$ cat /config/www/.env

$ php artisan about

  Environment ................................................................  
  Application Name .................................................. Heimdall  
  Laravel Version .................................................... 13.39.0  
  PHP Version ......................................................... 8.5.12  
  Composer Version .................................................... 2.11.0  
  Environment .......................................................... local  
  Debug Mode ............................................................. OFF  
  URL .............................................................. localhost  
  Maintenance Mode ....................................................... OFF  
  Timezone ............................................................... UTC  
  Locale .................................................................. en  

  Cache ......................................................................  
  Config .......................................................... NOT CACHED  
  Events .......................................................... NOT CACHED  
  Routes .......................................................... NOT CACHED  
  Views ............................................................... CACHED  

  Drivers ....................................................................  
  Broadcasting ........................................................... log  
  Cache ................................................................. file  
  Database ............................................................ sqlite  
  Logs ................................................................. daily  
  Mail .................................................................. smtp  
  Queue ................................................................. sync  
  Session ............................................................... file  

12:            'database' => env('DB_DATABASE', 'app.sqlite') === ':memory:'
14:                : database_path(env('DB_DATABASE', 'app.sqlite')),

# Security: Host Header Injection / Open Redirect hardening (CVE-2025-50578).
# TRUSTED_PROXIES: comma-separated CIDRs/IPs of reverse proxies allowed to set
#   X-Forwarded-* headers. Defaults to the private ranges below when unset. Use
#   "*" to trust all proxies (only behind a trusted network boundary).
#TRUSTED_PROXIES=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,127.0.0.1
# TRUSTED_HOSTS: comma-separated hostnames Heimdall is allowed to serve. Unset
#   means no restriction (default, backward compatible). Set this to your own
#   domain to fully prevent host-header injection / open redirects.
#TRUSTED_HOSTS=heimdall.example.com

/app/www/app/Http/Middleware/TrustProxies.php:11:     * The default trusted proxies used when the TRUSTED_PROXIES env var is unset.
/app/www/app/Http/Middleware/TrustProxies.php:38:     * The set of trusted proxies is read from the TRUSTED_PROXIES env var
/app/www/app/Http/Middleware/TrustProxies.php:46:        $trustedProxies = env('TRUSTED_PROXIES');

# Set to true if you host Heimdall on a LAN and need website lookups or icon
# URLs to reach internal addresses (e.g. http://192.168.1.10:8080/favicon.png).
# When false (the default), server-side fetches of user-supplied URLs are
# refused when the host, or any redirect it returns, resolves to a private or
# reserved address (loopback, RFC1918, link-local metadata, etc.).
ALLOW_INTERNAL_REQUESTS=false

/app/www/config/app.php:22:    'auth_roles_enable' =>  (bool) env('AUTH_ROLES_ENABLE', false),
/app/www/config/app.php:24:    'auth_roles_header' =>  env('AUTH_ROLES_HEADER', 'remote-groups'),
/app/www/config/app.php:26:    'auth_roles_http_header' =>  env('AUTH_ROLES_HTTP_HEADER', 'HTTP_REMOTE_GROUPS'),
/app/www/config/app.php:28:    'auth_roles_admin' =>  env('AUTH_ROLES_ADMIN', 'admin'),
/app/www/config/app.php:30:    'auth_roles_delimiter' =>  env('AUTH_ROLES_DELIMITER', ','),

CREATE TABLE "settings" ("id" integer primary key autoincrement not null, "group_id" integer not null default '0', "key" varchar not null, "type" varchar not null default 'text', "options" text, "label" varchar not null, "value" varchar, "order" varchar not null default '0', "system" tinyint(1) not null default '0')

{"id":1,"title":"app.settings.system","order":0}
{"id":2,"title":"app.settings.appearance","order":1}
{"id":3,"title":"app.settings.miscellaneous","order":2}
{"id":4,"title":"app.settings.advanced","order":3}

tiles:
   id: tiles
   name: Tiles
   target: _blank

baidu:
   id: baidu
   url: https://www.baidu.com/s
   name: Baidu
   method: get
   target: _blank
   query: wd

bing:
   id: bing
   url: https://www.bing.com/search
   name: Bing
   method: get
   target: _blank
   query: q
   autocomplete: https://api.bing.com/osjson.aspx?query={query}

ddg:
   id: ddg
   url: https://duckduckgo.com/
   name: DuckDuckGo
   method: get
   target: _blank
   query: q
   autocomplete: https://duckduckgo.com/ac/?q={query}&type=list

google:
   id: google
   url: https://www.google.com/search
   name: Google
   method: get
   target: _blank
   query: q
   autocomplete: https://suggestqueries.google.com/complete/search?output=toolbar&hl=en&q={query}

startpage:
   id: startpage
   url: https://www.startpage.com/do/dsearch
   name: Startpage
   method: get
   target: _blank
   query: query

lrwxrwxrwx 1 root root 32 Nov  3 00:47 searchproviders.yaml -> /config/www/searchproviders.yaml

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    listen 443 quic reuseport default_server;
    listen [::]:443 quic reuseport default_server;

    server_name _;

    include /config/nginx/ssl.conf;

    set $root /app/www/public;
    if (!-d /app/www/public) {
        set $root /config/www;
    }
    root $root;
    index index.html index.htm index.php;

    location / {
        try_files $uri $uri/ /index.html /index.htm /index.php$is_args$args;
    }

    location ~ ^(.+\.php)(.*)$ {
        fastcgi_split_path_info ^(.+\.php)(.*)$;
        if (!-f $document_root$fastcgi_script_name) { return 404; }
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        include /etc/nginx/fastcgi_params;
    }

    # deny access to .htaccess/.htpasswd files
    location ~ /\.ht {
        deny all;
    }
}

ssl_certificate /config/keys/cert.crt;
ssl_certificate_key /config/keys/cert.key;

# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000";

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;
ssl_prefer_server_ciphers off;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions

$ nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

; Edit this file to override php.ini directives

date.timezone = Asia/Shanghai
upload_max_filesize = 30M
post_max_size = 30M

[www]
user = abc
group = abc
listen = 127.0.0.1:9000
pm = dynamic
pm.max_children = 5
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
clear_env = no

APP_DEBUG=false
APP_URL=https://heimdall.example.com

# 反向代理所在网段（按实际改）；只信任它设置 X-Forwarded-*
TRUSTED_PROXIES=10.89.62.0/24
# 域名白名单，杜绝 Host 头注入/开放重定向
TRUSTED_HOSTS=heimdall.example.com

# 卡片指向内网地址（图标/标题自动抓取、增强应用 API）
ALLOW_INTERNAL_REQUESTS=true

# 若前置认证代理透传角色，才启用：
#AUTH_ROLES_ENABLE=true
#AUTH_ROLES_HEADER=remote-groups
#AUTH_ROLES_ADMIN=admin

date.timezone = Asia/Shanghai
upload_max_filesize = 30M
post_max_size = 30M
; 自签/本地 CA 增强应用（二选一，优先此项而非全局跳过校验）
;openssl.cafile = /config/heimdall.pem

$ php artisan config:clear

   INFO  Configuration cache cleared successfully.