# PSA Orderform Backup Server

This folder can be deployed as a central backup server for distributed PSA orderform instances.

## Setup

1. Copy `config.sample.php` to `config.php`.
2. Change `BACKUP_SERVER_PASSWORD`.
3. Ensure the `backups/` directory is writable by PHP.
4. Open `index.php` or `manage.php` and log in with the configured password.
5. Add every allowed distributed instance in the management UI.

The upload endpoint is `upload.php`. It intentionally does not require authentication, but every upload must include an `instance` identifier that was added in the management UI.

## Client target

Configure a distributed instance with a managed backup target:

```php
define('BACKUP_REMOTE_TARGETS', [
    [
        'name' => 'Managed Backup Server',
        'type' => 'managed',
        'url' => 'https://backup.example.org/upload.php',
        'instance' => 'stadt-freising-prod',
    ],
]);
```

`url` must point directly to `upload.php`. `instance` may contain letters, numbers, dots, underscores, and dashes.

## Retention

The server retains the latest backups per instance. The default is `30`.

Retention can be changed in `config.php` with `BACKUP_SERVER_RETENTION` and in the management UI. The UI value is stored in `backups/settings.json` and takes precedence after it has been saved once.

Retention is applied after every successful upload and after retention changes in the management UI.

## Storage

Backups are stored under:

```text
backups/<instance>/backup-YYYYmmdd-HHMMSS.zip
```

Metadata is stored in:

```text
backups/index.json
```

Allowed instances and UI retention settings are stored in:

```text
backups/settings.json
```

With the included `.htaccess`, ZIP and JSON files are not directly readable through Apache. Downloads should use the authenticated management UI.