# Configuration Notes

## Central configuration

V1:

```text
application/v1/config/app.php
```

V2:

```text
application/v2/core/config.php
```

The files accept environment variables and otherwise use explicit `CHANGE_ME_*` fallback values.

## Required core values

```text
RBE_DB_HOST
RBE_DB_NAME
RBE_DB_USER
RBE_DB_PASS
RBE_V1_BASE_URL
RBE_V2_BASE_URL
```

Both V1 and V2 must use the same database values.

## Integration values

IAMMETER:

```text
RBE_IAMMETER_TOKEN
```

Flecto:

```text
RBE_FLECTO_WATER_TOKEN
RBE_FLECTO_ELECTRIC_API_URL
RBE_FLECTO_WATER_API_URL
```

SMTP:

```text
RBE_SMTP_HOST
RBE_SMTP_PORT
RBE_SMTP_USER
RBE_SMTP_PASS
RBE_MAIL_FROM
RBE_MAIL_FROM_NAME
```

MQTT listener environment:

```text
RBE_MQTT_HOST
RBE_MQTT_USERNAME
RBE_MQTT_PASSWORD
RBE_MQTT_CLIENT_ID
```

A copyable variable list is supplied in:

```text
config/ENVIRONMENT_VARIABLES.example
```

## Session configuration

Both application roots contain `.user.ini`. Replace the shared parent-domain placeholder in both copies with the same destination cookie domain.

The intended production pattern is:

```text
session name: RBESESSID
cookie domain: shared parent covering V1 and V2
cookie path: /
Secure: enabled on HTTPS
HttpOnly: enabled
SameSite: Lax
strict mode: enabled
```

If the PHP handler does not honour `.user.ini`, use equivalent server/PHP configuration. See `DEPLOYMENT_NOTES.md`.

## V1 -> V2 bridge

The V1 dashboard bridge is controlled by:

```text
RBE_V2_BASE_URL
```

Do not replace the portable config with a former hosting hostname.

## Credential handling

RC1 contains placeholders for destination secrets. The RC1 database retains a working test credential state solely for independent deployment validation. Final delivery must rotate/neutralise excluded administrative credential state and use newly provisioned destination credentials/tokens where required.