.env.example

APP_NAME=Laravel
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://streaming.test

# Most of what an installation is - its name and copy, the sign-in providers, chat
# limits, the archive bucket, the playback secrets, the container images - is edited
# at /manage > Settings and stored in the database. A value here is the shipped
# fallback for a path nobody has saved a row against, so a saved row always wins and
# there is never a second source to disagree with. See docs/admin/settings.md.
#
# What is left below is what the panel cannot hold: the bootstrap this file has to
# answer before there is a database, and the values the local video stack reads out
# of this file directly, because a container is not a Laravel process.
#
# A fresh install has nobody who can reach the panel yet. Make an administrator:
#   php artisan auth:local-admin you@example.org
# See docs/admin/authentication.md.
#
# For a deploy that wants to arrive already configured, the same write from a shell:
#   php artisan branding:set site_name="My Con" primary_color="#0e7490"
#   php artisan branding:set --list
#
# Upgrading an installation that configured everything here? Move it across once, after
# migrating. The dry run is the default and prints what it would do:
#   php artisan settings:import-env
#   php artisan settings:import-env --write

LOG_CHANNEL=stack
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

DB_CONNECTION=pgsql
DB_HOST=127.0.0.1
DB_PORT=5432
DB_DATABASE=ef_streaming
DB_USERNAME=postgres
DB_PASSWORD=

BROADCAST_DRIVER=reverb
CACHE_DRIVER=file
FILESYSTEM_DISK=local
QUEUE_CONNECTION=database
SESSION_DRIVER=file
# 4 weeks, in minutes. Matches AUTH_REMEMBER_LIFETIME so attendees stay signed in.
SESSION_LIFETIME=40320
AUTH_REMEMBER_LIFETIME=40320

# Valkey/Redis (production uses this for cache, queue via Horizon, and Reverb scaling)
REDIS_CLIENT=phpredis
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_PASSWORD=null

# Mail. Password resets and address confirmation are sent from here, so an
# installation with public registration on needs a transport that works. An
# installation without one confirms addresses by hand in /manage > Users.
MAIL_MAILER=smtp
MAIL_HOST=127.0.0.1
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS="hello@example.com"
MAIL_FROM_NAME="${APP_NAME}"

# The general bucket: emotes, thumbnails, the branding logo. Not in the panel,
# because the panel renders its own uploads through this disk and a mistyped
# credential would take away the page that fixes it.
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_USE_PATH_STYLE_ENDPOINT=false

# The archive bucket recordings are cut from. Edited at /manage > Settings >
# Archive storage, and kept here because scripts/vod-to-archive.sh and the local
# dev stack read it out of this file rather than out of the database.
#
# The origin's uploader is handed its own copy when the server is provisioned, so
# changing the bucket in the panel leaves every existing origin writing to the old
# one. Regenerate and reinstall the origin, or nothing new reaches the archive.
DVR_AWS_ACCESS_KEY_ID=
DVR_AWS_SECRET_ACCESS_KEY=
DVR_AWS_DEFAULT_REGION=eu-west-1
DVR_AWS_BUCKET=recording
DVR_AWS_USE_PATH_STYLE_ENDPOINT=true
DVR_AWS_ENDPOINT=https://s3.your-server.com
DVR_AWS_URL=https://s3.your-server.com/recording

# System streamkey for internal operations (thumbnails, monitoring, the archive
# uploader, the operator preview). Edited at /manage > Settings > Tokens and keys;
# kept here because the local dev stack's containers read it from this file.
# Generate a secure random string for production.
STREAM_SYSTEM_STREAMKEY=

# Playback token secrets, shared with every edge server so it can verify tokens
# locally without calling back into Laravel. Two separate secrets so a leak of
# the viewer secret cannot mint long-lived embed keys. Edited at /manage > Settings >
# Tokens and keys; here for the same reason as the streamkey.
#
# Every edge holds its own copy, so rotating one in the panel 403s every viewer
# until each edge is reinstalled. Do it between shows.
# Generate with: openssl rand -hex 32
HLS_VIEWER_SECRET=
HLS_EMBED_SECRET=

# The grace window edges allow past a token's expiry. The edge and the app both hold
# it and they have to agree, or tokens fail intermittently at refresh boundaries.
# The rest of the token timings - lifetime, reuse window, refresh margin - are app
# side only and live in /manage > Settings > Tokens and keys.
HLS_TOKEN_LEEWAY=60

REVERB_APP_ID=my-app-id
REVERB_APP_KEY=my-app-key
REVERB_APP_SECRET=my-app-secret
REVERB_HOST=localhost
REVERB_PORT=8081
REVERB_SCHEME=http

REVERB_SERVER_HOST=0.0.0.0
REVERB_SERVER_PORT=8081
REVERB_MAX_REQUEST_SIZE=250000
REVERB_APP_MAX_MESSAGE_SIZE=100000
REVERB_SCALING_ENABLED=false
REVERB_PULSE_INGEST_INTERVAL=15

PUSHER_APP_ID="${REVERB_APP_ID}"
PUSHER_APP_KEY="${REVERB_APP_KEY}"
PUSHER_APP_SECRET="${REVERB_APP_SECRET}"
PUSHER_HOST="${REVERB_HOST}"
PUSHER_PORT="${REVERB_PORT}"
PUSHER_SCHEME="${REVERB_SCHEME}"
PUSHER_APP_CLUSTER=mt1

# Baked into the JS bundle at build time, so these cannot move into the panel and
# have to agree with their server-side twins above.
VITE_APP_NAME="${APP_NAME}"
VITE_REVERB_APP_KEY="${REVERB_APP_KEY}"
VITE_REVERB_HOST="${REVERB_HOST}"
VITE_REVERB_PORT="${REVERB_PORT}"
VITE_REVERB_SCHEME="${REVERB_SCHEME}"

# Servers and DNS. These are shipped defaults only: /manage > Settings > Servers
# overlays them, and a saved value always wins.
CLOUD_DRIVER=hetzner
HETZNER_TOKEN=

# rfc2136 while the nsupdate settings are the only ones set; `none` writes no records.
DNS_DRIVER=
DNS_ZONE=stream.example.org
DNS_TTL=60

# rfc2136 / nsupdate
DNS_SERVER=
DNS_KEY_NAME=stream-ddns
DNS_KEY_ALGORITHM=hmac-sha256
DNS_KEY_SECRET=

# Cloudflare and Hetzner DNS. The Hetzner DNS token is not the Cloud one.
CLOUDFLARE_DNS_TOKEN=
HETZNER_DNS_TOKEN=