HostBMS — installation
======================

HostBMS is early-development software (v0.1): test it before relying on it.
Licence: HostBMS Licence v1.0 (see LICENSE): free to use, not for resale or redistribution.

Requirements
------------
- PHP 8.1 or newer (8.2 / 8.3 recommended) with: curl, gd, json, mbstring, openssl,
  pdo_mysql, xml, zip, intl, bcmath, fileinfo
- MySQL 5.7+ / MariaDB 10.4+ (an empty database and a user for it)
- Apache, LiteSpeed, OpenLiteSpeed or Nginx with PHP-FPM, and HTTPS
- Cron (every 5 minutes)

1. Create a site and a database
-------------------------------
In your hosting panel, create a site such as billing.example.com with HTTPS,
and an empty MySQL/MariaDB database plus a user with full rights on it.

2. Upload
---------
Upload the CONTENTS of this hostbms/ folder to the site's web root (e.g. public_html),
including the hidden .htaccess file.

3. Block the private folders (important)
----------------------------------------
HostBMS keeps code, settings and uploaded files next to the public pages. The .htaccess
file blocks them on Apache and LiteSpeed. Some servers ignore .htaccess:

- OpenLiteSpeed / KarnakPanel: enable "Auto Load from .htaccess" for the site, or paste
  the RewriteCond/RewriteRule lines from .htaccess into the site's rewrite rules.
- Nginx: add deny rules for these paths (install.sh contains a complete example vhost):
    /src /vendor /includes (except /includes/api.php) /crons /templates /templates_c
    /bin /database /attachments /downloads, files ending .tpl .md .lock .sql .sh .log,
    configuration.php, configuration.sample.php, init.php, composer.json, dotfiles

The installer checks this for you: it requests a few of these files from your site and
stops if any of them download. You can also check by hand: https://your-site/composer.json
must NOT download (403 or 404). Admin > Dashboard > System health re-checks it hourly (via cron).

4. Run the installer
--------------------
Open https://your-site/install/ and follow the steps: requirement checks, licence,
database, company and first admin, optional import from WHMCS. Use your site's full
https:// address as the System URL. The installer locks itself when it finishes.

Command-line alternative (from the uploaded folder):
    php bin/console bm:install --db-name=NAME --db-user=USER \
        --email=you@example.com --url=https://billing.example.com/
(give the database password with --db-pass=... or in the BM_DB_PASS environment variable)

5. Cron
-------
Every 5 minutes, as the user that owns the site's files:
    */5 * * * * php /path/to/public_html/crons/cron.php
Admin > Utilities > Automation Status shows when it last ran. Use the PHP binary that matches
the site's PHP version if "php" on the command line is different.

6. After installing
-------------------
- Log in at https://your-site/admin/ and turn on two-factor authentication (click your name, top right).
- Setup > Mail: choose how email is sent (it is only logged until you do).
- Setup > Billing & Dunning: check the currency, timezone and the overdue schedule.
- Setup > Payment Gateways: bank transfer, Stripe and Mollie are included.

Fresh VPS (Ubuntu/Debian/Alma/Rocky, no control panel)
------------------------------------------------------
install.sh sets up Nginx or Apache, PHP-FPM, MariaDB, HTTPS, cron and backups, then
installs HostBMS. Run as root from this folder:  bash install.sh --help
It has not yet been run on a real server: use a throwaway VPS first.

Questions: info@hostbms.com · https://hostbms.com
