Restructure: move all files from Public HTML/ to root for Hostinger deployment

2026-02-22 02:37:32 +02:00
parent 515080774a
commit e3a74b2d50
103 changed files with 62 additions and 147 deletions
@@ -9,22 +9,35 @@

 # ── Application ───────────────────────────────────────────────
 APP_ENV=production
-SITE_NAME=
-SITE_URL=

 # ── Database ──────────────────────────────────────────────────
-# Use 'file' for JSON file storage, or 'mysql' for MySQL database
 DB_TYPE=file
-# DB_HOST=localhost
-# DB_NAME=your_database_name
-# DB_USER=your_database_user
-# DB_PASS=your_database_password
+DB_HOST=localhost
+DB_NAME=your_database_name
+DB_USER=your_database_user
+DB_PASS=your_database_password

 # ── Admin Credentials ─────────────────────────────────────────
-# IMPORTANT: Set a strong admin password before deploying!
 ADMIN_USER=admin
-ADMIN_PASS=CHANGE_ME_TO_A_STRONG_PASSWORD
+ADMIN_PASS=CHANGE_ME_TO_A_BCRYPT_HASH

 # ── JWT Secret ────────────────────────────────────────────────
-# Generate a random secret: php -r "echo bin2hex(random_bytes(32));"
+# Generate with: php -r "echo bin2hex(random_bytes(32));"
 JWT_SECRET=CHANGE_ME_GENERATE_RANDOM_SECRET
+
+# ── Site Settings ─────────────────────────────────────────────
+SITE_NAME=MSPE
+SITE_URL=https://mspe.pro
+ADMIN_EMAIL=info@mspe.pro
+
+# ── SMTP Configuration ───────────────────────────────────────
+SMTP_HOST=smtp.hostinger.com
+SMTP_PORT=465
+SMTP_USER=info@mspe.pro
+SMTP_PASS=your_email_password
+SMTP_FROM_NAME=MSPE
+SMTP_FROM_EMAIL=info@mspe.pro
+
+# ── Cloudflare Turnstile (Optional) ──────────────────────────
+TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET_KEY=
@@ -19,67 +19,67 @@ RewriteRule ^.*$ 404.html [L]

 # Block dev/test/seed scripts in production
 <FilesMatch "^(db_seed|db_test|email-test)\.php$">
-    <IfModule mod_authz_core.c>
-        Require all denied
-    </IfModule>
-    <IfModule !mod_authz_core.c>
-        Order deny,allow
-        Deny from all
-    </IfModule>
+	<IfModule mod_authz_core.c>
+		Require all denied
+	</IfModule>
+	<IfModule !mod_authz_core.c>
+		Order deny,allow
+		Deny from all
+	</IfModule>
 </FilesMatch>

 # Protect .env files
 <FilesMatch "^\.env">
-    <IfModule mod_authz_core.c>
-        Require all denied
-    </IfModule>
-    <IfModule !mod_authz_core.c>
-        Order deny,allow
-        Deny from all
-    </IfModule>
+	<IfModule mod_authz_core.c>
+		Require all denied
+	</IfModule>
+	<IfModule !mod_authz_core.c>
+		Order deny,allow
+		Deny from all
+	</IfModule>
 </FilesMatch>

 # Prevent access to hidden files
 <FilesMatch "^\.">
-    Order allow,deny
-    Deny from all
+	Order allow,deny
+	Deny from all
 </FilesMatch>

 # Prevent access to JSON data files from web
 <FilesMatch "\.(json)$">
-    <IfModule mod_authz_core.c>
-        Require all denied
-    </IfModule>
-    <IfModule !mod_authz_core.c>
-        Order deny,allow
-        Deny from all
-    </IfModule>
+	<IfModule mod_authz_core.c>
+		Require all denied
+	</IfModule>
+	<IfModule !mod_authz_core.c>
+		Order deny,allow
+		Deny from all
+	</IfModule>
 </FilesMatch>

 # Security headers
 <IfModule mod_headers.c>
-    Header set X-Content-Type-Options "nosniff"
-    Header set X-Frame-Options "SAMEORIGIN"
-    Header set X-XSS-Protection "0"
-    Header set Referrer-Policy "strict-origin-when-cross-origin"
-    Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
-    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: https://ui-avatars.com https://maps.gstatic.com; connect-src 'self' https://challenges.cloudflare.com; frame-src https://www.google.com https://challenges.cloudflare.com; frame-ancestors 'self'"
+	Header set X-Content-Type-Options "nosniff"
+	Header set X-Frame-Options "SAMEORIGIN"
+	Header set X-XSS-Protection "0"
+	Header set Referrer-Policy "strict-origin-when-cross-origin"
+	Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
+	Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+	Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: https://ui-avatars.com https://maps.gstatic.com https://www.google.com; connect-src 'self' https://challenges.cloudflare.com; frame-src https://www.google.com https://challenges.cloudflare.com; frame-ancestors 'self'"
 </IfModule>

 # Enable compression
 <IfModule mod_deflate.c>
-    AddOutputFilterByType DEFLATE text/html text/plain text/css application/json application/javascript text/xml
+	AddOutputFilterByType DEFLATE text/html text/plain text/css application/json application/javascript text/xml
 </IfModule>

 # Browser caching
 <IfModule mod_expires.c>
-    ExpiresActive On
-    ExpiresByType image/jpg "access plus 1 month"
-    ExpiresByType image/jpeg "access plus 1 month"
-    ExpiresByType image/png "access plus 1 month"
-    ExpiresByType image/gif "access plus 1 month"
-    ExpiresByType image/webp "access plus 1 month"
-    ExpiresByType text/css "access plus 1 week"
-    ExpiresByType application/javascript "access plus 1 week"
+	ExpiresActive On
+	ExpiresByType image/jpg "access plus 1 month"
+	ExpiresByType image/jpeg "access plus 1 month"
+	ExpiresByType image/png "access plus 1 month"
+	ExpiresByType image/gif "access plus 1 month"
+	ExpiresByType image/webp "access plus 1 month"
+	ExpiresByType text/css "access plus 1 week"
+	ExpiresByType application/javascript "access plus 1 week"
 </IfModule>
@@ -1,85 +0,0 @@
-# MSPE Public Folder .htaccess
-
-RewriteEngine On
-RewriteBase /
-
-# Disable directory listing
-Options -Indexes
-
-# Force HTTPS
-RewriteCond %{HTTPS} off
-RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
-
-# Handle SPA-style routing if needed - redirect 404s to index
-RewriteCond %{REQUEST_FILENAME} !-f
-RewriteCond %{REQUEST_FILENAME} !-d
-RewriteCond %{REQUEST_URI} !^/api/
-RewriteCond %{REQUEST_URI} !^/admin/
-RewriteRule ^.*$ 404.html [L]
-
-# Block dev/test/seed scripts in production
-<FilesMatch "^(db_seed|db_test|email-test)\.php$">
-	<IfModule mod_authz_core.c>
-		Require all denied
-	</IfModule>
-	<IfModule !mod_authz_core.c>
-		Order deny,allow
-		Deny from all
-	</IfModule>
-</FilesMatch>
-
-# Protect .env files
-<FilesMatch "^\.env">
-	<IfModule mod_authz_core.c>
-		Require all denied
-	</IfModule>
-	<IfModule !mod_authz_core.c>
-		Order deny,allow
-		Deny from all
-	</IfModule>
-</FilesMatch>
-
-# Prevent access to hidden files
-<FilesMatch "^\.">
-	Order allow,deny
-	Deny from all
-</FilesMatch>
-
-# Prevent access to JSON data files from web
-<FilesMatch "\.(json)$">
-	<IfModule mod_authz_core.c>
-		Require all denied
-	</IfModule>
-	<IfModule !mod_authz_core.c>
-		Order deny,allow
-		Deny from all
-	</IfModule>
-</FilesMatch>
-
-# Security headers
-<IfModule mod_headers.c>
-	Header set X-Content-Type-Options "nosniff"
-	Header set X-Frame-Options "SAMEORIGIN"
-	Header set X-XSS-Protection "0"
-	Header set Referrer-Policy "strict-origin-when-cross-origin"
-	Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
-	Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-	Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: https://ui-avatars.com https://maps.gstatic.com https://www.google.com; connect-src 'self' https://challenges.cloudflare.com; frame-src https://www.google.com https://challenges.cloudflare.com; frame-ancestors 'self'"
-</IfModule>
-
-# Enable compression
-<IfModule mod_deflate.c>
-	AddOutputFilterByType DEFLATE text/html text/plain text/css application/json application/javascript text/xml
-</IfModule>
-
-# Browser caching
-<IfModule mod_expires.c>
-	ExpiresActive On
-	ExpiresByType image/jpg "access plus 1 month"
-	ExpiresByType image/jpeg "access plus 1 month"
-	ExpiresByType image/png "access plus 1 month"
-	ExpiresByType image/gif "access plus 1 month"
-	ExpiresByType image/webp "access plus 1 month"
-	ExpiresByType text/css "access plus 1 week"
-	ExpiresByType application/javascript "access plus 1 week"
-</IfModule>
@@ -1,13 +0,0 @@
-# Prevent script execution in uploads directory
-<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps|cgi|pl|py|sh|bash)$">
-    <IfModule mod_authz_core.c>
-        Require all denied
-    </IfModule>
-    <IfModule !mod_authz_core.c>
-        Order deny,allow
-        Deny from all
-    </IfModule>
-</FilesMatch>
-
-# Disable directory listing
-Options -Indexes
--- a/Show More
+++ b/Show More