psa-orderform/config.sample.php

<?php
// Configuration for the PSA order system.
//
// Copy this file to config.php on the server and adjust values for your environment.
// config.php is not tracked in Git (.gitignore).

// Site settings
define('SITE_NAME', 'Stadt Freising');
define('SITE_SERVICE_NAME', 'Bestellservice');
define('SITE_SERVICE_HEADER', 'Amt 32 - Öffentliche Sicherheit und Ordnung');
define('SITE_DEPARTMENT_NAME', 'Amt 32 - Öffentliche Sicherheit und Ordnung');
define('SITE_ADDRESS_LINE', 'Dr.-von-Daller-Straße 7, 85354 Freising');
define('SITE_IMPRINT_URL', 'https://www.freising.de/impressum/');
define('SITE_PRIVACY_URL', 'https://www.freising.de/datenschutz');
define('SITE_FULL_NAME', SITE_NAME . ' - ' . SITE_SERVICE_HEADER);
define('SITE_URL', '/shop'); // Path under web root, or '' for document root

// Optional: scheme + host only (no path) for absolute links in e-mails when HTTP_HOST is wrong behind proxies.
// define('SITE_CANONICAL_ORIGIN', 'https://www.example.org');

// Optional: file-based rate limits (see includes/functions.php). Defaults apply if omitted.
// define('ADMIN_LOGIN_RATE_LIMIT_MAX', 10);
// define('ADMIN_LOGIN_RATE_LIMIT_WINDOW', 900);
// define('CHECKOUT_RATE_LIMIT_MAX', 30);
// define('CHECKOUT_RATE_LIMIT_WINDOW', 3600);

define('DISCLAIMER_LINES', [
    'Dieses System dient der internen Bestellung persönlicher Schutzausrüstung der Stadt Freising.',
    'Die Bearbeitung erfolgt durch Amt 32 - Öffentliche Sicherheit und Ordnung.',
]);

// Admin settings
// Runtime source of truth for admin logins is data/admins.json.

// Order settings
define('ORDER_PREFIX', 'FS');
define('ORDER_RECIPIENT_EMAIL', 'orders@example.org');
define('ATTACH_ORDER_PDF_TO_ADMIN_EMAIL', true);

// Email settings
define('ADMIN_EMAIL', 'admin@example.org'); // Fallback for admin profile email defaults
define('FROM_EMAIL', 'shop@example.org');
define('FROM_NAME', SITE_FULL_NAME);

// Data file paths
define('DATA_DIR', __DIR__ . '/data/');
define('UPLOADS_DIR', DATA_DIR . 'uploads/');
define('PRODUCTS_FILE', DATA_DIR . 'products.json');
define('ORDERS_FILE', DATA_DIR . 'orders.json');
define('MANUAL_BACKORDERS_FILE', DATA_DIR . 'manual_backorders.json');
define('ORGANIZATIONS_FILE', DATA_DIR . 'organizations.json');
define('SETTINGS_FILE', DATA_DIR . 'settings.json');
define('ADMINS_FILE', DATA_DIR . 'admins.json');
define('CATEGORIES_FILE', DATA_DIR . 'categories.json');
define('FAQ_FILE', DATA_DIR . 'faq.json');
define('UPLOADS_URL', SITE_URL . '/data/uploads');

// Update and backup
// Handled by the manage client in manage-client/. Its settings - server URL,
// instance, token, backup sources - live in manage-client/config.php, not here.
// See docs/UPDATE_AND_BACKUP.md.

// Session settings
if (session_status() === PHP_SESSION_NONE) {
    $isHttps =
        (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
        (isset($_SERVER['SERVER_PORT']) &&
            (int) $_SERVER['SERVER_PORT'] === 443);

    ini_set('session.use_strict_mode', '1');
    ini_set('session.cookie_httponly', '1');
    ini_set('session.cookie_secure', $isHttps ? '1' : '0');
    ini_set('session.cookie_samesite', 'Lax');

    session_start();
}