# TecnoCric centralized configuration

## One-time setup

1. Keep the project root `.env` file on the server. It is intentionally excluded from source control.
2. Copy `.env.example` to `.env` if setting up a fresh deployment.
3. Edit only the root `.env` for database credentials and integration secrets.
4. For XAMPP, the default local database settings are `127.0.0.1`, database `auction_db`, user `root`, blank password. Change these for your server.
5. Fill in Cloudinary / WhatsApp / Razorpay credentials only for services you actually use.
6. Restart Apache after changing environment settings.

## Central architecture

- `config/bootstrap.php`: loads root `.env`, defines shared environment helpers and constants, and exposes `tc_db()`.
- `config/database.php`: returns the shared MySQL connection.
- `config/services.php`: returns centralized Cloudinary, WhatsApp and Razorpay configuration.
- `includes/db.php`: backward-compatible `$conn` wrapper for existing pages.
- `admin/config.php`: compatibility wrapper for admin constants.
- `import_data/cloudinary_config.php`: compatibility wrapper for Cloudinary constants.
- `whatsapp/wa-config.php`: compatibility wrapper for WhatsApp settings.

Existing PHP pages and endpoints load the central bootstrap. Do not add credentials or create new database connections in individual pages; use `tc_db()` or `require config/database.php`.

## Security

- `.env` and `config/` are denied by the included Apache `.htaccess`. Ensure Apache `AllowOverride All` is enabled. On Nginx, add a deny rule for `/.env` and `/config/`.
- Never upload `.env` to Git or share it in a public archive. `.env.example` contains blank integration secrets.
- The uploaded source archive contained live-looking Cloudinary and WhatsApp credentials. Those values have been removed from the project. Rotate/revoke the old Cloudinary API secret and WhatsApp access token in their provider dashboards before production use.
- Set a long random `ADMIN_REGISTER_KEY` and `AUCTION_CONTROL_TOKEN` in `.env` before production.
- Keep `APP_DEBUG=false` in production.
- Browser JavaScript cannot safely keep private API secrets. All secret-bearing API calls must be made server-side.

## Notes

This is a configuration centralization pass; it does not provision cloud credentials or migrate the database. Confirm the `.env` values match the database and provider accounts before running the site.