Environment

Production settings in .env (or as environment variables, see Keys):

CI_ENVIRONMENT = production

app.baseURL = 'https://admin.example.com/'
app.forceGlobalSecureRequests = true
app.CSPEnabled = true

cookie.secure = true

# Anvil's security events are logged with level "warning" (5);
# CodeIgniter's production default (4) drops them.
logger.threshold = 5

Setting	Why
CI_ENVIRONMENT = production	No debug toolbar, no error details (display_errors off, CI_DEBUG false); Anvil refuses plain HTTP on the API and accepts only https:// systems in Config\Anvil::$links.
app.baseURL with https://	Single sign-on builds its redirect and SAML URLs from it.
app.forceGlobalSecureRequests	Redirects HTTP to HTTPS (CodeIgniter’s required forcehttps filter).
app.CSPEnabled	Sends the Content Security Policy, see below.
cookie.secure	Session cookie only over HTTPS. Keep cookie.samesite = Lax (default): the OpenID Connect callback needs the session cookie after the redirect from the identity provider.
logger.threshold = 5	Keeps warnings, so the security events reach the application log.

Config\App::$proxyIPs is an array and cannot be set from .env, see Reverse proxies.

Where the values come from

CodeIgniter reads .env in the project root and environment variables; environment variables win. Anvil’s options use the prefix anvil., see Configuration → Environments for what belongs in .env and what in app/Config/Anvil.php.

Staging

Run staging with CI_ENVIRONMENT = production as well, with its own keys, database and identity provider client. A staging system in development mode shows error details and allows plain HTTP links, so it does not test what production does.