Environment variables

config/opcua.php reads its values from env(...) by default. For most deployments, a .env file (or its production equivalent) is the only place you need to touch.

Connection — the basics

Security

Authentication

Trust store

See Security · Trust store.

Library behaviour flags

Session manager

Logging and caching

These two land on the daemon side. The per-connection log_channel in config/opcua.php is client-side and not exposed via env var by default.

A complete .env for development

APP_ENV=local
APP_DEBUG=true

OPCUA_ENDPOINT=opc.tcp://localhost:4840
OPCUA_SESSION_MANAGER_ENABLED=true

Minimal. Everything else takes defaults.

A complete .env for staging

APP_ENV=staging
APP_DEBUG=false

OPCUA_ENDPOINT=opc.tcp://staging-plc.internal:4840
OPCUA_SECURITY_POLICY=Basic256Sha256
OPCUA_SECURITY_MODE=SignAndEncrypt
OPCUA_USERNAME=integrations
OPCUA_PASSWORD="${SECRETS_OPCUA_PASS}"     # from secret manager

OPCUA_CLIENT_CERT=/etc/opcua/client.pem
OPCUA_CLIENT_KEY=/etc/opcua/client.key

OPCUA_TRUST_STORE_PATH=/var/lib/opcua/trust
OPCUA_TRUST_POLICY=fingerprint+expiry

OPCUA_SESSION_MANAGER_ENABLED=true
OPCUA_AUTH_TOKEN="${SECRETS_OPCUA_AUTH_TOKEN}"
OPCUA_LOG_CHANNEL=opcua
OPCUA_CACHE_STORE=redis

Sensitive values come from a secrets manager (Vault, AWS Secrets Manager, Doppler, …). The package doesn't read from those directly — Laravel does, via your standard secret-injection mechanism.

A complete .env for production

Same shape as staging, with values from your production secrets store. Differences are typically:

• OPCUA_TIMEOUT=10.0 for tolerance to occasional slowness
• OPCUA_AUTO_RETRY=3 for transient failure resilience
• OPCUA_AUTH_TOKEN definitely set
• OPCUA_TRUST_POLICY=fingerprint+expiry enforced
• OPCUA_AUTO_ACCEPT=false to refuse new certs without operator intervention

See Recipes · Production deployment.

env vars per-connection

The variables listed above feed the default connection in config/opcua.php. For multiple connections, the package doesn't enforce an env-var-per-connection scheme — it's your choice in config/opcua.php:

'connections' => [
    'plc-line-a' => [
        'endpoint' => env('OPCUA_LINE_A_ENDPOINT'),
        'username' => env('OPCUA_LINE_A_USER'),
        'password' => env('OPCUA_LINE_A_PASS'),
    ],
    'plc-line-b' => [
        'endpoint' => env('OPCUA_LINE_B_ENDPOINT'),
        'username' => env('OPCUA_LINE_B_USER'),
        'password' => env('OPCUA_LINE_B_PASS'),
    ],
],

.env matches:

OPCUA_LINE_A_ENDPOINT=opc.tcp://plc-a.factory.local:4840
OPCUA_LINE_A_USER=integrations
OPCUA_LINE_A_PASS="${SECRETS_PLC_A_PASS}"

OPCUA_LINE_B_ENDPOINT=opc.tcp://plc-b.factory.local:4840
OPCUA_LINE_B_USER=integrations
OPCUA_LINE_B_PASS="${SECRETS_PLC_B_PASS}"

Caching the config

php artisan config:cache freezes the resolved config in a PHP file. Two consequences:

• env() calls outside config/*.php return null in production after config:cache. Always read env via config('opcua.*') from application code.
• Changing .env after config:cache has no effect until you config:clear or config:cache again.

The Laravel deployment pattern: config:cache after every deploy, never inside the dev loop.

Secrets discipline

The package never logs sensitive values. See Security · Credentials for the runtime sanitisation guarantees.

Where to read next

• Security — security-related env vars in context.
• Session manager — daemon-side env vars in context.
• Recipes · Production deployment — putting it together.