j.foucher
92f4fd16e8
Self-contained admin under /PS_Launcher/admin/ on the same OVH host. No
JS framework, no Composer deps — just PHP 8.3 + sessions + a small CSS.
Auth & infrastructure
---------------------
- admin/lib/Auth.php: session + CSRF helper. Login via password_hash /
password_verify. session_regenerate_id on successful login.
config.example.php gains admin_password_hash, generated by:
php -r "echo password_hash('PWD', PASSWORD_DEFAULT);"
- admin/lib/Layout.php: shared header/footer/nav, formatBytes,
csrfField helpers.
- admin/.htaccess: noindex / X-Frame-Options DENY / X-Content-Type
nosniff / blocks lib/*.php from web access.
- admin/assets/style.css: matches launcher's dark theme — same
Brush.* palette mapped to CSS vars, vivid green/blue/amber status
pills consistent with the WPF UI.
Pages
-----
- index.php (Dashboard): KPIs (active/expired/revoked licenses, machines
seen 30d, validations 24h), manifest signature status, last 10
audit_log entries.
- licenses.php: full CRUD.
* Émettre: owner, expiration date, max machines, internal notes →
generates a PRSRV-XXXX-XXXX-XXXX-XXXX key, displays it ONCE in a
green callout (DB stores the key; the message stays only on this
request, never shown again).
* Prolonger (per-row, expandable form), Revoke / Unrevoke,
Reset machines (frees all slots for that license).
* Status badge: active / expired / revoked.
- versions.php: edit the manifest from the web.
* Add a version: number + release date + minLicenseDate + release
notes Markdown (creates releasenotes/{version}.md). Sets default
download URL to {base_url}/builds/proserve-{version}.zip.
* Per-row Méta (edit minLicenseDate / releasedAt), Notes (edit md
inline), toggle availableForDownload, Delete entry.
* 🔁 Sync (sign-manifest) button: shells out to
`php tools/sign-manifest.php` and shows its stdout — recomputes
sha256/sizeBytes for every uploaded ZIP, bumps `latest`, signs
Ed25519. Visual indicators on each row: zip presence, hash
computed yes/no, signature status.
* Lists orphan ZIPs in builds/ that no manifest entry references.
- audit.php: paginated audit_log viewer (100/page) with event-type
filter dropdown. JOINs licenses to show owner_name. Color-codes
events (validate_ok green, expired amber, invalid/revoked red).
Server README rewritten to document the full setup flow:
1. Create MySQL DB, run migrations/001_init.sql
2. Copy config.example.php → config.php, fill db credentials
3. php tools/generate-keypair.php → paste into config.php and into the
client's Resources/server-pubkey.txt
4. Set admin_password_hash in config.php
5. Login at /PS_Launcher/admin/
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
44 lines
1.8 KiB
PHP
44 lines
1.8 KiB
PHP
<?php
|
|
// === À RENSEIGNER LORS DU DÉPLOIEMENT ===
|
|
// Copier ce fichier en config.php sur le serveur, puis le compléter.
|
|
// Le fichier config.php est gitignored.
|
|
|
|
return [
|
|
// Base path public sous lequel le launcher est servi
|
|
'base_url' => 'https://asterionvr.com/PS_Launcher',
|
|
|
|
// MySQL (depuis le manager OVH : Hébergements -> Bases de données)
|
|
'db' => [
|
|
// Format DSN OVH typique : mysql:host=<bdd>.mysql.db;dbname=<bdd>;charset=utf8mb4
|
|
'dsn' => 'mysql:host=localhost;dbname=replace_me;charset=utf8mb4',
|
|
'username' => 'replace_me',
|
|
'password' => 'replace_me',
|
|
],
|
|
|
|
// HMAC secret pour les URLs présignées de /builds/ (v0.6, optionnel)
|
|
// Génère 64 hex chars : `php -r "echo bin2hex(random_bytes(32));"`
|
|
'hmac_secret' => 'replace_with_random_64_bytes_hex',
|
|
|
|
// Clés Ed25519 pour signer la réponse de validation license et le manifest.
|
|
// Génère le keypair via : `php tools/generate-keypair.php`
|
|
// Recopie les hex strings ci-dessous, et embarque la public_key_hex dans le launcher.
|
|
'ed25519' => [
|
|
'private_key_hex' => '', // 128 hex chars (sodium secret key, contient la pub key)
|
|
'public_key_hex' => '', // 64 hex chars (32 bytes)
|
|
],
|
|
|
|
// (v0.4-β) JWT pour les URLs de download protégées (optionnel pour le moment)
|
|
'jwt_secret' => 'replace_with_random_secret',
|
|
'jwt_ttl_seconds' => 900, // 15 min
|
|
|
|
// Limites de validation
|
|
'validate_max_per_minute_per_ip' => 10,
|
|
|
|
// === BACKOFFICE ADMIN ===
|
|
// Mot de passe bcrypt pour la connexion à /PS_Launcher/admin/
|
|
// Génère le hash via SSH OVH :
|
|
// php -r "echo password_hash('motdepasse_choisi', PASSWORD_DEFAULT);"
|
|
// puis colle le résultat ci-dessous.
|
|
'admin_password_hash' => '',
|
|
];
|