Environments

The class Config\Anvil holds what is the same everywhere; .env holds what differs per environment and every secret.

What goes where

In app/Config/Anvil.php	In .env
panels, policies, permissions, templates, building blocks	keys: encryption.key, anvil.auditKey, anvil.auditPreviousKeys
file types, working days, links	secrets: anvil.sso.<provider>.clientSecret
defaults of limits	limits that differ per environment, e.g. anvil.fileMaxSize
	anvil.holidayRegion, anvil.ssoAutoRedirect per site

Example

# .env of production
CI_ENVIRONMENT = production
app.baseURL = 'https://backoffice.example.com/'

encryption.key = hex2bin:…
anvil.auditKey = base64:…

anvil.sso.adfs.clientSecret = …
anvil.ssoAutoRedirect = adfs
anvil.holidayRegion = BY
anvil.fileMaxSize = 26214400

# .env of development
CI_ENVIRONMENT = development
anvil.endpointRateLimit = 0
anvil.ssoAutoRedirect =

Rules

• Never commit .env; keep secrets out of the class.
• Values from .env override the class; check the effective values with Anvil\Config\Anvil::resolve() in a test or command.
• In production https is required for links and single sign-on; the debug toolbar must be off (CI_ENVIRONMENT = production).

Server setup, keys and scheduled commands: Deployment.