From 00775c2def030cbc24ce1150f10e56701d82a093 Mon Sep 17 00:00:00 2001 From: bernardhanna Date: Sat, 10 Oct 2026 12:08:27 +0100 Subject: [PATCH] Remove exposed Laravel APP_KEY from the dev branch. Match master: blank .env.example / .env.devspace, drop .env.travis which still held a real key. Co-authored-by: Cursor --- .env.example | 105 +++++++++++++++++++++++++++++++++++++++-- .env.travis | 32 ------------- devspace/.env.devspace | 8 ++-- 3 files changed, 105 insertions(+), 40 deletions(-) delete mode 100644 .env.travis diff --git a/.env.example b/.env.example index 709b64bd9..5ddc53c95 100644 --- a/.env.example +++ b/.env.example @@ -1,5 +1,6 @@ APP_ENV=local -APP_KEY=base64:ilyL17PxJTnZXqNBVr+P36ARu9NF7HgqJ87ciGWvo5E= +# Generate with: php artisan key:generate +APP_KEY= APP_DEBUG=false APP_TIMEZONE=UTC APP_URL=http://localhost @@ -16,10 +17,24 @@ BCRYPT_ROUNDS=12 DB_CONNECTION=sqlite DB_DATABASE=database/database.sqlite +# Deployed environments use mysql and need the following instead: +# DB_CONNECTION=mysql +# DB_HOST=127.0.0.1 +# DB_PORT=3306 +# DB_USERNAME= +# DB_PASSWORD= +# Used only by the opt-in mysql_testing connection in phpunit.xml +# DB_DATABASE_TESTING= + +REDIS_HOST=127.0.0.1 +REDIS_PORT=6379 +REDIS_PASSWORD= CACHE_STORE=array SESSION_DRIVER=array -QUEUE_DRIVER=sync +# QUEUE_CONNECTION, not QUEUE_DRIVER: the old Laravel 4/5 name is ignored by the +# framework. Must not be 'sync' on any deployed environment. +QUEUE_CONNECTION=sync SCOUT_DRIVER=null ALGOLIA_APP_ID= @@ -29,8 +44,8 @@ ALGOLIA_SECRET= AWS_ACCESS_KEY_ID= AWS_SECRET_ACCESS_KEY= AWS_DEFAULT_REGION=eu-west-1 -AWS_BUCKET=codeweek-dev -AWS_URL=https://codeweek-s3.s3.amazonaws.com/ +AWS_BUCKET= +AWS_URL= LOG_CHANNEL=stack LOG_STACK=single @@ -48,6 +63,88 @@ SESSION_DOMAIN=null AUTH_MODEL=App\User +# --------------------------------------------------------------------------- +# Mail. Required in every deployed environment; the app sends certificates, +# contact form submissions and moderation notices. +# --------------------------------------------------------------------------- +MAIL_MAILER=smtp +MAIL_HOST= +MAIL_PORT=587 +MAIL_USERNAME= +MAIL_PASSWORD= +MAIL_ENCRYPTION=tls +MAIL_FROM_ADDRESS= +MAIL_FROM_NAME="EU Code Week" +# Falls back to ADMIN_EMAIL when unset +CONTACT_FORM_RECIPIENT_EMAIL= + +# --------------------------------------------------------------------------- +# Social login. LoginController allowlists twitter, github, google, facebook. +# --------------------------------------------------------------------------- +TWITTER_CLIENT_ID= +TWITTER_CLIENT_SECRET= +TWITTER_REDIRECT= +GITHUB_CLIENT_ID= +GITHUB_CLIENT_SECRET= +GITHUB_REDIRECT= +GOOGLE_CLIENT_ID= +GOOGLE_CLIENT_SECRET= +GOOGLE_REDIRECT= +FACEBOOK_CLIENT_ID= +FACEBOOK_CLIENT_SECRET= +FACEBOOK_REDIRECT= + +# --------------------------------------------------------------------------- +# Maps and geolocation +# --------------------------------------------------------------------------- +MAPS_MAPBOX_ACCESS_TOKEN= +MAP_TILES= +MAXMIND_USER_ID= +MAXMIND_LICENSE_KEY= +IPAPI_KEY= + +# --------------------------------------------------------------------------- +# Certificates. PDFLATEX_PATH must point at a real pdflatex binary or the +# whole certificate pipeline fails. See docs/handover/08-certificates.md +# +# CERTIFICATE_ADMIN_EMAILS is a comma-separated allowlist for +# /admin/certificate-backend/*. No role grants access, so if this is blank +# the certificate backend is closed to everyone. +# --------------------------------------------------------------------------- +PDFLATEX_PATH= +CERTIFICATE_ADMIN_EMAILS= + +# --------------------------------------------------------------------------- +# Storage. RESOURCES_BUCKET is a second bucket for Learn & Teach PDFs, and is +# commonly pointed at production even on dev - check before importing. +# --------------------------------------------------------------------------- +FILESYSTEM_CLOUD=s3 +RESOURCES_BUCKET= +RESOURCES_URL= +# Bulk event/user upload temp files — Amazon S3 so every web node/worker sees them. +# Use local only for single-machine development without AWS. +BULK_UPLOAD_TEMP_DISK=s3 +RESOURCES_IMPORT_TEMP_DISK=local + +# --------------------------------------------------------------------------- +# Bot protection (Cloudflare Turnstile). Either TURNSTILE_SECRET or +# TURNSTILE_SECRET_KEY is accepted; verification is skipped when both are blank. +# --------------------------------------------------------------------------- +TURNSTILE_SITEKEY= +TURNSTILE_SECRET= + +# --------------------------------------------------------------------------- +# Partner feeds and integrations +# --------------------------------------------------------------------------- +BLOG_URL= +EEDUCATION_CLIENTID= +RELOCATION_COUNTRY= +# Bearer token for the internal support API +SUPPORT_SERVICE_TOKEN= + +# Error monitoring +SENTRY_LARAVEL_DSN= + # --------------------------------------------------------------------------- # Support AI copilot (Phase 1: AI triage + frontend code PRs) # --------------------------------------------------------------------------- diff --git a/.env.travis b/.env.travis deleted file mode 100644 index 9179d2548..000000000 --- a/.env.travis +++ /dev/null @@ -1,32 +0,0 @@ -APP_ENV=local -APP_KEY=base64:ilyL17PxJTnZXqNBVr+P36ARu9NF7HgqJ87ciGWvo5E= -APP_DEBUG=false -APP_URL=http://127.0.0.1:8000 - -DB_CONNECTION=mysql -DB_HOST=127.0.0.1 -DB_PORT=3306 -DB_DATABASE=codeweek -DB_USERNAME=root -DB_PASSWORD= - -CACHE_STORE=array -SESSION_DRIVER=array -QUEUE_DRIVER=sync - -SCOUT_DRIVER=null -ALGOLIA_APP_ID= -ALGOLIA_KEY= -ALGOLIA_SECRET= - -AWS_ACCESS_KEY_ID= -AWS_SECRET_ACCESS_KEY= -AWS_DEFAULT_REGION=eu-west-1 -AWS_BUCKET=codeweek-dev -AWS_URL=https://codeweek-s3.s3.amazonaws.com/ - -LOG_CHANNEL=stack - -LOCALES=al,ba,bg,cs,da,de,el,en,es,et,fi,fr,hr,hu,it,lt,lv,me,mk,nl,pl,pt,ro,rs,sk,sl,sv - -ADMIN_EMAIL=admin@codeweek.test diff --git a/devspace/.env.devspace b/devspace/.env.devspace index 03c80195b..4fba7c6f9 100644 --- a/devspace/.env.devspace +++ b/devspace/.env.devspace @@ -1,5 +1,5 @@ APP_ENV=local -APP_KEY=base64:R7ErAo+lGcenuwxia/CG4raozxe7lYviGc7gHizfUHw= +APP_KEY= APP_DEBUG=true APP_URL=https://codeweek.local.europa.eu FORCE_HTTPS=true @@ -8,7 +8,7 @@ DB_CONNECTION=mysql DB_HOST=mysql DB_PORT=3306 DB_USERNAME=codeweek -DB_PASSWORD=pass123 +DB_PASSWORD= DB_DATABASE=codeweek CACHE_STORE=file @@ -26,8 +26,8 @@ ALGOLIA_SECRET= AWS_ACCESS_KEY_ID= AWS_SECRET_ACCESS_KEY= AWS_DEFAULT_REGION=eu-west-1 -AWS_BUCKET=codeweek-dev -AWS_URL=https://codeweek-s3.s3.amazonaws.com/ +AWS_BUCKET= +AWS_URL= LOG_CHANNEL=stack