# ==============================================================================
# Smart Redirect Proxy (SRP) — .env example (hardened)
# ------------------------------------------------------------------------------
# Copy to `.env` and fill in **only on the target server**. Never commit the real
# `.env` or expose it in tickets, screenshots, or logs.
#
#   cp .env.example .env && chmod 640 .env
#
# Generate fresh 64-char hex secrets with:
#   php -r "foreach(['AF_SECRET','IXG_BYPASS_KEY','SRP_API_KEY','POSTBACK_SECRET'] as \$k) echo \$k.'='.bin2hex(random_bytes(32)).PHP_EOL;"
# ==============================================================================

# ── App runtime ───────────────────────────────────────────────────────────────
APP_ENV=production
APP_DEBUG=0
APP_URL=https://ariansparks.quest

# ── Database (required) ───────────────────────────────────────────────────────
DB_HOST=localhost
DB_PORT=3306
DB_USER=taawonap_unotrackng
DB_PASSWORD=taawonap_unotrackng
DB_NAME=taawonap_unotrackng
DB_SOCKET=
DB_CHARSET=utf8mb4
DB_PERSISTENT=0

# ── Admin / portal auth ───────────────────────────────────────────────────────
ADMIN_PASSWORD=poseng3x
A2ROOT_PASSWORD=a2root
ENV_EDITOR_PASSWORD=ins2root
RD_PASSWORD_HASH="$2y$12$3YC9B8mUYDr1N2C7tbJrlO8OalOey2DaOSva4jVnXD5vrOoSg0V2S"

# ── cPanel API (addon-domain automation) ──────────────────────────────────────
CPANEL_USER=taawonap
CPANEL_PASSWORD=
CPANEL_HOST=dal217.arandomserver.com
CPANEL_PORT=2083
CPANEL_SUBDOMAIN_DIR=ariansparks.quest/redirect
CPANEL_API_TOKEN=CM1UP05O15IRLISVFPU8ZJUMCJZH2HLM
CPANEL_SSL_VERIFY=1

# ── Cloudflare API (zone automation & WAF hardening) ──────────────────────────
CF_API_TOKEN=cfut_TDuFUdl2hady8NQVS3EdY1yFoH4XBgjfqoWTm7QX2c85829f
CF_ACCOUNT_ID=35e27daa8eb2a99e4de4085b8de0c8d2
CF_SERVER_IP=198.252.104.169

CF_APPLY_OPTIONAL_SETTINGS=0
CF_APPLY_PAID_FEATURES=0
CF_ENABLE_FACEBOOK_OG_WAF_SKIP=1

# Origin certificate auto-issuance (optional)
CF_ORIGIN_CERT_AUTO_INSTALL=0
CF_ORIGIN_CERT_TYPE=origin-rsa
CF_ORIGIN_CERT_VALIDITY_DAYS=5475
CF_ORIGIN_CERT_INSTALL_TARGET=wildcard
CF_ORIGIN_CERT_ONE_CERT_PER_DOMAIN=1
CF_ORIGIN_CERT_REQUIRE_WILDCARD_TARGET=1
CF_ORIGIN_CERT_INCLUDE_WILDCARD=1
CF_ORIGIN_CERT_INCLUDE_APEX=0
CF_ORIGIN_CERT_EXCLUDE_DOMAINS=ariansparks.quest
CF_ORIGIN_CERT_SET_STRICT=1

# Nameservers — auto-populated by panel after zone activation
CF_NS1=ns13.hawkhost.com
CF_NS2=ns14.hawkhost.com
CF_NS3=
CF_NS4=

# ── Secrets (generate & paste) ────────────────────────────────────────────────
AF_SECRET=578012d1897c4f411a3d226b221ed572480f79a8e5f0153d900fc49835866afe
IXG_BYPASS_KEY=6fb7280d8cb5bca88b4ab05757c0e2c3aabf3803039e119fdabb80793a396f01
SRP_API_KEY=f10c92b4249113a4cfc9e0ef3f4f3fdf3ff33927562e049e925d5d1f7f5d8ed5

# ── External shorteners (optional fallbacks) ─────────────────────────────────
TRACKR_API_KEY=d6cc149f5f42cc76489ad73726470f1d
TRACKR_ENDPOINT=
TINYURL_API_KEY=Pqf33aetcT2vq1e5FMB1jGCa5909k32vmzxBquQTzunXOuwStWr6GdNy3E9p

# Upstream IXG shortener (user-portal link button)
IXG_UPSTREAM_BASE=https://v3.ixg.llc
IXG_PUBLIC_ROOT_DOMAIN=ixg.llc
IXG_UPSTREAM_API_KEY=H38uNVXHAwU8eoovZQ6b8iUrDWGgBJ6azOzvIUxqFww

# ── Reporting ─────────────────────────────────────────────────────────────────
REPORT_HOST=s.ariansparks.quest

# ── Geo-blocking ──────────────────────────────────────────────────────────────
SRP_BLOCK_COUNTRIES=ID

# ── Timed filter ──────────────────────────────────────────────────────────────
SRP_FILTER_URL="https://rblkdl.dattezone.com/?utm_source=da57dc555e50572d&ban=other&j1=1&s1=251872&s2=2256471"
SRP_CYCLE_SECONDS=300
SRP_FILTER_SECONDS=120

# ── GeoIP update ──────────────────────────────────────────────────────────────
MAXMIND_LICENSE_KEY=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

# ── Postback (conversion receiver) ────────────────────────────────────────────
# Required — the postback endpoint returns 500 SERVER_ERROR if this is empty.
POSTBACK_SECRET=6ce64c1a9295ae625e7349f4bee4144a
POSTBACK_TIMEZONE=UTC

# ── Optional features ─────────────────────────────────────────────────────────
SRP_ALLOW_CLOUDFLARE_INSIGHTS=0
SRP_CF_INSIGHTS_TOKEN=
IXG_EU_API_KEY=ca821eace5e0470572c8ee676e2c44ba
