Restructure: move all files from Public HTML/ to root for Hostinger deployment

2026-02-22 02:37:32 +02:00
parent 515080774a
commit e3a74b2d50
103 changed files with 62 additions and 147 deletions
@@ -9,22 +9,35 @@
 # ── Application ───────────────────────────────────────────────
 APP_ENV=production
 SITE_NAME=
 SITE_URL=
 # ── Database ──────────────────────────────────────────────────
 # Use 'file' for JSON file storage, or 'mysql' for MySQL database
 DB_TYPE=file
-# DB_HOST=localhost
+DB_HOST=localhost
-# DB_NAME=your_database_name
+DB_NAME=your_database_name
-# DB_USER=your_database_user
+DB_USER=your_database_user
-# DB_PASS=your_database_password
+DB_PASS=your_database_password
 # ── Admin Credentials ─────────────────────────────────────────
 # IMPORTANT: Set a strong admin password before deploying!
 ADMIN_USER=admin
-ADMIN_PASS=CHANGE_ME_TO_A_STRONG_PASSWORD
+ADMIN_PASS=CHANGE_ME_TO_A_BCRYPT_HASH
 # ── JWT Secret ────────────────────────────────────────────────
-# Generate a random secret: php -r "echo bin2hex(random_bytes(32));"
+# Generate with: php -r "echo bin2hex(random_bytes(32));"
 JWT_SECRET=CHANGE_ME_GENERATE_RANDOM_SECRET
 # ── Site Settings ─────────────────────────────────────────────
 SITE_NAME=MSPE
 SITE_URL=https://mspe.pro
 ADMIN_EMAIL=info@mspe.pro
 # ── SMTP Configuration ───────────────────────────────────────
 SMTP_HOST=smtp.hostinger.com
 SMTP_PORT=465
 SMTP_USER=info@mspe.pro
 SMTP_PASS=your_email_password
 SMTP_FROM_NAME=MSPE
 SMTP_FROM_EMAIL=info@mspe.pro
 # ── Cloudflare Turnstile (Optional) ──────────────────────────
 TURNSTILE_SITE_KEY=
 TURNSTILE_SECRET_KEY=
@@ -64,7 +64,7 @@ RewriteRule ^.*$ 404.html [L]
 	Header set Referrer-Policy "strict-origin-when-cross-origin"
 	Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
 	Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-    Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: https://ui-avatars.com https://maps.gstatic.com; connect-src 'self' https://challenges.cloudflare.com; frame-src https://www.google.com https://challenges.cloudflare.com; frame-ancestors 'self'"
+	Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: https://ui-avatars.com https://maps.gstatic.com https://www.google.com; connect-src 'self' https://challenges.cloudflare.com; frame-src https://www.google.com https://challenges.cloudflare.com; frame-ancestors 'self'"
 </IfModule>
 # Enable compression
@@ -1,85 +0,0 @@
 # MSPE Public Folder .htaccess
 RewriteEngine On
 RewriteBase /
 # Disable directory listing
 Options -Indexes
 # Force HTTPS
 RewriteCond %{HTTPS} off
 RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
 # Handle SPA-style routing if needed - redirect 404s to index
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteCond %{REQUEST_URI} !^/api/
 RewriteCond %{REQUEST_URI} !^/admin/
 RewriteRule ^.*$ 404.html [L]
 # Block dev/test/seed scripts in production
 <FilesMatch "^(db_seed|db_test|email-test)\.php$">
 	<IfModule mod_authz_core.c>
 		Require all denied
 	</IfModule>
 	<IfModule !mod_authz_core.c>
 		Order deny,allow
 		Deny from all
 	</IfModule>
 </FilesMatch>
 # Protect .env files
 <FilesMatch "^\.env">
 	<IfModule mod_authz_core.c>
 		Require all denied
 	</IfModule>
 	<IfModule !mod_authz_core.c>
 		Order deny,allow
 		Deny from all
 	</IfModule>
 </FilesMatch>
 # Prevent access to hidden files
 <FilesMatch "^\.">
 	Order allow,deny
 	Deny from all
 </FilesMatch>
 # Prevent access to JSON data files from web
 <FilesMatch "\.(json)$">
 	<IfModule mod_authz_core.c>
 		Require all denied
 	</IfModule>
 	<IfModule !mod_authz_core.c>
 		Order deny,allow
 		Deny from all
 	</IfModule>
 </FilesMatch>
 # Security headers
 <IfModule mod_headers.c>
 	Header set X-Content-Type-Options "nosniff"
 	Header set X-Frame-Options "SAMEORIGIN"
 	Header set X-XSS-Protection "0"
 	Header set Referrer-Policy "strict-origin-when-cross-origin"
 	Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
 	Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 	Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: https://ui-avatars.com https://maps.gstatic.com https://www.google.com; connect-src 'self' https://challenges.cloudflare.com; frame-src https://www.google.com https://challenges.cloudflare.com; frame-ancestors 'self'"
 </IfModule>
 # Enable compression
 <IfModule mod_deflate.c>
 	AddOutputFilterByType DEFLATE text/html text/plain text/css application/json application/javascript text/xml
 </IfModule>
 # Browser caching
 <IfModule mod_expires.c>
 	ExpiresActive On
 	ExpiresByType image/jpg "access plus 1 month"
 	ExpiresByType image/jpeg "access plus 1 month"
 	ExpiresByType image/png "access plus 1 month"
 	ExpiresByType image/gif "access plus 1 month"
 	ExpiresByType image/webp "access plus 1 month"
 	ExpiresByType text/css "access plus 1 week"
 	ExpiresByType application/javascript "access plus 1 week"
 </IfModule>
@@ -1,13 +0,0 @@
 # Prevent script execution in uploads directory
 <FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps|cgi|pl|py|sh|bash)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
 </FilesMatch>
 # Disable directory listing
 Options -Indexes
--- a/Show More
+++ b/Show More