.env.example

# =======================================================
# HAWKI 2: Configuration environment varibales (template)
# =======================================================
#
# HAWKI 2 is built with the Lavarel framework for PHP. This allows to configure the
# application by editing the *.php files in the config directory. However, by default
# these files are writtin in such a way that most settings can also be changed with
# environment variables. This is handy because changing the config files would mean
# to change the HAWKI 2 source code, since these files are managed in the HAWKI git
# repository and also contained in the installation packages. Environment variables,
# however, are set in the OS (or your hosting environment).
#
# Additionaly, Lavarel reads the contents of a .env file in the project root directory
# to override the environment variables. This file is not contained in the HAWKI
# installation as it is meant for developers and administrators to set their local
# configuration values.
#
# This file is a template for the .env file. It documents all relevant settings,
# their allowed values and their defaults. Simply copy this file (don't just rename
# it) to a new file called .env and change the values as needed. The pre-set values
# will provide a sensible configuration for a "localhost deployment" for developers.
# Commented out settings are not strictly needed and usually contain the default
# values found in the config/*.php files.

# ===========================
# Global Application Settings
# ===========================
#
#  - APP_NAME:               Application name, can be anything you like
#  - PROJECT_NAME:           Application name, can be anything you like
#  - APP_ENV:                Deployment type: "local", "statiging" or "production"
#  - APP_URL:                Public URL to access the web interface
#  - APP_TRUSTED_PROXIES:    Comma separated list of trusted proxy IP addresses (e.g. "10.0.1.11", or "10.0.1.11,10.0.1.12" for multiple proxies).
#                            This is important if you are using a reverse proxy in front of HAWKI, to ensure that the application can correctly determine the client's IP address and other request information.
#  - APP_DEBUG:              Enable debug output: "true" or "false"
#  - APP_TIMEZONE:           Timezone of the web server
#  - APP_LOCALE:             Language of the user interface
#  - APP_FALLBACK_LOCALE:    Fallback language (for any missing translations)
#  - APP_FAKER_LOCALE:       You shouldn't need this
#  - APP_KEY:                Encryption key: 32 random characters (e.g. created with https://www.random.org/strings)
#  - APP_PREVIOUS_KEYS:      Comma seperated list of previously used encryption keys
#  - APP_MAINTENANCE_DRIVER: Maintenance mode driver: "cache" or "file": "cache" allows setting the maintenance mode across multiple machines
#  - APP_MAINTENANCE_STORE:  Maintenance mode storage: "database" or ???

APP_NAME="HAWKI2"
PROJECT_NAME="HAWKI2"

APP_URL="http://127.0.0.1:8000"
#APP_TRUSTED_PROXIES=
APP_ENV="local"
APP_DEBUG="false"
APP_TIMEZONE="CET"

APP_LOCALE="de_DE"
APP_FALLBACK_LOCALE="en_US"
APP_FAKER_LOCALE="de_DE"

APP_KEY=
APP_PREVIOUS_KEYS=

APP_MAINTENANCE_DRIVER="cache"
APP_MAINTENANCE_STORE="database"

# Asset Cache Busting
# Custom version string to include when generating the cache buster hash for JS/CSS assets.
# This is OPTIONAL -> helps if you build your own HAWKI version and want to ensure users get the latest assets.
#APP_CACHE_BUSTER="2025-10-15"

# ===========================
# Session Configuration
# ===========================
#
# These are essential Laravel default variables for session management and they must be
# present and active to ensure proper session handling within the application.
#
# SESSION_DRIVER: Specifies the session "driver" or handler used to store session data.
# Common choices include "file", "cookie", "database", etc. Typically, "database" is used
# if sessions are stored in the database.
#
# SESSION_LIFETIME: The session lifetime in minutes. It determines how long a session
# remains active before it expires.
#
# SESSION_ENCRYPT: Indicates whether session data should be encrypted. Accepts "true" or "false".
# When set to "true", it adds an extra layer of security by encrypting session data.
#
# SESSION_PATH: Defines the path for which the session cookie is available. The default value is "/".
#
# SESSION_DOMAIN: Specifies the domain that the session cookie is available to. Use "null"
# to default to the current domain.
#
# SESSION_EXPIRE_ON_CLOSE: Defines whether the session should expire when the browser
# is closed. Set to "true" to expire sessions on browser close, enhancing session security.

SESSION_DRIVER="database"
SESSION_LIFETIME="120"
SESSION_ENCRYPT="false"
SESSION_PATH="/"
SESSION_DOMAIN="null"
SESSION_EXPIRE_ON_CLOSE="true"

# ==========================
# HAWKI Profile
# ==========================
#
# Add your HAWKI user attributes here.
#
#  - AI_MENTION_HANDLE:      Hnadle to mention AI in group chats. AI Handle is always included with '@' syntax: @hawki

AI_MENTION_HANDLE="hawki"

# -------------------------
# MIGRATION ATTRIBUTES
# -------------------------
# Remember after migrating the database you can't change the migration attributes anymore.
# If you want to change the HAWKI_AVATAR first you need to place the file in /public/img
# folder and update the name here.
# HAWKI User model variables.
# Before changing HAWKI_AVATAR add the file to /public/img folder.

HAWKI_NAME='HAWKI'
HAWKI_USERNAME='HAWKI'
HAWKI_AVATAR='hawkiAvatar.jpg'

# ==========================
# SECURITY SETTINGS
# ==========================
#
# Application-level security configuration.
#
# APP_SECURITY_PASSKEY_ALLOW_PASTE
# Controls clipboard operations for passkey input fields.
# When true (default): Allows paste from password managers and enables copy/cut to clipboard.
# When false: Blocks all clipboard operations (paste, copy, and cut) for maximum security.
# Note: Passkeys are used as direct cryptographic input, so clipboard behavior affects key derivation.
#
# APP_SECURITY_PASSKEY_CHAR_LIMITATION
# Restricts allowed characters for passkey input.
# When true (default): Only allows [A-Za-z0-9!@#$%^&*()_+-] to ensure deterministic
# cryptographic key derivation across browsers, devices, and language runtimes.
# When false: Allows any characters (use with caution as this may affect key compatibility).

APP_SECURITY_PASSKEY_ALLOW_PASTE=true
APP_SECURITY_PASSKEY_CHAR_LIMITATION=true

# ==========================
# AI CONNECTION
# ==========================
#
# Add your AI Provider API Keys here.
# This section includes a list of hidden attributes for costumization of each model and provider.
# For the complete list of attributes refer to HAWKI Documentation.

OPENAI_API_KEY=
GWDG_API_KEY=
GOOGLE_API_KEY=
OPEN_WEB_UI_API_KEY=

# ==========================
# FILE CONVERTER
# ==========================
#
# Define your file converter here.
# You can choose betwee HAWKI Toolkit File Converter, GWDG SAIA Docling.
# To use Gwdg Docling you'll need to have the GWDG_API_KEY.
#
# FILE_CONVERTER:                   The converter you prefer to use "hawki_converter", "gwdg_docling"
# HAWKI_FILE_CONVERTER_API_URL     URL to the Hosted HAWKI converter.
# GWDG_FILE_CONVERTER_API_URL       URL to the GWDG converter. 'https://chat-ai.academiccloud.de/v1/documents/convert'

FILE_CONVERTER=hawki_converter
HAWKI_FILE_CONVERTER_API_URL=127.0.0.1:8001/extract
HAWKI_FILE_CONVERTER_API_KEY=
GWDG_FILE_CONVERTER_API_URL='https://chat-ai.academiccloud.de/v1/documents/convert'

# ===============
# Database server
# ===============
#
# HAWKI uses a database to save chats and other data. For this a relation SQL database
# like MariaDB (MySQL) or Postgres should be used in production. For local development
# SQlite provides a zero-config default solution (but note that SQlite is single-user
# only and stores all data in a single file).
#
# IMPORTANT: When using a database other than SQlite set DB_DATABASE to a sensible value.
# Because the default value in config/database.php is "lavarel" which is less clear and
# could at least in theory already be in use by other applications.
#
# A WORD ON BACKUPS: For various reasons, if you are running in a Docker environment,
# the DB_BACKUP feature is disabled and will throw an error if you try to enable it.
# Use the dump solution of your database container instead, and make sure to back up the database volume regularly.
#
#  - DB_CONNECTION:               Database server type: "mysql", "sqlite", "mariadb", "pgsql", "sqlsrv" (see config/database.php)
#  - DB_BACKUP_INTERVAL           Interval in which the database in being backed up: "daily", "weekly", "monthly", etc. Can be "never" to disable automatic backups.
#  - DB_BACKUP_INTERVAL_ARGS      Some intervals accept additional constraints, e.g. "20:00" for "dailyAt" or "sunday" and "12:31" for "weeklyOn"
#                                 See more details at: \Illuminate\Console\Scheduling\ManagesFrequencies
#                                 As value you can pass either a single string value, or a single numeric value (e.g. "20:00" or "20")
#                                 Or an JSON array to pass multiple values (e.g. ["sunday", "12:31"] or ["20:00", "wednesday", "15:00"])
#                                 Example: DB_BACKUP_INTERVAL="cron", DB_BACKUP_INTERVAL_ARGS="0 0 * * *" for daily backup at midnight,
#                                 or DB_BACKUP_INTERVAL="dailyAt", DB_BACKUP_INTERVAL_ARGS="20:00" for daily backup at 8pm,
#                                 or DB_BACKUP_INTERVAL="daysOfMonth", DB_BACKUP_INTERVAL_ARGS="[1, 13, 28]" for backup on the 1st, 13th and 28th of each month, etc.
#  - DB_BACKUP_DUMPER_BINARY_DIR  By Default we are using "mysqldump" for MySQL/MariaDB, however if, on your machine the binary is not in the PATH,
#                                 you can specify the path to the directory containing the binary here.
#  - DB_URL:                      Database connection URL (instead of host and port)
#  - DB_HOST:                     Database server host name
#  - DB_PORT:                     Database server port number
#  - DB_SOCKET:                   Unix domain socket instead of URL, host and port (MySQL and MariaDB only)
#  - DB_DATABASE:                 Database name (please change!)
#  - DB_USERNAME:                 Username to access the database server
#  - DB_PASSWORD:                 Password to access the database server
#  - DB_ROOT_PASSWORD:            The password of the root user of the database server.
#  - DB_CHARSET:                  Character encoding of the database
#  - DB_COLLATION:                Database collation (MySQL and MariaDB only)

DB_CONNECTION="mysql"
DB_BACKUP_INTERVAL="daily"
DB_BACKUP_INTERVAL_ARGS=
DB_BACKUP_DUMPER_BINARY_DIR=

## SQlite
#DB_URL          =
#DB_DATABASE     = database/database.sqlite
#DB_FOREIGN_KEYS = true

## MySQL / MariaDB
#DB_URL            =
DB_HOST="127.0.0.1"
DB_PORT="3306"
DB_SOCKET=
DB_DATABASE=
DB_USERNAME="root"
DB_PASSWORD="root"
DB_ROOT_PASSWORD="root"
#DB_CHARSET        = utf8mb4
#DB_COLLATION      = utf8mb4_unicode_ci
#MYSQL_ATTR_SSL_CA =

## Postgresql
#DB_URL      =
#DB_HOST     = localhost
#DB_PORT     = 5432
#DB_DATABASE = HAWKI2
#DB_USERNAME = root
#DB_PASSWORD =
#DB_CHARSET  = utf8

## Microsoft SQL Server
#DB_URL      =
#DB_HOST     = localhost
#DB_PORT     = 1433
#DB_DATABASE = HAWKI2
#DB_USERNAME = root
#DB_PASSWORD =
#DB_CHARSET  = utf8

# ==================
# Filesystem Storage
# ==================
#
# Uploaded media files are typically stored on disk and served from an asset web server.
# However, to simplify the setup the uploaded files will be served by PHP by default,
# though thos is not so good for performance. Alternateively Amazon S3 could be used.
#
# NOTE: If you want to serve media files with your web server, choose "public" for
# FILESYSTEM_DISK. In this case make the server serve the files from the "app/public"
# directory. The HTTP address must be your APP_URL followed by "/storage".
#
#  - FILESYSTEM_DISK:               Default Storage type: "local", "public", "s3", "sftp", "nextcloud"
#  - STORAGE_DISK:                  File Storage type: "local", "public", "s3", "sftp", "nextcloud"
#  - AVATAR_STORAGE:                Avatar Storage type: "local", "public", "s3", "sftp", "nextcloud"
#  - REMOVE_FILES_AFTER_MONTHS:     Remove the storage files after an specific expiry date.
#
#  - S3_ACCESS_KEY:                 Access Key to S3 Server
#  - S3_SECRET_KEY:                 Secret Key to S3 Server
#  - S3_REGION:                     Region of S3 Server
#  - S3_ENDPOINT:                   URL to S3 Server
#  - S3_DEFAULT_BUCKET:             Bucket name
#  -
#  - NEXTCLOUD_BASE_URL:            URL to Nextcloud server
#  - NEXTCLOUD_BASE_PATH:           Base Path to Nextcloud storage folder
#  - NEXTCLOUD_USERNAME:            Nextcloud Username
#  - NEXTCLOUD_PASSWORD:            Nextcloud Password
#
#  - SFTP_HOST:                     SFTP Server Host
#  - SFTP_PORT:                     SFTP Server Port
#  - SFTP_USERNAME:                 SFTP Server Username
#  - SFTP_PASSWORD:                 SFTP Server Password
#  - SFTP_BASE_PATH:                Base Path to SFTP Server storage folder

FILESYSTEM_DISK="local"
STORAGE_DISK="local_file_storage"
AVATAR_STORAGE="public"

REMOVE_FILES_AFTER_MONTHS=6

S3_ACCESS_KEY=
S3_SECRET_KEY=
S3_REGION=
S3_ENDPOINT=
S3_DEFAULT_BUCKET=

NEXTCLOUD_BASE_URL=
NEXTCLOUD_BASE_PATH=
NEXTCLOUD_USERNAME=
NEXTCLOUD_PASSWORD=

SFTP_HOST=
SFTP_PORT=
SFTP_USERNAME=
SFTP_PASSWORD=
SFTP_BASE_PATH=

# ===========================
# File Upload Settings
# ===========================
#
# The following settings define the limits and allowed types for file uploads in HAWKI. These settings are crucial for ensuring that the application can handle
# file uploads securely and efficiently, while also providing a good user experience.
#
# IMPORTANT! Your upload limits must be supported by your PHP configuration (e.g. post_max_size and upload_max_filesize in php.ini).
# If you set a file size limit that exceeds your PHP configuration, the limits will automatically be reduced to the maximum allowed by PHP, which may lead to confusion
# if you are not aware of this behavior. Always ensure that your PHP configuration supports the file size limits you set in these environment variables.
# If you are using our Docker image: Use the "MAX_UPLOAD_SIZE" variable in the Docker configuration to set the PHP and Nginx limits accordingly.
#
# MAX_FILE_SIZE: The maximum file size for an uploaded file (e.g., attachment) in bytes. The default is 20 MB (20 * 1024 * 1024 bytes).
# MAX_AVATAR_FILE_SIZE: The maximum file size for an avatar in bytes. The default is 2 MB (2 * 1024 * 1024 bytes).
# ALLOWED_FILE_MIME_TYPES: A comma-separated list of allowed MIME types for uploaded files (e.g., "image/jpeg,image/png,application/pdf"). If empty, the defaults are defined in the file storage service.
# ALLOWED_AVATAR_MIME_TYPES: A comma-separated list of allowed MIME types for uploaded avatars (e.g., "image/jpeg,image/png"). If empty, the defaults are defined in the avatar storage service.
# MAX_ATTACHMENT_FILES: The maximum number of files that can be attached to a single message. Set to 0 for unlimited.

#MAX_FILE_SIZE=20971520
#MAX_AVATAR_FILE_SIZE=2097152
#ALLOWED_FILE_MIME_TYPES=
#ALLOWED_AVATAR_MIME_TYPES=
#MAX_ATTACHMENT_FILES=0

# ==================
# Event Broadcasting
# ==================
#
# Lavarel contains an internal mechanism to broadcast events amongst servers.
# Normaly you shouldn't need to change the settings here. Just use the values
# below and only change them if you really know what you are doing.
#
#  - BROADCAST_CONNECTION: Broadcasting mechanism. Default: "reverb"
#  - BROADCAST_DRIVER:     Broadcasting mechanism. Default: "reverb"

BROADCAST_CONNECTION="reverb"
BROADCAST_DRIVER="reverb"

# ========================
# Reverb: Websocket Server
# ========================
#
# For websocket connectivity Laravel provides a special server called Reverb. This must be
# set up for HAWKI since many features rely on real-time communication via web sockets.
#
# --- Server binding ---
#
#  - REVERB_SERVER_HOST: The network interface address Reverb binds to when it starts.
#                        This should almost always be "0.0.0.0" so Reverb listens on all interfaces.
#                        Only change this if you explicitly want to restrict which interface Reverb listens on.
#  - REVERB_SERVER_PORT: The port Reverb listens on internally. Defaults to 8080.
#
# --- Backend connection (PHP → Reverb) ---
#
# These variables tell the PHP application how to reach the Reverb server internally.
# They are NOT used by the browser and do NOT need to be publicly accessible.
# In a typical Docker or local setup, Reverb runs on the same host as PHP.
#
#  - REVERB_HOST:   Hostname the PHP application uses to connect to Reverb internally.
#  - REVERB_PORT:   Port the PHP application uses to connect to Reverb internally.
#  - REVERB_SCHEME: Protocol used for the internal PHP → Reverb connection: "http" or "https".
#                   Use "http" unless Reverb itself is terminating TLS.
#
# --- Frontend connection override ---
#
# By default, the browser assumes Reverb is accessible via the same host and port as APP_URL,
# i.e. it expects a reverse proxy to forward WebSocket traffic to Reverb. If your setup differs
# (e.g. Reverb is exposed on a different host or port), you can override the frontend connection:
#
#  - VITE_REVERB_HOST: Hostname the browser uses to connect to Reverb. Defaults to APP_URL host.
#  - VITE_REVERB_PORT: Port the browser uses to connect to Reverb. Defaults to APP_URL port.
#  - VITE_REVERB_SCHEME: Protocol used by the browser to connect to Reverb: "https" or "http".
#
#  --> If you don't have any issues, keep those values commented out.
#
# --- Application identity and security ---
#
#  - REVERB_APP_ID:     Uniquely identifies this WebSocket application instance on the Reverb server.
#                       Useful when multiple applications share one Reverb server.
#                       Can be a number (e.g. "1001") or a string (e.g. "hawki").
#  - REVERB_APP_KEY:    A public identifier used to establish a WebSocket connection with Reverb.
#                       This value is also exposed to the browser (frontend) to initiate the connection.
#  - REVERB_APP_SECRET: A shared secret key used by the backend to authenticate with the Reverb server
#                       and to sign/validate real-time events. Must be kept private. Required.
#
# --- Behaviour ---
#
#  - REVERB_APP_PING_INTERVAL:    How often (in seconds) the backend pings connected frontend clients
#                                 to verify they are still alive. Defaults to 60.
#  - REVERB_APP_MAX_MESSAGE_SIZE: Maximum WebSocket message size in bytes. Defaults to 250000 (≈244 KB).
#
# --- Scaling (advanced) ---
#
#  - REVERB_SCALING_ENABLED: Set to "true" to enable Redis-based scaling across multiple Reverb instances.
#  - REVERB_SCALING_CHANNEL: Redis channel used for scaling coordination. Defaults to "reverb".

REVERB_SERVER_HOST="0.0.0.0"
REVERB_SERVER_PORT="8080"

REVERB_HOST="127.0.0.1"
REVERB_PORT="8080"
REVERB_SCHEME="http"

REVERB_APP_ID="hawki"
REVERB_APP_KEY=
REVERB_APP_SECRET=

#VITE_REVERB_HOST=
#VITE_REVERB_PORT=
#VITE_REVERB_SCHEME=

REVERB_APP_MAX_MESSAGE_SIZE="250000"
#REVERB_APP_PING_INTERVAL=60
#REVERB_SCALING_ENABLED=false
#REVERB_SCALING_CHANNEL=reverb

# =================================
# SSL Certificate Configuration
# =================================
#
# These environment variables are used to specify the SSL certificate and the corresponding
# private key that are essential for establishing secure TLS/SSL connections in certain
# broadcasting setups. This is particularly crucial when using Reverb or similar services
# with encrypted connections, ensuring data is securely transmitted over HTTPS.
#
# SSL_CERTIFICATE: Specifies the path to your SSL certificate file. This certificate is used
# to authenticate and establish a secure connection between the server and the client.
#
# SSL_CERTIFICATE_KEY: Specifies the path to the private key file corresponding to your SSL
# certificate. The key is required to confirm the identity of the server and encrypt the
# data being transmitted.
#
# In the broadcasting configuration, these variables are used to configure the Guzzle
# HTTP client with appropriate SSL settings. By providing these files, you enable
# SSL/TLS encryption for broadcast services, enhancing the security of data in transit.

SSL_CERTIFICATE=""
SSL_CERTIFICATE_KEY=""

# ===========================
# Queue Worker Configuration
# ===========================
#
# This configuration setting is used to specify the queue connection that should be used by the
# Laravel application. This is essential for managing asynchronous tasks such as sending emails,
# processing uploads, or any other task that can be handled in the background.
#
# QUEUE_CONNECTION: Defines the queue connection that the Laravel application will use.
# Options include "sync", "database", "redis", etc. The "database" connection is typically
# used to store jobs in a database table, which is useful for tracking, retrying, or monitoring
# queued jobs effectively.

QUEUE_CONNECTION="database"

# ================================
# Authentication and Authorization
# ================================
#
# Access to HAWKI is restricted for registered users. In a production environment, you
# usually want to connect to your LDAP directory, OpenID provider, or Shibboleth service
# to make HAWKI available to your staff and/or students. For simpler setups (e.g., a small
# project setup for a single course), you can use the built-in Test User Authentication mechanism.
# This allows defining a small set of pre-allocated users in the local database (set up in advance by you).
#
# NOTE: If you want a small setup with fixed users but want to allow the users to change
# their passwords, you can install LLDAP (https://github.com/lldap/lldap) on the same
# machine than HAWKI.
#
# Supported authentication methods:
#   - LDAP
#   - OIDC (OpenID Connect)
#   - Shibboleth
#
# Set the AUTHENTICATION_METHOD variable to one of the following:
#
# AUTHENTICATION_METHOD="LDAP"
# AUTHENTICATION_METHOD="OIDC"
# AUTHENTICATION_METHOD="Shibboleth"
#
# According to your authentication method, set the necessary variables as follows:

AUTHENTICATION_METHOD="LDAP"

# -------------------------------
# LDAP Configuration
# -------------------------------
#
# LDAP_HOST: Hostname of the LDAP server, e.g. "ldap.example.com"
# LDAP_PORT: Port number used by the LDAP server, commonly 389 for unencrypted or 636 for LDAPS
# LDAP_BIND_DN: This value is the distinguished name (DN) used to bind to the LDAP server. Basically it is the user
#               that HAWKI will use to perform searches against the LDAP server (not the user that is logging in). This should be
#               something like: "cn=admin,dc=example,dc=com". Historically this was called "LDAP_BASE_DN", but to avoid confusion with
#               the actual "base DN" used for searches, this has been renamed.
#               -> Set this to `anonymous` to use anonymous binding.
# LDAP_BIND_PW: Password for the bind (authentication) user connecting to the LDAP server
# LDAP_BASE_DN: is the "search base".
#               This is the DN where user searches will start; something like: "ou=users,dc=example,dc=com".
#               Historically this was called "LDAP_SEARCH_DN", while "LDAP_BASE_DN" was used for the bind DN; to avoid confusion we
#               swapped the names.
#
# LDAP_ATTR_USERNAME: Attribute in LDAP records containing the username (e.g. "cn" or "uid")
# LDAP_ATTR_EMAIL: Attribute containing the user’s email address (e.g. "mail")
# LDAP_ATTR_EMPLOYEETYPE: Attribute specifying the employee type classification (e.g. "employeetype")
# LDAP_ATTR_NAME: Attribute for the full display name of the user (e.g. "displayname")
# LDAP_INVERT_NAME: If "true", inverts the order of first and last name in display name extraction
#
# LDAP_FILTER: LDAP search filter for user authentication; should reference the username placeholder (e.g., "(|(sAMAccountName={username})(mail={username}))")
# LDAP_DEBUG_MODE: If "true", enables detailed LDAP logging for troubleshooting (not recommended in production)
#
# TEST_USER_LOGIN: If "true", test users are permitted to authenticate; users must be listed in a test users JSON file in the storage folder

#LDAP_HOST=localhost
#LDAP_PORT=389
#LDAP_BIND_DN=dc=local,dc=com
#LDAP_BIND_PW=secret
#LDAP_BASE_DN=
#LDAP_ATTR_USERNAME="cn"
#LDAP_ATTR_EMAIL="mail"
#LDAP_ATTR_EMPLOYEETYPE="employeetype"
#LDAP_ATTR_NAME="displayname"
#LDAP_INVERT_NAME=true
#LDAP_FILTER="(|(sAMAccountName=username)(mail=username))"
#LDAP_DEBUG_MODE="true"
TEST_USER_LOGIN="true"

# -------------------------------
# Shibboleth Configuration
# -------------------------------
# The "target" (login) url will automatically be added to the SHIBBOLETH_LOGIN_URL, so you do not have to configure it manually.
# The same is true for the "return" (logout) url, which will be added to the SHIBBOLETH_LOGOUT_URL.
# SHIBBOLETH_LOGIN_URL: Path to the Shibboleth login handler "{$scheme}://{$_SERVER['HTTP_HOST']}/{$loginPath}{$loginPage}" (defaults to: /Shibboleth.sso/Login)
# SHIBBOLETH_LOGOUT_URL: URL for Shibboleth logout (redirection) (defaults to: /Shibboleth.sso/Logout)
#
# The following values are used to extract user attributes from the Shibboleth environment. All of them MUST be
# available, otherwise the login will fail. The attribute names are case-sensitive.
# They will be searched in the $_SERVER array; make sure your web server is configured to pass them to PHP
# Also, Shibboleth is sometimes weird, so the names will also be found if they are prefixed with "REDIRECT_"
# Meaning if you set SHIBBOLETH_USERNAME_VAR to "uid", the code will search for $_SERVER['uid'] and $_SERVER['REDIRECT_uid']
# SHIBBOLETH_USERNAME_VAR: Defined attribute on shibboleth server for username (defaults to: REMOTE_USER) - This must be a unique identifier; usually the login name
# SHIBBOLETH_NAME_VAR: Defined attribute on shibboleth server for name (defaults to: displayname); usually the full name of the user to display in the UI
# SHIBBOLETH_EMPLOYEETYPE_VAR: Defined attribute on shibboleth server for employee type (defaults to: employee) - Some kind of group membership attribute, used to distinguish between students, staff, etc.
# SHIBBOLETH_EMAIL_VAR: Defined attribute on shibboleth server for email address (defaults to: mail) - used to send email notifications
#
# Special case: SHIBBOLETH_NAME_VAR with multiple attributes:
# You can either define SHIBBOLETH_NAME_VAR as a single attribute that contains the full display name of the user (e.g. "displayname").
# Example: SHIBBOLETH_NAME_VAR="displayName"
# OR set it to a comma separated list of attributes that will be concatenated to form the display name.
# Example: SHIBBOLETH_NAME_VAR="givenName,sn" will concatenate the given name and surname attributes to form the display name.
# As: "givenName" => "John", "sn" => "Doe" will result in the display name "John Doe".


#SHIBBOLETH_LOGIN_URL=""
#SHIBBOLETH_LOGOUT_URL=""
#SHIBBOLETH_USERNAME_VAR="REMOTE_USER"
#SHIBBOLETH_EMAIL_VAR="email"
#SHIBBOLETH_EMPLOYEETYPE_VAR="employeetype"
#SHIBBOLETH_NAME_VAR="displayName"

# -------------------------------
# OpenID Connect (OIDC) Configuration
# -------------------------------
#
# OIDC_IDP: URL of the OpenID Connect Identity Provider
# OIDC_CLIENT_ID: Client ID for the OIDC application
# OIDC_CLIENT_SECRET: Client secret for the OIDC application
# OIDC_LOGOUT_URI: URI for OIDC logout
# OIDC_SCOPES: Scopes define the level of access that the client is requesting from the authorization server.
# OIDC_PKCE_METHOD: The code challenge method for PKCE (Proof Key for Code Exchange). Set to 'S256' to enable PKCE with SHA-256, or leave empty/null to disable.
# OIDC_FIRSTNAME_VAR="firstname"
# OIDC_LASTNAME_VAR="lastname"
# OIDC_EMAIL_VAR="email"
# OIDC_EMPLOYEETYPE_VAR="employeetype"

# OIDC_IDP="https://xxx"
# OIDC_CLIENT_ID="xxx"
# OIDC_CLIENT_SECRET="xxx"
# OIDC_LOGOUT_URI=""
# OIDC_SCOPES=profile,email
# OIDC_PKCE_METHOD=

# OIDC_FIRSTNAME_VAR="firstname"
# OIDC_LASTNAME_VAR="lastname"
# OIDC_EMAIL_VAR="email"
# OIDC_EMPLOYEETYPE_VAR="employeetype"

# ====================================
# External Communication Configuration
# ====================================
#
# ALLOW_EXTERNAL_COMMUNICATION: This setting enables or disables the ability for users to generate and use API keys
# to access HAWKI models. When set to "true", users will be able to create API keys, allowing external applications
# to register and interact with HAWKI using the user's account. This is particularly useful for integrating
# HAWKI with third-party applications or for enabling programmatic access to HAWKI functionalities.
# Ensure that this feature is enabled only if you understand the security implications and have measures
# in place to protect API access and user data.
#
# Example: ALLOW_EXTERNAL_COMMUNICATION="true" or ALLOW_EXTERNAL_COMMUNICATION="false"

ALLOW_EXTERNAL_COMMUNICATION="true"
ALLOW_USER_TOKEN_CREATION="true"

# =======
# Caching
# =======
#
# The following settings allow use a dedicated cache server to speed up some often executed
# code paths like database queries and so on. Usually a very fast storage like Memcached or
# Redis is used for this. By default the local database will be used, which should be fine
# for most installations. So only change these values if you really need to.
#
#  - CACHE_STORE:                 "array", "database", "file", "memcached", "redis", "dynamodb", "octane" (see config/cache.php)
#  - CACHE_PREFIX:                Prefix for cache keys (by default calculated from the app name)
#  - DB_CACHE_TABLE:              ???
#  - DB_CACHE_CONNECTION:         ???
#  - DB_CACHE_LOCK_CONNECTION:    ???
#  - MEMCACHED_HOST:              ???
#  - MEMCACHED_PORT:              ???
#  - MEMCACHED_USERNAME:          ???
#  - MEMCACHED_PASSWORD:          ???
#  - MEMCACHED_PERSISTENT_ID:     ???
#  - REDIS_CACHE_CONNECTION:      cache
#  - REDIS_CACHE_LOCK_CONNECTION: default
#  - DYNAMODB_CACHE_TABLE:        ???
#  - DYNAMODB_ENDPOINT:           ???

CACHE_STORE=database
CACHE_PREFIX=""

## Database Table
#DB_CACHE_TABLE           = cache
#DB_CACHE_CONNECTION      =
#DB_CACHE_LOCK_CONNECTION =

## Memcached
MEMCACHED_HOST="127.0.0.1"
#MEMCACHED_PORT          =
#MEMCACHED_USERNAME      =
#MEMCACHED_PASSWORD      =
#MEMCACHED_PERSISTENT_ID =

## Redis
#REDIS_CACHE_CONNECTION      = cache
#REDIS_CACHE_LOCK_CONNECTION = default

## Amazon DynamoDB (please also set the common AWS values at the end of this file)
#DYNAMODB_CACHE_TABLE  = cache
#DYNAMODB_ENDPOINT     =

# ============
# Redis Server
# ============
#
# This is only needed, if REVERB_SCALING_ENABLED is true, in which case it defines the Redis
# server that will be used by the Reverb instances to synchronize each other. Additionaly
# Redis can be used as a data storage instead of a traditional SQL database, though this would
# normally not be a good idea. And Redis can be used as cache server to replace the default
# cache database table.
#
#  - REDIS_CLIENT:   PHP library used to access the Redis server
#  - REDIS_SERVER:   Hostname of the Redis server
#  - REDIS_PORT:     Port number of the Redis server
#  - REDIS_USERNAME: Username to access the Redis server
#  - REDIS_PASSWORD: Password to access the Redis server
#  - REDIS_DB:       Redis database number for storing normal database entries in Redis
#  - REDIS_CACHE_DB: Redis database number for storing cache entries in Redis
#  - REDIS_CLUSTER:  ???
#  - REDIS_PREFIX:   Prefix for database entry keys (by default calculated from the app name)

# REVERB_APP_KEY="PMU5Y0gmYhHIUw3MmRTOjYhfUpzoXTjQ"
# REVERB_APP_SECRET="2HbFgUEEMLjwcHDNTfb8r8rbObTPICyU"

#REDIS_CLIENT   = phpredis
#REDIS_SERVER   = localhost
#REDIS_PORT     = 6379
#REDIS_USERNAME =
#REDIS_PASSWORD =
#REDIS_DB       = 0
#REDIS_CACHE_DB = 1
#REDIS_CLUSTER  = redis
#REDIS_PREFIX   =

# ========================
# Email Configuration
# ========================
#
# The email configuration settings allow the application to send invitation emails to users,
# enabling them to invite other users to group chats. This feature is currently in beta testing.
# Ensure that the mail server settings are correctly configured to enable email functionality.
#
# MAIL_MAILER: The mailer method to use for sending emails. Typically set to "smtp".
# MAIL_HOST: The hostname of the SMTP server used to send emails.
# MAIL_PORT: The port number used by the SMTP server. Use 465 for SSL or 587 for TLS.
# MAIL_USERNAME: The username for authenticating with the SMTP server.
# MAIL_PASSWORD: The password for authenticating with the SMTP server.
# MAIL_ENCRYPTION: The encryption method used to secure email transmissions. Use 'ssl' for port 465.
# MAIL_FROM_ADDRESS: The email address that will appear as the sender of the invitation emails.
# MAIL_FROM_NAME: The display name that will appear as the sender of the invitation emails.

MAIL_MAILER=log
MAIL_HOST=
MAIL_PORT=# Use 465 for SSL or 587 for TLS
MAIL_USERNAME=
MAIL_PASSWORD=
MAIL_ENCRYPTION=# Use 'ssl' for port 465
MAIL_FROM_ADDRESS=
MAIL_FROM_NAME=

# ==========================
# Encryption Configuration
# ==========================
#
# For enhanced security, HAWKI utilizes individual salts for each component to ensure that data is
# encrypted uniquely. While not mandatory, using unique hash keys for each component is recommended
# to maximize the security of user data, invitations, AI components, passkeys, and backups.
#
# USERDATA_ENCRYPTION_SALT: The salt used specifically for encrypting user data.
# INVITATION_SALT:          The salt used for encrypting invitations data.
# AI_CRYPTO_SALT:           Used to generate a derived key for the AI messages in the groupchat
# PASSKEY_SALT:             The salt used for encrypting passkey data, contributing to robust password and credential security.
# BACKUP_SALT:              The salt used to encrypt backup data, ensuring their security during storage and transfer.

USERDATA_ENCRYPTION_SALT=
INVITATION_SALT=
AI_CRYPTO_SALT=
PASSKEY_SALT=
BACKUP_SALT=

# ==========================
# Links
# ==========================
#
# IMPRINT_LOCATION:          The URL to your organization imprint page.

IMPRINT_LOCATION=