# <?php exit('No direct script access allowed'); ?>
# InvoicePlane Configuration File

### START HERE
# Set your URL without trailing slash here, e.g. http://your-domain.com
# If you use a subdomain, use http://subdomain.your-domain.com
# If you use a subfolder, use http://your-domain.com/subfolder
IP_URL=[[softurl]]

# Having problems? Enable debug by changing the value to 'true' to enable advanced logging
ENABLE_DEBUG=false

# Having saving troubles?
# Uncomment to disable csrf regenerated on each page load and POST (AJAX)
# CSRF_REGENERATE=false
# Disable server csrf check on each POST (AJAX)
# CSRF_PROTECTION=false

# To Show all PHP errors, change the value to 'development' (Or comment the following line)
CI_ENV=production

X_FRAME_OPTIONS=SAMEORIGIN
ENABLE_X_CONTENT_TYPE_OPTIONS=true

# Session settings
# Leave SESS_SAVE_PATH empty to use PHP's default session save path (sys_get_temp_dir()).
# To store sessions elsewhere, e.g. outside the document root, set an absolute path:
#   SESS_SAVE_PATH=/srv/invoiceplane/sessions
SESS_SAVE_PATH='[[softpath]]/storage/framework/sessions'
# Override the session cookie name
SESS_COOKIE_NAME=ip_session
# Override the session database table name (only used when SESS_DRIVER=database)
SESS_TABLE_NAME=ip_sessions
# Destroy the old session ID after regeneration — prevents session fixation attacks.
SESS_REGENERATE_DESTROY=true

# Set this setting to 'true' if you want to disable the setup for security purposes
DISABLE_SETUP=[[setup_value]]

# To remove index.php from the URL, set this setting to 'true'.
# Please notice the additional instructions in the htaccess file!
REMOVE_INDEXPHP=false

# These database settings are set during the initial setup
DB_HOSTNAME="[[softdbhost]]"
DB_USERNAME="[[softdbuser]]"
DB_PASSWORD="[[softdbpass]]"
DB_DATABASE="[[softdb]]"
DB_PORT=3306

# If you want to be logged out after closing your browser window, set this setting to 0 (ZERO).
# The number represents the amount of minutes after that IP will automatically log out users,
# the default is 10 days.
SESS_EXPIRATION=864000
SESS_MATCH_IP=true
# Database table used to store sessions when SESS_DRIVER=database.
# Only needed if you override the default table name.
SESS_TABLE_NAME=ip_sessions
# Name of the session cookie sent to the browser.
# Only needed if you need to avoid a collision with another application on the same domain.
SESS_COOKIE_NAME=ip_session

# Default Global Amounts Calculation mode - Since 1.6.3
# This change Taxes and discounts calcuation mode
# true  : Taxes: Global Y, Item Y. Use classic calculation for Discounts & Taxes : Use same calculation as previous v1.6.3 (Default)
# false : Taxes: Global N, Item Y. Use simple item tax calculation system : Calculate Global discount before Item discount (without tax) and apply item tax on discounted total price
# Notes :
#   • "when the client use e-invoice": This is automatically overridden to false by default to use "simple tax" calculation system. It for valid xml data for european models***
#   • Dev Note: If you really need to override by true, just add 'legacy_calculation' => true in `$xml_settings`. (See helpers/XMLconfigs/README.md)
#   • *** When use Facturx10Xml and Ubl24Xml XMLtemplates based. Download here: https://github.com/InvoicePlane/InvoicePlane-e-invoices
LEGACY_CALCULATION=true

# Enable the deletion of invoices
ENABLE_INVOICE_DELETION=false

# Disable the read-only mode for invoices
DISABLE_READ_ONLY=false

# Password reset rate limiting settings (since v1.6.4)
# Maximum password reset attempts per IP address within the time window
PASSWORD_RESET_IP_MAX_ATTEMPTS=5
# Time window in minutes for IP-based rate limiting
PASSWORD_RESET_IP_WINDOW_MINUTES=60
# Maximum password reset attempts per email address within the time window
PASSWORD_RESET_EMAIL_MAX_ATTEMPTS=3
# Time window in hours for email-based rate limiting
PASSWORD_RESET_EMAIL_WINDOW_HOURS=1

# Password reset token expiration (since v1.7.2)
# Time in minutes before a password reset token expires (default: 15 minutes)
# This prevents indefinite token validity and reduces account takeover risk
PASSWORD_RESET_TOKEN_EXPIRY_MINUTES=15

# Sumex Customizations (Swiss Medical Invoices)
# Need one (or more) Name containing "sumex" in invoice groups
# Settings panel: true to Enable - Since v-1.6.3
SUMEX_SETTINGS=false
# Set the url where post the xml to get a generated pdf - Since v-1.5.0. See https://github.com/InvoicePlane/InvoicePlane/pull/453
SUMEX_URL=

# Security: Strip EXIF metadata from uploaded images
# When enabled, removes GPS coordinates, timestamps, camera info, and other metadata from uploaded images
# This protects user privacy but may slightly reduce image quality
# Default: false (disabled)
SEC_STRIP_EXIF_FROM_IMAGES=false

# Path to a directory containing custom templates (optional)
# Useful for persistent custom templates when running in a container.
# Set an absolute path; the directory should mirror the built-in structure:
#   <path>/invoice_templates/pdf/
#   <path>/invoice_templates/public/
#   <path>/quote_templates/pdf/
#   <path>/quote_templates/public/
CUSTOM_TEMPLATES_FOLDER=

# Explicit allowlist of custom template names (without .php extension).
#
# Security: The filesystem is NEVER scanned for templates (prevents Remote Code Execution).
# Only template names listed here are made available in the UI.
# Names must contain only letters, digits, spaces, hyphens, and underscores.
#
# Format: comma-separated names. Quote the whole value when names contain spaces or hyphens.
#   CUSTOM_INVOICE_TEMPLATES_PDF="My Template,Another Template"
#   CUSTOM_INVOICE_TEMPLATES_PDF="Corporate - Modern,Corporate - Classic"
#
# The corresponding .php file must exist in CUSTOM_TEMPLATES_FOLDER under the matching sub-path.
CUSTOM_INVOICE_TEMPLATES_PDF=
CUSTOM_INVOICE_TEMPLATES_PUBLIC=
CUSTOM_QUOTE_TEMPLATES_PDF=
CUSTOM_QUOTE_TEMPLATES_PUBLIC=

##
## DO NOT CHANGE ANY CONFIGURATION VALUES BELOW THIS LINE!
## =======================================================
##

# This key is automatically set after the first setup. Do not change it manually!
ENCRYPTION_KEY=[[encryption_key]]
ENCRYPTION_CIPHER=AES-256

# Set to true after the initial setup. Access to the setup wizard is blocked when this is true.
# To re-run the setup (e.g. after an upgrade), temporarily set this to false.
SETUP_COMPLETED=[[setup_completed]]

LEGACY_CALCULATION=false