Thanakorn
ae98dcdcdd
- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and app internals; security headers, HSTS over TLS, optional HTTPS redirect - uploads served through app/file.php to signed-in users only - Apache/PHP hardening config for the container (ServerTokens, expose_php) - least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php; SMTP passwords re-encrypted with a random IV (secret_box.php) - Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets - escape notification text; CLI guards on build scripts; no fixed demo password
78 lines
3.2 KiB
Plaintext
78 lines
3.2 KiB
Plaintext
<?php
|
|
|
|
//<><><><><><><><> MAIN CONFIG (docker-generated) <><><><><><><><>//
|
|
if(true){
|
|
$base_url = "/wms-app/";
|
|
$server_url = $base_url."app/";
|
|
$include_url = $_SERVER['DOCUMENT_ROOT'].$server_url;
|
|
|
|
$db_server = "db";
|
|
// Least-privilege account created by the entrypoint (docker/php/entrypoint.sh);
|
|
// root is only used there and by setup.php.
|
|
$db_user = "${DB_APP_USER}";
|
|
$db_pass = "${DB_APP_PASSWORD}";
|
|
$db_type = "mysql";
|
|
$db_database = "wms";
|
|
$db_database2 = "wms2";
|
|
|
|
$db_server2 = (!empty($db_server2))?$db_server2:$db_server;
|
|
$db_user2 = (!empty($db_user2))?$db_user2:$db_user;
|
|
$db_pass2 = (!empty($db_pass2))?$db_pass2:$db_pass;
|
|
$db_type2 = (!empty($db_type2))?$db_type2:$db_type;
|
|
|
|
$time_zone = "Asia/Bangkok";
|
|
}
|
|
|
|
// ── Real-time Node.js server ─────────────────────────────────────────────────
|
|
if (!defined('NODE_PUBLIC_URL')) {
|
|
define('NODE_PUBLIC_URL', 'http://${PUBLIC_HOST}:3000');
|
|
}
|
|
if (!defined('NODE_EMIT_URL')) {
|
|
define('NODE_EMIT_URL', 'http://node:3000/emit');
|
|
}
|
|
if (!defined('NODE_EMIT_SECRET')) {
|
|
define('NODE_EMIT_SECRET', '${EMIT_SECRET}');
|
|
}
|
|
|
|
// ── Login OTP ────────────────────────────────────────────────────────────────
|
|
// Set from OTP_REQUIRED in .env and reconciled by the entrypoint on every start.
|
|
// Off by default: anything other than the boolean true leaves the OTP step off.
|
|
if (!defined('OTP_REQUIRED')) {
|
|
define('OTP_REQUIRED', ${OTP_REQUIRED});
|
|
}
|
|
|
|
// ── App registry ─────────────────────────────────────────────────────────────
|
|
// Apps a user can be given access to (Setting → Users Access). Keys must match
|
|
// the user.app_access enum; assets/utils/app_registry.php supplies this default
|
|
// for configs that do not define it.
|
|
$app_registry = [
|
|
'wms' => ['label' => 'WMS', 'icon' => 'ti-box', 'color' => 'bg-label-primary'],
|
|
'accounting' => ['label' => 'Accounting', 'icon' => 'ti-calculator', 'color' => 'bg-label-success'],
|
|
];
|
|
|
|
// ── Usage packages ───────────────────────────────────────────────────────────
|
|
$packages = [
|
|
'starter' => [
|
|
'daily_limit' => 30,
|
|
'weekly_limit' => 100,
|
|
'lock_on_limit' => ['dashboard'],
|
|
],
|
|
];
|
|
|
|
// Key for stored SMTP passwords (assets/utils/secret_box.php). Keep it stable
|
|
// across deploys: changing it makes saved SMTP passwords unreadable.
|
|
if (!defined('APP_SECRET_KEY')) {
|
|
define('APP_SECRET_KEY', '${APP_SECRET_KEY}');
|
|
}
|
|
// Legacy fixed key: only used to read SMTP passwords saved before APP_SECRET_KEY.
|
|
$pinkey = "wms";
|
|
|
|
$SMTP = [];
|
|
$SMTP['server'] = "smtp.gmail.com";
|
|
$SMTP['username'] = "${SMTP_USERNAME}";
|
|
$SMTP['port'] = "587";
|
|
$SMTP['password'] = "${SMTP_PASSWORD}"; // Gmail app password, not your login password
|
|
$method = "AES-256-CBC";
|
|
$iv = "1234567890123456"; // Must be exactly 16 bytes
|
|
$SMTP['password'] = openssl_encrypt($SMTP['password'], $method, $pinkey, 0, $iv);
|