psa-orderform/config.sample.php

<?php
// Configuration for the PSA order system.
//
// Copy this file to config.php on the server and adjust values for your environment.
// config.php is not tracked in Git (.gitignore).

// Site settings
define('SITE_NAME', 'Stadt Freising');
define('SITE_SERVICE_NAME', 'Bestellservice');
define('SITE_SERVICE_HEADER', 'Amt 32 - Öffentliche Sicherheit und Ordnung');
define('SITE_DEPARTMENT_NAME', 'Amt 32 - Öffentliche Sicherheit und Ordnung');
define('SITE_ADDRESS_LINE', 'Dr.-von-Daller-Straße 7, 85354 Freising');
define('SITE_IMPRINT_URL', 'https://www.freising.de/impressum/');
define('SITE_PRIVACY_URL', 'https://www.freising.de/datenschutz');
define('SITE_FULL_NAME', SITE_NAME . ' - ' . SITE_SERVICE_HEADER);
define('SITE_URL', '/shop'); // Path under web root, or '' for document root

// Optional: scheme + host only (no path) for absolute links in e-mails when HTTP_HOST is wrong behind proxies.
// define('SITE_CANONICAL_ORIGIN', 'https://www.example.org');

// Optional: file-based rate limits (see includes/functions.php). Defaults apply if omitted.
// define('ADMIN_LOGIN_RATE_LIMIT_MAX', 10);
// define('ADMIN_LOGIN_RATE_LIMIT_WINDOW', 900);
// define('CHECKOUT_RATE_LIMIT_MAX', 30);
// define('CHECKOUT_RATE_LIMIT_WINDOW', 3600);

define('DISCLAIMER_LINES', [
    'Dieses System dient der internen Bestellung persönlicher Schutzausrüstung der Stadt Freising.',
    'Die Bearbeitung erfolgt durch Amt 32 - Öffentliche Sicherheit und Ordnung.',
]);

// Admin settings
// Runtime source of truth for admin logins is data/admins.json.

// Order settings
define('ORDER_PREFIX', 'FS');
define('ORDER_RECIPIENT_EMAIL', 'orders@example.org');
define('ATTACH_ORDER_PDF_TO_ADMIN_EMAIL', true);

// Email settings
define('ADMIN_EMAIL', 'admin@example.org'); // Fallback for admin profile email defaults
define('FROM_EMAIL', 'shop@example.org');
define('FROM_NAME', SITE_FULL_NAME);

// Data file paths
define('DATA_DIR', __DIR__ . '/data/');
define('UPLOADS_DIR', DATA_DIR . 'uploads/');
define('PRODUCTS_FILE', DATA_DIR . 'products.json');
define('ORDERS_FILE', DATA_DIR . 'orders.json');
define('MANUAL_BACKORDERS_FILE', DATA_DIR . 'manual_backorders.json');
define('NAMETAGS_FILE', DATA_DIR . 'nametags.json');
define('ORGANIZATIONS_FILE', DATA_DIR . 'organizations.json');
define('SETTINGS_FILE', DATA_DIR . 'settings.json');
define('ADMINS_FILE', DATA_DIR . 'admins.json');
define('CATEGORIES_FILE', DATA_DIR . 'categories.json');
define('FAQ_FILE', DATA_DIR . 'faq.json');
define('UPLOADS_URL', SITE_URL . '/data/uploads');

// Manual update settings
// Point this to the central update server's manifest.php endpoint.
define('UPDATE_MANIFEST_URL', 'https://dev.med0.de/psa/updater/manifest.php');
define('UPDATE_WORK_DIR', DATA_DIR . 'updates/work/');
define('UPDATE_BACKUP_DIR', DATA_DIR . 'updates/backups/');

// Data backup settings
define('BACKUP_DIR', DATA_DIR . 'backups/');
define('BACKUP_LOCAL_RETENTION', 4);
define('BACKUP_AUTO_INTERVAL_SECONDS', 604800);
define('BACKUP_REMOTE_TARGETS', [
    // [
    //     'name' => 'S3 Backup',
    //     'type' => 's3',
    //     'bucket' => 'example-bucket',
    //     'region' => 'eu-central-1',
    //     'prefix' => 'psa-orderform',
    //     'access_key' => 'AKIA...',
    //     'secret_key' => '...',
    //     // Optional for S3-compatible storage:
    //     // 'endpoint' => 'https://s3.example.org',
    // ],
    // [
    //     'name' => 'SFTP Backup',
    //     'type' => 'sftp',
    //     'host' => 'backup.example.org',
    //     'port' => 22,
    //     'username' => 'backup-user',
    //     'password' => '...',
    //     'path' => '/backups/psa-orderform',
    // ],
    // [
    //     'name' => 'Custom Backup',
    //     'type' => 'custom',
    //     'file' => __DIR__ . '/custom-backup-uploader.php',
    //     'callback' => 'uploadPsaOrderformBackup',
    // ],
    // [
    //     'name' => 'Managed Backup Server',
    //     'type' => 'managed',
    //     'url' => 'https://backup.example.org/upload.php',
    //     'instance' => 'stadt-freising-prod',
    // ],
]);

// Log retention settings
define('LOG_MAX_BYTES', 1048576);
define('LOG_KEEP_FILES', 5);
define('LOG_MAX_AGE_SECONDS', 2592000);

// Session settings
if (session_status() === PHP_SESSION_NONE) {
    $isHttps =
        (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
        (isset($_SERVER['SERVER_PORT']) &&
            (int) $_SERVER['SERVER_PORT'] === 443);

    ini_set('session.use_strict_mode', '1');
    ini_set('session.cookie_httponly', '1');
    ini_set('session.cookie_secure', $isHttps ? '1' : '0');
    ini_set('session.cookie_samesite', 'Lax');

    session_start();
}