Purple_Envelop_Order_Site/public/web.config.production.template

<?xml version="1.0" encoding="UTF-8"?>
<configuration>

  <appSettings>
    <!-- Access connection string. Points at the persistent data folder, outside the
         deploy directory so a redeploy (which wipes and re-extracts the deploy dir) never
         touches it. -->
    <add key="ConnectionString"
         value="Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\inetpub\data\webdata.accdb;Persist Security Info=False;" />

    <!-- Environment flag (Development / Staging / Production) -->
    <add key="Environment" value="Production" />

    <!-- Flash message display duration in milliseconds -->
    <add key="FlashMessageTimeout" value="8000" />

    <!-- 404 error page redirect countdown in seconds -->
    <add key="Error404RedirectSeconds" value="5" />

    <!-- Cache expiration year for static content -->
    <add key="CacheExpirationYear" value="2030" />

    <!-- Maximum characters to display in table cells before truncating -->
    <add key="TableCellMaxLength" value="90" />

    <!-- Character threshold for textarea vs input field in forms -->
    <add key="FormTextareaThreshold" value="100" />

    <!-- Enable error logging to file (true/false) -->
    <add key="EnableErrorLogging" value="true" />

    <!-- Error log file path - also outside the deploy directory so logs survive a redeploy. -->
    <add key="ErrorLogPath" value="C:\inetpub\data\logs\errors.log" />

    <!-- Enable cache-busting for URLs and assets (true/false) -->
    <add key="EnableCacheBusting" value="false" />

    <!-- Cache-bust parameter name (default: "v") -->
    <add key="CacheBustParamName" value="v" />

    <!-- SMTP settings used by CDOEmail for outbound order emails. -->
    <add key="SmtpServer" value="kentcommunications-com.mail.protection.outlook.com" />
    <add key="SmtpPort" value="25" />
    <add key="SmtpUsername" value="" />
    <add key="SmtpPassword" value="" />
    <add key="SmtpUseSSL" value="false" />
    <add key="SmtpFromAddress" value="no-reply@kentcommunications.com" />

    <!-- Hours before an order continuation link (token) expires -->
    <add key="OrderTokenExpirationHours" value="24" />

    <!--
      Jurisdiction number validation (request-order form). The list is essentially static
      reference data, so it's cached in Application scope rather than fetched on every
      submission - see JurisdictionCacheMinutes.
    -->
    <add key="JurisdictionApiUrl" value="http://192.168.1.40:8081/api/jurisdictions" />
    <add key="JurisdictionCacheMinutes" value="60" />

    <!-- Cloudflare Turnstile (CAPTCHA) keys. -->
    <add key="TurnstileSiteKey" value="0x4AAAAAAEUPEPHEnA9hPgbw" />
    <add key="TurnstileSecretKey" value="0x4AAAAAAEUPEFnbhCe6ttr_Mq6yCozxRkg" />
  </appSettings>

  <system.webServer>
    <!-- Default document for the site root -->
    <defaultDocument>
      <files>
        <clear />
        <add value="Default.asp" />
      </files>
    </defaultDocument>

    <!-- URL Rewrite: send everything through Default.asp except static assets -->
    <rewrite>
      <rules>
        <rule name="Rewrite to Default.asp" stopProcessing="true">
          <match url="^(?!Default\.asp$|css/|js/|images/|aspunit/|favicon\.ico$).*$" />

          <conditions>
            <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
          </conditions>

          <action type="Rewrite" url="/Default.asp" />
        </rule>
      </rules>
    </rewrite>

    <!-- Strip the Server response header (reveals IIS version) - IIS 10+ only -->
    <security>
      <requestFiltering removeServerHeader="true" />
    </security>

    <!-- Strip framework-identifying headers that IIS/ASP.NET modules may add -->
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
        <remove name="X-AspNet-Version" />
        <remove name="X-AspNetMvc-Version" />
        <!-- URL Rewrite module adds this in IIS Express, leaking the physical file path -->
        <remove name="X-SourceFiles" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>

  <location path="css">
    <system.webServer>
      <staticContent>
        <clientCache cacheControlMode="UseMaxAge" cacheControlMaxAge="01:00:00" />
      </staticContent>
    </system.webServer>
  </location>
</configuration>