# ────────────────────────────────────────────────────────────────────
# CompleCare API — environment template
# Copy to .env and fill in. NEVER commit a populated .env.
# Production values come from AWS Secrets Manager via the boot script.
# ────────────────────────────────────────────────────────────────────

# ─── App ─────────────────────────────────────────────────────────────
APP_NAME=CompleCare
APP_ENV=staging
APP_KEY=base64:4vdosjl/I6nahPhdIFqN+wSn9QKe7fwYaj+JnkkGPuQ=
# Separate from APP_KEY — rotated independently. Used for blind-index HMAC
# over encrypted PII (national IDs, patient name search).
BLIND_INDEX_KEY=
APP_DEBUG=true
APP_URL=http://172.20.10.2:8000
APP_TIMEZONE=Africa/Accra
APP_LOCALE=en
APP_FAKER_LOCALE=en_GH

# Front-end origins (CORS allowlist — comma-separated)
APP_TRUSTED_ORIGINS="http://localhost:5173,http://localhost:8081,http://172.20.10.2:8081"

# ─── Logging ─────────────────────────────────────────────────────────
LOG_CHANNEL=stack
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

# Sentry (real impl)
SENTRY_LARAVEL_DSN=
SENTRY_TRACES_SAMPLE_RATE=0.2

# ─── Database (PostgreSQL) ───────────────────────────────────────────
DB_CONNECTION=pgsql
DB_HOST=127.0.0.1
DB_PORT=5432
DB_DATABASE=C0mpl3car3
DB_USERNAME=postgres
DB_PASSWORD=Omarion@2024!

# Read replica for Metabase / reporting
DB_READ_HOST=
DB_READ_USERNAME=
DB_READ_PASSWORD=

# ─── Redis (cache + queue + sessions) ────────────────────────────────
# REDIS_HOST=redis
# REDIS_PASSWORD=null
# REDIS_PORT=6379
# REDIS_CACHE_DB=1
# REDIS_QUEUE_DB=2
# REDIS_SESSION_DB=3

REDIS_CLIENT=predis
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379
REDIS_CACHE_DB=1
REDIS_QUEUE_DB=2
REDIS_SESSION_DB=3

CACHE_STORE=redis
QUEUE_CONNECTION=redis
SESSION_DRIVER=redis
SESSION_LIFETIME=120

REVERB_APP_ID=complecare
REVERB_APP_KEY=complecare-local
REVERB_APP_SECRET=complecare-secret123

REVERB_HOST=localhost
REVERB_PORT=8080
REVERB_SCHEME=http

# Internal server hosts required for Docker to listen correctly:
REVERB_SERVER_HOST=0.0.0.0
REVERB_SERVER_PORT=8080

# ─── Sanctum auth ────────────────────────────────────────────────────
SANCTUM_STATEFUL_DOMAINS="localhost:5173,localhost:8081,http://172.20.10.2:8081"
SANCTUM_TOKEN_PREFIX=cc_
SANCTUM_ACCESS_TOKEN_TTL_MIN=15
SANCTUM_REFRESH_TOKEN_TTL_DAYS=30

# ─── Mail (transactional) ────────────────────────────────────────────
MAIL_MAILER=smtp
MAIL_HOST=mailpit
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS="hello@complecare.example"
MAIL_FROM_NAME="${APP_NAME}"

# MAIL_MAILER=postmark
# MAIL_FROM_ADDRESS="no-reply@complecare.example"
# MAIL_FROM_NAME="CompleCare"
# POSTMARK_TOKEN=
# fallback: AWS SES
SES_KEY=
SES_SECRET=
SES_REGION=eu-west-1

# ─── SMS (Ghana primary: Hubtel; secondary: Africa's Talking) ────────
SMS_PROVIDER=arkesel
SMS_FALLBACK=hubtel
# ─── Arkesel (SMS / OTP primary) ─────────────────────────────────────
# Get the API key from https://account.arkesel.com → Developer → API Keys.
# Sender ID must be pre-approved; production is "CompleCare".
ARKESEL_API_KEY=RlBHU1N6bVFNdEFvQ3FOcU5ieVY
ARKESEL_SENDER_ID=CompleCare
ARKESEL_BASE_URL=https://sms.arkesel.com/api/v2/sms/send
# Optional — Arkesel will POST delivery receipts here if set.
ARKESEL_CALLBACK_URL=
HUBTEL_CLIENT_ID=
HUBTEL_CLIENT_SECRET=
HUBTEL_SENDER_ID=CompleCare
MNOTIFY_API_KEY=
MNOTIFY_SENDER_ID=CompleCare

# ─── Africa's Talking (voice primary, SMS secondary, WhatsApp, USSD, Airtime) ───
AT_USERNAME=sandbox
AT_API_KEY=
AT_VOICE_FROM=
AT_SMS_SENDER_ID=CompleCare
AT_WHATSAPP_PHONE_NUMBER=
AT_WHATSAPP_ACCOUNT_ID=
AT_WEBHOOK_SECRET=
AT_BASE_URL=https://api.africastalking.com/version1
AT_VOICE_BASE_URL=https://voice.africastalking.com

# ─── Voice (Africa's Talking primary, Hubtel critical-call fallback) ──
VOICE_PROVIDER=at
VOICE_FALLBACK=hubtel
HUBTEL_VOICE_FROM=

# ─── Video (Daily.co) ────────────────────────────────────────────────
VIDEO_PROVIDER=daily
DAILY_API_KEY=
DAILY_SUBDOMAIN=complecare
DAILY_WEBHOOK_SECRET=
DAILY_BASE_URL=https://api.daily.co/v1

# ─── Payments (Paystack primary; Hubtel fallback) ────────────────────
PAYMENT_PROVIDER=paystack
PAYSTACK_PUBLIC_KEY=pk_test_3e9063d08a13cbaee2c32dbb6f87da0837946605
PAYSTACK_SECRET_KEY=sk_test_fed2ede2bf0d8743ec62ccf2a0e7e369894e318e
PAYSTACK_WEBHOOK_SECRET=sk_test_fed2ede2bf0d8743ec62ccf2a0e7e369894e318e
HUBTEL_PAY_CLIENT_ID=
HUBTEL_PAY_CLIENT_SECRET=

# ─── Push notifications (FCM via Expo) ───────────────────────────────
EXPO_PUSH_ACCESS_TOKEN=
FCM_SERVER_KEY=
PUSH_DRIVER=fcm
FCM_PROJECT_ID=complecare-91a87
FCM_CREDENTIALS_PATH=/storage/app/fcm.json

# ─── Storage (S3-compatible) ─────────────────────────────────────────
FILESYSTEM_DISK=s3
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=eu-west-1
AWS_BUCKET=complecare-prod-phi
AWS_URL=
AWS_ENDPOINT=
AWS_USE_PATH_STYLE_ENDPOINT=false
AWS_PHI_KMS_KEY_ID=

# ─── Identity verification (Ghana Card, future) ──────────────────────
SMILEID_PARTNER_ID=
SMILEID_API_KEY=
SMILEID_ENV=sandbox

# ─── Feature flags / runtime config ──────────────────────────────────
FEATURE_DEVICE_VITALS=false
FEATURE_AI_TRANSCRIPTS=false
FEATURE_FHIR_EXPORT=false

# ─── Horizon (queue dashboard) ───────────────────────────────────────
HORIZON_PREFIX=complecare:horizon:
HORIZON_DOMAIN=

# ─── Telescope (dev only — NEVER enable in prod) ─────────────────────
# Perf knobs — keep Telescope + Debugbar off unless actively diagnosing.
# Each of these can add 500–1500ms to every API request because they
# capture queries / model events / view renders on the synchronous path.
TELESCOPE_ENABLED=false
DEBUGBAR_ENABLED=false

# bcrypt cost — 12 is fine for prod; 10 in dev cuts ~200ms off every login.
BCRYPT_ROUNDS=10

# ─── Pulse (production performance dashboard) ────────────────────────
PULSE_ENABLED=true

# ─── Backup (Spatie) ─────────────────────────────────────────────────
BACKUP_ARCHIVE_PASSWORD=
BACKUP_DISK=s3
BACKUP_NOTIFY_EMAIL=ops@complecare.example

# ─── Two-factor auth for staff (Google Authenticator) ────────────────
GOOGLE2FA_ENABLED=true
GOOGLE2FA_WINDOW=2

# Force real SMS provider even when APP_ENV=local (overrides the env gate).
SMS_FORCE_REAL=true

# OTP throttle — eased on staging for back-to-back testing.
OTP_COOLDOWN_SECONDS=5
OTP_MAX_PER_HOUR=60
