<?php
/**
 * Key Lair — configuration
 *
 * Copy this file to config.php and fill in your real values.
 * config.php is never committed / shipped — only this sample is.
 */

return [
    // --- Database -----------------------------------------------------
    'db' => [
        'host'     => '127.0.0.1',
        'port'     => 3306,
        'database' => 'key_lair',
        'username' => 'key_lair_admin',
        'password' => 'CHANGE_ME',
        'charset'  => 'utf8mb4',
    ],

    // --- Application ----------------------------------------------------
    'app' => [
        // Full base URL of the site, no trailing slash. Used for building
        // claim links shown in the admin panel.
        'base_url' => 'https://keys.example.com',

        // Used as the TOTP "issuer" label shown in authenticator apps.
        'name' => 'Key Lair',

        // Set to true only while diagnosing an installation problem —
        // never leave this on in production, it can leak internal paths.
        'debug' => false,
    ],

    // --- Mail -----------------------------------------------------------
    'mail' => [
        // Used as the "From" address on emails like password resets. Sent
        // via PHP's built-in mail(), which hands off to the mail transfer
        // agent configured on the server (see install/INSTALL.md) — no
        // external mail service or library needed.
        'from_address' => 'no-reply@keys.example.com',
        'from_name' => 'Key Lair',
    ],

    // --- Security ---------------------------------------------------------
    'security' => [
        // Random 32+ byte string, unique per installation. Used to encrypt
        // two-factor secrets at rest. Generate with:
        //   php -r "echo bin2hex(random_bytes(32));"
        'encryption_key' => 'CHANGE_ME_64_HEX_CHARACTERS',

        // Rate limiting: requests allowed per window, per IP, per endpoint.
        'rate_limit_claim_max_requests' => 20,
        'rate_limit_claim_window_seconds' => 60,
    ],
];
