMAILS=

# ---------------------------------------------------------------------------
# Storage. RESOURCES_BUCKET is a second bucket for Learn & Teach PDFs, and is
# commonly pointed at production even on dev - check before importing.
# ---------------------------------------------------------------------------
FILESYSTEM_CLOUD=s3
RESOURCES_BUCKET=
RESOURCES_URL=
BULK_UPLOAD_TEMP_DISK=local
RESOURCES_IMPORT_TEMP_DISK=local

# ---------------------------------------------------------------------------
# Bot protection (Cloudflare Turnstile). Either TURNSTILE_SECRET or
# TURNSTILE_SECRET_KEY is accepted; verification is skipped when both are blank.
# ---------------------------------------------------------------------------
TURNSTILE_SITEKEY=
TURNSTILE_SECRET=

# ---------------------------------------------------------------------------
# Partner feeds and integrations
# ---------------------------------------------------------------------------
BLOG_URL=
EEDUCATION_CLIENTID=
RELOCATION_COUNTRY=
# Bearer token for the internal support API
SUPPORT_SERVICE_TOKEN=

# Error monitoring
SENTRY_LARAVEL_DSN=

# ---------------------------------------------------------------------------
# Support AI copilot (Phase 1: AI triage + frontend code PRs)
# ---------------------------------------------------------------------------
SUPPORT_AI_ENABLED=false
# One Cursor key for both the headless CLI (triage) and Cloud Agents API (PRs).
CURSOR_API_KEY=

# Triage brain (Cursor headless CLI: `agent -p --output-format json`)
SUPPORT_AI_TRIAGE_ENABLED=true
SUPPORT_AI_CLI_BIN=agent
SUPPORT_AI_CLI_MODEL=gpt-5.4-mini-medium
SUPPORT_AI_CLI_TIMEOUT=120

# Frontend code changes (Cursor Cloud Agents API -> PR into dev)
SUPPORT_AI_CODE_CHANGE_ENABLED=false
SUPPORT_AI_CURSOR_API_BASE=https://api.cursor.com
SUPPORT_AI_CLOUD_MODEL=composer-2.5
SUPPORT_AI_REPO_URL=https://github.com/codeeu/codeweek
SUPPORT_AI_DEV_BRANCH=dev
SUPPORT_AI_AUTO_CREATE_PR=true
SUPPORT_AI_MAX_POLL_MINUTES=30

# Dev -> Live promotion: pr_only | none  (never auto-merges to live)
SUPPORT_AI_LIVE_PROMOTION=pr_only
SUPPORT_AI_LIVE_BRANCH=master
# Token-gated; promotion PR is skipped if absent. owner/repo form.
SUPPORT_GITHUB_REPO=codeeu/codeweek
SUPPORT_GITHUB_TOKEN=

# Phase 2 — AI artisan changes (allowlist-first, dry-run + APPROVE)
SUPPORT_AI_ARTISAN_ENABLED=false
SUPPORT_AI_ARTISAN_ALLOW_RAW=true
SUPPORT_AI_ARTISAN_TIMEOUT=120
SUPPORT_AI_ARTISAN_OUTPUT_LIMIT=8000

# Phase 3 — AI content edits on Nova-managed records (text fields only, dry-run + APPROVE)
SUPPORT_AI_CONTENT_ENABLED=false
SUPPORT_AI_CONTENT_MAX_FIELD_LENGTH=5000