config.sample.php

<?php

$host = $_SERVER['HTTP_HOST'] ?? 'localhost';
// X-Forwarded-Proto covers deployments behind a reverse proxy (e.g. nginx
// terminating SSL and proxying to this app over plain HTTP) -- without it,
// HTTPS sites behind such a proxy generate http:// URLs for every asset/form
// action, which browsers block as mixed content once loaded over HTTPS.
$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || ($_SERVER['SERVER_PORT'] ?? 80) == 443 || ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https') ? "https" : "http";

// ---- Base URL ----
$config['base_url']       = $protocol . '://' . $host . '/';

// ---- Database Configuration ----
// Read from environment variables (set by docker-compose.yml's `environment:`
// block, or by system/env.php loading a local .env file for non-Docker
// installs) rather than hardcoded here -- see .env.example. Fallbacks below
// only apply if no environment value is present at all.
// For the bundled docker-compose.yml, db_host should be the service name ('db'),
// not 'localhost' — the app and database run in separate containers.
$config['db_host']        = getenv('DB_HOST') ?: 'db';
$config['db_username']    = getenv('DB_USERNAME') ?: 'workflow';
$config['db_password']    = getenv('DB_PASSWORD') ?: 'CHANGE_ME';
$config['db_name']        = getenv('DB_DATABASE') ?: 'workflow_platform';

// ---- System Settings ----
$config['default_controller'] = 'in';
$config['error_controller']   = 'err';
$config['error_log']          = 'error.log';
// Set to true only for local development — leaving this on in a public-facing
// install leaks stack traces and file paths (including the DB password above)
// to anyone who triggers a PHP error.
$config['debug_mode']         = false;
$config['app_name']           = 'WorkFlow';
$config['version']            = '1.0';
$config['default_language']   = 'en';

// ---- Storage Configuration ----
$config['default_storage']    = 'local'; // 'local' or 's3'
$config['upload_dir']         = 'uploads/'; // local upload folder

// ---- Field Encryption (Note Keeper + Team Chat content) ----
// AES-256 key, base64-encoded, read from the environment (see .env.example).
// Generate one with:
//   php -r "echo base64_encode(random_bytes(32));"
// Losing this key makes every encrypted note/message permanently unreadable —
// there is no recovery path. Back it up somewhere outside this repo.
$config['encryption_key']     = getenv('WORKFLOW_ENCRYPTION_KEY') ?: 'CHANGE_ME_GENERATE_A_NEW_KEY';

?>