# KimsQ PHP 8.5 deployment

This source has been updated and syntax-checked with PHP 8.5.4. It requires the
mysqli, mbstring, gd, zip, xml, and fileinfo PHP extensions.

## Before deployment

1. Back up both /var/www/html and the MySQL database.
2. If this is an existing site, change the prefix near the top of
   migrations/20260713_php8_mysql8.sql, then run that migration before
   replacing the PHP files. The pw column must be VARCHAR(255) for modern
   password hashes.
3. Confirm php -m lists mysqli; the application deliberately stops with a
   generic error if the extension or database connection is unavailable.

On the current Ubuntu PHP 8.5 installation, install the missing optional
extensions before using image uploads, archive handling, or XML integrations:

    sudo apt-get update
    sudo apt-get install php8.5-gd php8.5-zip php8.5-mbstring php8.5-xml

## Apache on Ubuntu

Enable rewrite and headers, and allow this application's .htaccess files:

    <Directory /var/www/html>
        AllowOverride All
        Options -Indexes +FollowSymLinks
        Require all granted
    </Directory>

Serve the site over HTTPS. The application marks session cookies as Secure
only when PHP sees HTTPS, so a TLS-terminating reverse proxy must pass the
correct trusted HTTPS setting to Apache/PHP.

The web-service account needs write access only to these runtime locations:

    files/
    _tmp/session/
    _tmp/backup/
    _tmp/out/

Use owner-only permissions for _var/db.info.php (for example, 0640) and do not
expose _var or _tmp through any Nginx virtual-host rule.

Set writable runtime paths to the Apache group without granting access to other
local users:

    sudo chgrp -R www-data /var/www/html/files /var/www/html/_tmp
    sudo find /var/www/html/files /var/www/html/_tmp -type d -exec chmod 2770 {} +
    sudo find /var/www/html/files /var/www/html/_tmp -type f -exec chmod 0660 {} +

## After deployment

- Sign in with an administrator account and change its password to a new,
  12-character-or-longer password.
- Test login, one board post, comment, download, and image/file upload.
- Delete any old browser cookie that stored a password. The upgraded site only
  remembers the login ID and no longer writes passwords to cookies.
- Keep database credentials out of backups and source-control systems.

## Important limitation

The supplied source contains no _var/db.info.php, _var/table.info.php, or
database dump. It therefore cannot be connected to, or data-tested against, a
specific MySQL database until those site-specific files/database are restored.
