# ============================================================================
#  NOWILLS ISP - SINGLE-DEPLOYMENT BUILD
#
#  APP_KEY is already set, so you do NOT run `php artisan key:generate`.
#  Everything marked CHANGE_ME still has to be filled in: database credentials,
#  your organisation details, the administrator account, mail and RADIUS secret.
#
#  This key is unique to this build. Do not reuse this zip for a second server:
#  two installations sharing an APP_KEY can decrypt each other's sessions and
#  encrypted columns, and one leaked key compromises both.
# ============================================================================

# ============================================================================
#  NOWILLS ISP - Connect. Manage. Grow.
#  Production environment template for cPanel / shared hosting.
#
#  Copy to .env, fill in every CHANGE_ME, then run:
#      php artisan key:generate --force
#
#  Never commit the real .env. The values below are placeholders, not secrets.
# ============================================================================

APP_NAME="NOWILLS ISP"
APP_ENV=production
APP_KEY=base64:4zIXseH72AUqTZdB2/FxJVteBo/Izna7py2ETQbhYKs=
APP_DEBUG=false
APP_URL=https://CHANGE_ME.example.com

# Platform default. Per-organisation overrides come from organizations.timezone
# and are applied per request by SetOrganizationTimezone; this value governs
# console, queue and scheduler work, where there is no signed-in tenant.
APP_TIMEZONE=Africa/Accra

APP_LOCALE=en
APP_FALLBACK_LOCALE=en

# --- Logging ---------------------------------------------------------------
# Keep this at warning or above in production. debug writes request detail to
# disk on a host where the log directory is often world-readable.
LOG_CHANNEL=stack
LOG_STACK=daily
LOG_LEVEL=warning

# --- Database --------------------------------------------------------------
# cPanel: create the database and user in "MySQL Databases", then grant the
# user ALL PRIVILEGES on that one database only.
DB_CONNECTION=mysql
DB_HOST=CHANGE_ME.db.host
DB_PORT=3306
DB_DATABASE=CHANGE_ME_cpaneluser_nowills
DB_USERNAME=CHANGE_ME_cpaneluser_nowills
DB_PASSWORD=CHANGE_ME

# Charset is required for correct Cedi / Pound / Euro rendering on invoices.
DB_CHARSET=utf8mb4
DB_COLLATION=utf8mb4_unicode_ci

# --- Sessions, cache, queue ------------------------------------------------
# All three use the database driver so the app needs no Redis, Memcached or
# daemonised queue worker - a hard requirement on shared hosting.
SESSION_DRIVER=database
SESSION_LIFETIME=480
SESSION_ENCRYPT=false
SESSION_SECURE_COOKIE=true

CACHE_STORE=database
QUEUE_CONNECTION=database
FILESYSTEM_DISK=local

# --- Mail ------------------------------------------------------------------
# Set MAIL_MAILER=log only while commissioning: every message is written to
# storage/logs instead of being sent. Customers will not receive it.
MAIL_MAILER=smtp
MAIL_HOST=CHANGE_ME.smtp.host
MAIL_PORT=587
MAIL_USERNAME=CHANGE_ME
MAIL_PASSWORD=CHANGE_ME
MAIL_SCHEME=tls          # tls | ssl | null
MAIL_FROM_ADDRESS="billing@CHANGE_ME.example.com"
MAIL_FROM_NAME="${APP_NAME}"

# --- Your organisation -----------------------------------------------------
# ProductionSeeder writes these into the organizations row and attaches roles,
# plans and the chart of accounts to the slug below. The default slug is the
# demonstration estate's and should be changed.
NOWILLS_ORG_SLUG=CHANGE_ME-your-isp
NOWILLS_ORG_NAME="CHANGE_ME Your ISP Name"
NOWILLS_ORG_LEGAL_NAME="CHANGE_ME Your ISP Legal Name Ltd"
NOWILLS_ORG_TRADING_NAME=
NOWILLS_ORG_TAX_ID=
NOWILLS_ORG_REG_NUMBER=
NOWILLS_ORG_COUNTRY=GH
NOWILLS_ORG_SUPPORT_EMAIL=support@CHANGE_ME.example.com
NOWILLS_ORG_SUPPORT_PHONE=

# --- First administrator ---------------------------------------------------
# Required by ProductionSeeder, which refuses to run without both. There is no
# built-in default password: a published one would be a known credential on
# every installation of this package.
#
# Delete or blank NOWILLS_ADMIN_PASSWORD once you have signed in and changed it.
NOWILLS_ADMIN_NAME="System Administrator"
NOWILLS_ADMIN_EMAIL=admin@CHANGE_ME.example.com
NOWILLS_ADMIN_PASSWORD=CHANGE_ME_strong_password

# --- NOWILLS platform settings --------------------------------------------
NOWILLS_BASE_CURRENCY=GHS
NOWILLS_DEFAULT_TAX_RATE=15
NOWILLS_INVOICE_PREFIX=INV
# Leave true. Setting this false disables tenant scoping globally and lets any
# signed-in user read and write every organisation's data.
NOWILLS_TENANCY_ENFORCED=true
NOWILLS_DEFAULT_DUE_DAYS=14

# --- RADIUS / AAA ----------------------------------------------------------
# Must match the shared secret configured on every NAS in radcheck/nas.
# Generate one with: openssl rand -hex 32
RADIUS_SHARED_SECRET=CHANGE_ME_openssl_rand_hex_32
RADIUS_COA_PORT=3799
RADIUS_COA_TIMEOUT=3
RADIUS_DEFAULT_REALM=CHANGE_ME.example.com
RADIUS_NAS_IDENTIFIER=CHANGE_ME-core

# --- Network integration ---------------------------------------------------
# SNMP: many shared hosts block outbound UDP 161. Verify with the NOC poll
# command before relying on SNMP graphs.
SNMP_COMMUNITY=CHANGE_ME
SNMP_TIMEOUT=2
SNMP_RETRIES=1

# MikroTik RouterOS API. Port 8729 is the TLS variant and is strongly
# preferred; outbound access to it must be open on the host.
MIKROTIK_API_PORT=8728
MIKROTIK_API_SSL_PORT=8729
MIKROTIK_TIMEOUT=5
