; ---------------------------------------------------------------------------
; helix-bridge — PHP 8.5 runtime overrides
; Mounted/copied into the image's conf.d (see Dockerfile). Hardens error
; handling and right-sizes limits for a small JSON bridge service.
; See docs/06-phase-1-infrastructure.md and docs/03-security-analysis.md.
; ---------------------------------------------------------------------------

; Do not leak the PHP version in the Server/X-Powered-By headers.
expose_php = Off

; Never render errors to the client (they can leak internal detail — SEC-06).
; Log them instead so they land in the container/Apache log pipeline.
display_errors = Off
display_startup_errors = Off
log_errors = On

; Deprecations are expected during modernization; keep them out of runtime noise
; but keep everything else. Fix deprecations in Phase 3 rather than hiding them
; permanently.
error_reporting = E_ALL & ~E_DEPRECATED

; Reasonable limits for small JSON POST endpoints.
memory_limit = 128M
post_max_size = 1M
upload_max_filesize = 1M
max_input_time = 30
max_execution_time = 30
default_socket_timeout = 15

; Session cookie hardening. The bridge does not currently start sessions, but if
; any code path ever does (see SEC-11), these secure defaults apply.
session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = Strict

; Timezone kept explicit to avoid date() warnings under 8.5.
date.timezone = America/Toronto