Configuration

Configuration

All settings live in .env. Run php artisan config:clear after changing it. A production template is in deploy/.env.production.example.

Key	Purpose
APP_URL, ZOVITA_SITE_URL	Local URL, and the public canonical URL used in sitemaps, canonicals and the llms files.
MAIL_MAILER=resend, RESEND_API_KEY, MAIL_FROM_ADDRESS	E-mail through Resend (log writes to storage/logs). The from-address must be on a domain verified in Resend, or every e-mail is rejected.
RECAPTCHA_V3_SITE_KEY / _SECRET_KEY, RECAPTCHA_V3_MIN_SCORE	Invisible reCAPTCHA.
RECAPTCHA_V2_SITE_KEY / _SECRET_KEY	Checkbox reCAPTCHA. Leave a version's keys blank and that version is switched off.
RECAPTCHA_ENABLED	false disables both (used by the e2e server).
RATE_LIMIT_ALLOWLIST	Comma-separated IPs that skip the site-wide budget (health checks, load tests).
ZOVITA_SUPPORT_PHONE, ZOVITA_SUPPORT_EMAIL, ZOVITA_ADMIN_EMAIL	Contact details and where team notifications go.
ZOVITA_DELIVERY_FEE, ZOVITA_FREE_DELIVERY_OVER	Delivery pricing.
QUEUE_CONNECTION	sync locally; database or redis with workers in production.
PASSWORD_RESET_EXPIRE	Minutes a password-reset link lives (default 10).
PAYMENTS_DRIVER, STRIPE_SECRET, STRIPE_WEBHOOK_SECRET, PAYMENTS_EXPIRES_MINUTES	sandbox (local test gateway, refused in production), stripe or none. See Payments.
MALWARE_SCANNER, CLAMAV_SOCKET / CLAMAV_HOST / CLAMAV_PORT, MALWARE_SCAN_FAIL_OPEN	clamav streams uploads to clamd; none locally.
CACHE_LIMITER_STORE, BAN_CACHE_STORE	Shared store for throttle counters and ban look-ups (redis with several servers).
INERTIA_SSR_ENABLED, INERTIA_SSR_URL	Server-side rendering (off by default; on in the production template).

E-mails sent

All e-mails share one branded template and go through Resend.

E-mail	When
Welcome + confirm your e-mail	Sign-up and e-mail change (signed link, expires in 10 minutes)
Sign-in code	Passwordless sign-in and customer two-step sign-in (6 digits, HMAC-stored, 10 minutes, single use, 5 tries, one per minute)
Password reset	"Forgot password?" (64 random characters, stored hashed, single use, 10 minutes)
New sign-in alert	Sign-in from an IP not seen on the account in 90 days
Order confirmed / status updates / refund issued	Checkout or payment webhook, every status change, every refund
Prescription received / decision, refill reminders	Upload, review, and 3 days before a regular medicine runs out