2FAuth/.env.example

# You can change the name of the app

APP_NAME=2FAuth


# You can leave this on "local". If you change it to production most console commands will ask for extra confirmation.
# Never set it to "testing".

APP_ENV=local


# Set to true if you want to see debug information in error screens.

APP_DEBUG=false


# This should be your email address

SITE_OWNER=mail@example.com


# The encryption key for your database and sessions. Keep this very secure.
# If you generate a new one all existing data must be considered LOST.
#
# You can leave this empty if you use `php artisan 2fauth:install`.
# Otherwise, change it to a string of exactly 32 chars or use command
# `php artisan key:generate` to generate it.

APP_KEY=


# This variable must match your installation's external address.
# Webauthn won't work otherwise.

APP_URL=http://localhost


# If you want to serve js assets from a CDN (like https://cdn.example.com),
# uncomment the following line and set this var with the CDN url.
# Otherwise, let this line commented.

# ASSET_URL=http://localhost


# The domain subdirectory from which you want to serve 2FAuth.
# This must reflect the path targeted by APP_URL.
#
# For example, if you set APP_URL=https://mydomain.org/2fa to access 2FAuth from the '/2fa/' subdirectory
# you have to set APP_SUBDIRECTORY=2fa
#
# Leave blank if you serve 2FAuth from the domain root.

APP_SUBDIRECTORY=


# Turn this to true if you want your app to react like a demo.
# The Demo mode reset the app content every hours and set a generic demo user.

IS_DEMO_APP=false


# The log channel defines where your log entries go to.
# 'daily' is the default logging mode giving you 7 daily rotated log files in /storage/logs/.
# Also available are 'errorlog', 'syslog', 'stderr', 'papertrail', 'slack' and a 'stack' channel
# to combine multiple channels into a single one.

LOG_CHANNEL=daily


# Log level. You can set this from least severe to most severe:
# debug, info, notice, warning, error, critical, alert, emergency
# If you set it to debug your logs will grow large, and fast. If you set it to emergency probably
# nothing will get logged, ever.

LOG_LEVEL=notice


# If you're looking for performance improvements, you could install memcached.

CACHE_DRIVER=file
SESSION_DRIVER=file
FILESYSTEM_DRIVER=local


#### Database config & credentials ####

# Supported values for DB_CONNECTION: mysql|pgsql|sqlsrv|sqlite
# mysql => MySQL
# pgsql => PostGreSQL
# sqlsrv => SQL server
# sqlite => SQLite

# Example for a MySQL database connection
#
# DB_CONNECTION=mysql
# DB_DATABASE=my_2fauth_DB_name
# DB_HOST=127.0.0.1
# DB_PORT=3306
# DB_USERNAME=my_2fauth_db_user
# DB_PASSWORD=My_d8_S3cr3t

# Example for SQLite (linux)
#
# DB_CONNECTION=sqlite
# DB_DATABASE="path/to/your/database.sqlite"

# Example for SQLite (windows)
#
# DB_CONNECTION=sqlite
# DB_DATABASE="C:\\path\\to\\your\\database.sqlite"

DB_CONNECTION=
DB_DATABASE=
DB_HOST=
DB_PORT=
DB_USERNAME=
DB_PASSWORD=

# The absolute path to the root CA bundle if you're connecting to the MySQL database via SSL.

MYSQL_ATTR_SSL_CA=


#### Mail settings ####

# Refer your email provider documentation to configure your mail settings
# Set a value for every available setting to avoid issue

MAIL_MAILER=log
MAIL_HOST=smtp.mailtrap.io
MAIL_PORT=2525
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_NAME=null
MAIL_FROM_ADDRESS=null


# SSL peer verification.
# Set this to false to disable the SSL certificate validation.
#
# WARNING
# Disabling peer verification can result in a major security flaw.
# Change it only if you know what you're doing.

MAIL_VERIFY_SSL_PEER=true


#### API settings ####

# The maximum number of API calls in a minute from the same IP.
# Once reached, all requests from this IP will be rejected until the minute has elapsed.
#
# Set to null to disable the API throttling.

THROTTLE_API=60


#### Authentication settings ####

# The number of times per minute a user can fail to log in before being locked out.
# Once reached, all login attempts will be rejected until the minute has elapsed.
#
# This setting applies to both email/password and webauthn login attemps.

LOGIN_THROTTLE=5

# The default authentication guard
#
# Supported:
#   'web-guard' : The Laravel built-in auth system (default if nulled)
#   'reverse-proxy-guard' : When 2FAuth is deployed behind a reverse-proxy that handle authentication
#
# WARNING
# When using 'reverse-proxy-guard' 2FAuth only look for the dedicated headers and skip all other built-in
# authentication checks. That means your proxy is fully responsible of the authentication process, 2FAuth will
# trust him as long as headers are presents.

AUTHENTICATION_GUARD=web-guard


# Name of the HTTP headers sent by the reverse proxy that identifies the authenticated user at proxy level.
# Check your proxy documentation to find out how these headers are named (i.e 'REMOTE_USER', 'REMOTE_EMAIL', etc...)
# (only relevant when AUTHENTICATION_GUARD is set to 'reverse-proxy-guard')

AUTH_PROXY_HEADER_FOR_USER=null
AUTH_PROXY_HEADER_FOR_EMAIL=null


# Custom logout URL to open when using an auth proxy.

PROXY_LOGOUT_URL=null


#### WebAuthn settings ####

# Relying Party name, aka the name of the application.
# If blank, defaults to APP_NAME. Do not set to null.

WEBAUTHN_NAME=2FAuth


# Relying Party ID, should equal the site domain (i.e 2fauth.example.com).
# If null, the device will fill it internally (recommended)
# See https://webauthn-doc.spomky-labs.com/prerequisites/the-relying-party#how-to-determine-the-relying-party-id

WEBAUTHN_ID=null

# [DEPRECATED]
# Optional image data in BASE64 (128 bytes maximum) or an image url
# See https://webauthn-doc.spomky-labs.com/prerequisites/the-relying-party#relying-party-icon

# WEBAUTHN_ICON=null
# [/DEPRECATED]


# Use this setting to control how user verification behave during the
# WebAuthn authentication flow.
#
# Most authenticators and smartphones will ask the user to actively verify
# themselves for log in. For example, through a touch plus pin code,
# password entry, or biometric recognition (e.g., presenting a fingerprint).
# The intent is to distinguish one user from any other.
#
# Supported:
#   'required': Will ALWAYS ask for user verification
#   'preferred' (default) : Will ask for user verification IF POSSIBLE
#   'discouraged' : Will NOT ask for user verification (for example, to minimize disruption to the user interaction flow)

WEBAUTHN_USER_VERIFICATION=preferred


#### SSO settings (for Socialite) ####

# Uncomment and complete lines for the OAuth providers you want to enable.

# OPENID_AUTHORIZE_URL=
# OPENID_TOKEN_URL=
# OPENID_USERINFO_URL=
# OPENID_CLIENT_ID=
# OPENID_CLIENT_SECRET=

# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=


#### Proxy settings ####

# Use this setting to declare trusted proxied.
# Supported:
#   '*': to trust any proxy
#   A comma separated IP list: The list of proxies IP to trust

TRUSTED_PROXIES=null


# Proxy for outgoing requests like new releases detection or logo fetching.
# You can provide a proxy URL that contains a scheme, username, and password.
# For example, "http://username:password@192.168.16.1:10".

PROXY_FOR_OUTGOING_REQUESTS=null


# Leave the following configuration vars as is.
# Unless you like to tinker and know what you're doing.

BROADCAST_DRIVER=log
QUEUE_DRIVER=sync

REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

PUSHER_APP_ID=
PUSHER_APP_KEY=
PUSHER_APP_SECRET=
PUSHER_APP_CLUSTER=mt1

VITE_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
VITE_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"

MIX_ENV=local