<?php
/*
 * package examples/crash_reporter/backend/config/config.example.php
 * config.example.php
 * Created at: Wed 20 May 2026 14:31:55 +0200
 * Updated at: Wed 20 May 2026 15:17:13 +0200 by Anton Afanasyeu <a.afanasieff@gmail.com>
 * Commit: 5d8e82d2e60a21fff3138d2a394ee4e8b4c6dcb8
 * Contributors:
 *    - Anton Afanasyeu <a.afanasieff@gmail.com> (2 commits, 23 lines)
 *    - Cursor Agent (project assistant)
 * Digest: SHA256	fcd4a89ef4201736923d0e7e1ad88868bba7e39eadb9fcf0ffb9d1ba7efecd12
 */
return [
    'app_name' => 'Android Cast',
    // Console (issues/tickets/…) — production path
    'project_base_path' => '/app/androidcast_project',
    'base_path' => '/app/androidcast_project/issues',
    // Legacy alias kept for redirects/nginx; do not use in new links
    'legacy_base_path' => '/app/androidcast_project/crashes',
    'db' => [
        // sqlite = default file DB; mysql = MariaDB/MySQL (recommended on BE for concurrency)
        'driver' => 'sqlite', // sqlite | mysql | mariadb (alias)
        'sqlite_path' => __DIR__ . '/../data/crashes.sqlite',
        'mysql' => [
            // Alpine: if TCP fails with "Connection refused", set socket (see /etc/my.cnf.d/*.cnf)
            'host' => '127.0.0.1',
            'port' => 3306,
            'socket' => '/run/mysqld/mysqld.sock', // leave '' to use host+port only
            'database' => 'androidcast_crashes',
            'username' => 'androidcast',
            'password' => 'change-me',
            'charset' => 'utf8mb4',
        ],
    ],
    'session_name' => 'ac_crash_sess',
    // Shared login cookie across crashes, build, and other consoles under this path
    'session_cookie_path' => '/app/androidcast_project',
    // When true, upload API may include a short error hint (do not enable on public prod long-term)
    'debug' => false,
    // Phase 1 RBAC: anonymous uploads and legacy rows attach to this company
    'rbac' => [
        'default_company_slug' => 'default',
        'default_company_id' => 1,
    ],
    // Google Analytics 4 (hub + crash console share public/assets/js/analytics.js)
    'analytics' => [
        'enabled' => false,
        'measurement_id' => '', // e.g. G-XXXXXXXXXX
        'debug' => false,
    ],
    // On-demand remote access (WireGuard v1) — see docs/REMOTE_ACCESS_IMPL.md
    'remote_access' => [
        // Public UDP endpoint (FE DNAT → BE wg0 ListenPort)
        'wg_endpoint' => 'ra.apps.f0xx.org:45340',
        // wg show wg0 public-key on BE — REQUIRED for production connect
        'wg_server_public_key' => 'EV2nnwHH7xe3jA5J46Rjtl8ao+ybZinibKg2Hy83GBw=',
        'wg_interface' => 'wg0',
        // Client / server addresses (must match wg0 Address subnet on BE)
        'wg_server_allowed_ips' => '172.200.2.1/32',
        'wg_client_ip_prefix' => '172.200.2.',
        'wg_client_ip_min' => 10,
        'wg_client_ip_max' => 250,
        // Prefix for `wg set` when PHP-FPM runs as nobody (see examples/wireguard/alpine-be-sudoers-wg)
        'wg_set_prefix' => 'sudo -n ',
        'provision_peers' => true,
        'require_wg_tools' => true,
        'session_ttl_s' => 3600,
        'min_poll_interval_s' => 45,
        // Reverse SSH (alpha): outbound -R from device; no VpnService on phone
        'rssh' => [
            'bastion_host' => 'ra.apps.f0xx.org',
            'bastion_port' => 443,
            'username_prefix' => 'ra-',
            'local_forward_port' => 8022,
            'remote_port_min' => 18000,
            'remote_port_max' => 18999,
            // Lab/prod: create ephemeral Match User ra-* on BE sshd (see scripts/rssh_bastion_user.sh)
            'provision_users' => false,
            'provision_script' => '', // default: backend/scripts/rssh_bastion_user.sh
        ],
    ],
    // Outbound mail (registration verify, password reset) — see docs/20260607-2FA-email-mobile-auth-flow.md
    'auth' => [
        // 32+ char secret for encrypting TOTP seeds + hashing auth attempts
        'encryption_key' => '',
        'max_attempts' => 8,
        'lockout_window_minutes' => 15,
    ],
    // SFU / WebRTC relay (post-alpha) — hidden until owner spec; see examples/sfu/README.md
    'sfu' => [
        'enabled' => false,
        'signaling_url' => '', // e.g. wss://apps.f0xx.org/sfu/signal
        'janus_url' => '', // lab only — port 8089 is a separate stack (INFRA.md)
    ],
    'mail' => [
        'transport' => 'smtp', // smtp | sendmail
        // Alpha: use apex if apps.f0xx.org has CNAME (no MX on subdomain) — see tmp/20260608_help_request.md
        'from' => 'Android Cast Issues <noreply@f0xx.org>',
        'reply_to' => 'info@apps.f0xx.org',
        'smtp' => [
            'host' => '127.0.0.1',
            'port' => 587,
            'encryption' => 'tls', // tls | ssl | ''
            'username' => '',
            'password' => '', // set in prod config.php only — not in git
        ],
    ],
    // URL shortener admin (hub Short links card) — MariaDB url_shortener on BE
    'url_shortener' => [
        'enabled' => false,
        'public_base' => 'https://s.f0xx.org',
        'db' => [
            'mysql' => [
                'host' => '127.0.0.1',
                'port' => 3306,
                'socket' => '/run/mysqld/mysqld.sock',
                'database' => 'url_shortener',
                'username' => 'androidcast',
                'password' => 'change-me',
                'charset' => 'utf8mb4',
            ],
        ],
    ],
];
