<?php
/**
 * Env-driven wp-config for the RESPILON Anti-Acne checkout on Fly.io.
 * Everything sensitive comes from environment variables (Fly secrets).
 * Do NOT put real credentials in this file.
 */

// --- Database (over the Fly private network: respilon-antiacne-db.internal) ---
define( 'DB_NAME',     getenv( 'WORDPRESS_DB_NAME' )     ?: 'wordpress' );
define( 'DB_USER',     getenv( 'WORDPRESS_DB_USER' )     ?: 'wp_user' );
define( 'DB_PASSWORD', getenv( 'WORDPRESS_DB_PASSWORD' ) ?: '' );
define( 'DB_HOST',     getenv( 'WORDPRESS_DB_HOST' )     ?: 'respilon-antiacne-db.internal:3306' );
define( 'DB_CHARSET',  'utf8mb4' );
define( 'DB_COLLATE',  '' );

$table_prefix = getenv( 'WORDPRESS_TABLE_PREFIX' ) ?: 'wp_';

// --- Authentication unique keys and salts (set all 8 as Fly secrets).
//     Fresh values: https://api.wordpress.org/secret-key/1.1/salt/
//     The 'changeme' fallbacks are for local docker-compose ONLY — never production. ---
define( 'AUTH_KEY',         getenv( 'WORDPRESS_AUTH_KEY' )         ?: 'changeme-auth-key' );
define( 'SECURE_AUTH_KEY',  getenv( 'WORDPRESS_SECURE_AUTH_KEY' )  ?: 'changeme-secure-auth-key' );
define( 'LOGGED_IN_KEY',    getenv( 'WORDPRESS_LOGGED_IN_KEY' )    ?: 'changeme-logged-in-key' );
define( 'NONCE_KEY',        getenv( 'WORDPRESS_NONCE_KEY' )        ?: 'changeme-nonce-key' );
define( 'AUTH_SALT',        getenv( 'WORDPRESS_AUTH_SALT' )        ?: 'changeme-auth-salt' );
define( 'SECURE_AUTH_SALT', getenv( 'WORDPRESS_SECURE_AUTH_SALT' ) ?: 'changeme-secure-auth-salt' );
define( 'LOGGED_IN_SALT',   getenv( 'WORDPRESS_LOGGED_IN_SALT' )   ?: 'changeme-logged-in-salt' );
define( 'NONCE_SALT',       getenv( 'WORDPRESS_NONCE_SALT' )       ?: 'changeme-nonce-salt' );

// --- Site URLs (public domain, NOT the .fly.dev host, or WooCommerce builds wrong
//     checkout/asset URLs) ---
define( 'WP_HOME',    getenv( 'WP_HOME' )    ?: 'https://kasse.antiakne.no' );
define( 'WP_SITEURL', getenv( 'WP_SITEURL' ) ?: 'https://kasse.antiakne.no' );

// --- Behind Fly Proxy: TLS is terminated at the edge and plain HTTP reaches us.
//     Fly forwards X-Forwarded-Proto; without this, FORCE_SSL_ADMIN redirect-loops. ---
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
     && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
    $_SERVER['HTTPS'] = 'on';
}
// Trust Fly's forwarded client IP (used by WooCommerce fraud tools / geolocation).
if ( isset( $_SERVER['HTTP_FLY_CLIENT_IP'] ) ) {
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_FLY_CLIENT_IP'];
} elseif ( ! empty( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
    $_SERVER['REMOTE_ADDR'] = trim( explode( ',', $_SERVER['HTTP_X_FORWARDED_FOR'] )[0] );
}
// Force SSL admin only when the site itself is https (so local http dev still works).
define( 'FORCE_SSL_ADMIN', strpos( WP_HOME, 'https://' ) === 0 );

// --- WordPress tuning ---
define( 'WP_DEBUG', filter_var( getenv( 'WP_DEBUG' ) ?: 'false', FILTER_VALIDATE_BOOLEAN ) );
define( 'WP_DEBUG_LOG', WP_DEBUG );
define( 'WP_DEBUG_DISPLAY', false );
define( 'FS_METHOD', 'direct' );          // let WP-CLI/admin write files without FTP creds
define( 'WP_AUTO_UPDATE_CORE', false );   // image is the source of truth for code
define( 'AUTOMATIC_UPDATER_DISABLED', true );
if ( ! defined( 'WP_MEMORY_LIMIT' ) ) {
    define( 'WP_MEMORY_LIMIT', '256M' );  // WooCommerce admin is hungry
}

/* That's all, stop editing! Happy publishing. */
if ( ! defined( 'ABSPATH' ) ) {
    define( 'ABSPATH', __DIR__ . '/' );
}
require_once ABSPATH . 'wp-settings.php';