chore: load secrets from config/system/secrets.php

additional.php is maintained in Git now (taken over from DDEV's
generated file): DDEV settings apply inside DDEV only, and
secrets.php (gitignored, template secrets.example.php) is merged in
everywhere, ignoring empty values. The web container reaches the local
MyE&P project as myep-next.ddev.site, as in EP/website.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.ddev/docker-compose.communicate.yaml

@@ -0,0 +1,5 @@
+# Reach the local MyE&P DDEV project from this web container (as in EP/website)
+services:
+  web:
+    external_links:
+      - "ddev-router:myep-next.ddev.site"

config/system/.gitignore

@@ -0,0 +1,2 @@
+/secrets.php
+/drushrc.php

config/system/additional.php

@@ -0,0 +1,59 @@
+<?php
+
+// Maintained in Git (taken over from DDEV's generated file): DDEV settings locally, secrets
+// from secrets.php everywhere. Empty secret values leave settings.php untouched.
+
+if (getenv('IS_DDEV_PROJECT') == 'true') {
+    $GLOBALS['TYPO3_CONF_VARS'] = array_replace_recursive(
+        $GLOBALS['TYPO3_CONF_VARS'],
+        [
+            'DB' => [
+                'Connections' => [
+                    'Default' => [
+                        'dbname' => 'db',
+                        'driver' => 'mysqli',
+                        'host' => 'db',
+                        'password' => 'db',
+                        'port' => '3306',
+                        'user' => 'db',
+                    ],
+                ],
+            ],
+            // This GFX configuration allows processing by installed ImageMagick 6
+            'GFX' => [
+                'processor' => 'ImageMagick',
+                'processor_path' => '/usr/bin/',
+                'processor_path_lzw' => '/usr/bin/',
+            ],
+            // This mail configuration sends all emails to mailpit
+            'MAIL' => [
+                'transport' => 'smtp',
+                'transport_smtp_encrypt' => false,
+                'transport_smtp_server' => 'localhost:1025',
+            ],
+            'SYS' => [
+                'trustedHostsPattern' => '.*.*',
+                'devIPmask' => '*',
+                'displayErrors' => 1,
+            ],
+        ]
+    );
+}
+
+if (is_file(__DIR__ . '/secrets.php')) {
+    $withoutEmptyValues = static function (array $values) use (&$withoutEmptyValues): array {
+        foreach ($values as $key => $value) {
+            if (is_array($value)) {
+                $values[$key] = $withoutEmptyValues($value);
+            } elseif ($value === '' || $value === null) {
+                unset($values[$key]);
+            }
+        }
+        return $values;
+    };
+    $GLOBALS['TYPO3_CONF_VARS'] = array_replace_recursive(
+        $GLOBALS['TYPO3_CONF_VARS'],
+        $withoutEmptyValues(require __DIR__ . '/secrets.php')
+    );
+    unset($withoutEmptyValues);
+}

config/system/secrets.example.php

@@ -0,0 +1,25 @@
+<?php
+
+// Template for config/system/secrets.php (not in Git). Values come from the TYPO3 10
+// production LocalConfiguration.php; empty values are ignored.
+return [
+    'SYS' => [
+        // Must be the production key of TYPO3 10: static pages link to cHash URLs served by TYPO3 13
+        'encryptionKey' => '',
+    ],
+    'EXTENSIONS' => [
+        'ep_products' => [
+            // /api/hotel, /api/product, /api/content/* (X-Api-Key or ?key=)
+            'cmsApiKey' => '',
+            // MyE&P OAuth2 client credentials (import, price calendar); locally e.g. https://myep-next.ddev.site/api/
+            'myEpApiBaseUrl' => '',
+            'myEpApiClientId' => '',
+            'myEpApiClientSecret' => '',
+            'myEpApiUrlAuthorize' => '',
+            'myEpApiUrlToken' => '',
+            // bpn-connect (price calendar)
+            'bpnConnectApiBaseUrl' => '',
+            'bpnConnectApiKey' => '',
+        ],
+    ],
+];