Cyresora Quickstart, as shipped in the download

CYRESORA — QUICKSTART
=====================

REQUIREMENTS
------------
  - PHP 8.1+ with extensions: pdo, pdo_sqlite (or pdo_mysql)
  - MySQL 5.7+ OR SQLite 3 (SQLite requires no extra setup)
  - A web server (Apache with mod_rewrite, or Nginx with try_files)

SHARED HOSTING / CPANEL (RECOMMENDED FOR MOST BUYERS)
------------------------------------------------------
1. Upload the contents of the `app/` folder to your web root (e.g. public_html/)
   or a subdirectory (e.g. public_html/incidents/).

2. Make sure this directory is writable by PHP:
     data/

3. Visit https://yourdomain.com/install/ in your browser.

4. Fill in the installer: database, organization, timezone, admin account.

5. DELETE the install/ folder.

6. Before you need it: list your products and systems, mark what is in scope,
   and name who notifies and their deputy. A 24-hour clock that starts at 02:00
   on a Sunday is a rota question before it is a legal one.

VPS / SELF-HOSTED (APACHE)
--------------------------
Point a vhost at the app folder; the shipped .htaccess handles routing.
Ensure `AllowOverride All` is set and mod_rewrite is enabled.

NGINX
-----
    root /var/www/cyresora/app;
    index index.php;
    location ~ ^/(src|data|bin|tests|controllers|deploy|cron)/ { deny all; }
    location ~ ^/views/.+\.php$ { deny all; }
    location ~ (^|/)(config\.php|\.demo-mode)$|\.sqlite$ { deny all; }
    location = /install/ { rewrite ^ /install/index.php last; }
    location / { try_files $uri /index.php?$query_string; }
    location ~ \.php$ { try_files $uri =404; include fastcgi_params; fastcgi_pass unix:/run/php/php8.3-fpm.sock;
                        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; }

LOCAL / EVALUATION (PHP BUILT-IN SERVER)
----------------------------------------
    cd app
    php -S localhost:8080 router.php
Then open http://localhost:8080/install/ and choose SQLite.

DEMO DATA (OPTIONAL)
--------------------
    php bin/demo.php
Demo login (only if no admin exists yet): admin@cyresora.app with the one-time password it prints

The demo seeds four incidents whose timestamps are computed backwards from the
moment you load it, so the board is genuinely live: one mid-flight, one with an
OVERDUE deadline, one whose one-month final report is running from the moment
the notification was actually submitted, and one whose 14-day clock has NOT
STARTED because no corrective measure exists yet.

BACKUPS
-------
SQLite: back up data/cyresora.sqlite. MySQL: back up your database. Either way,
keep a copy of config.php. Settings -> Backups also produces a redacted JSON
export and a token-authenticated scheduled backup with retention.

THE CLOCKS THIS PRODUCT TRACKS
------------------------------
CRA (Regulation (EU) 2024/2847, Article 14) - applies from 11 September 2026
  Actively exploited vulnerability
    early warning   24 hours from becoming aware
    notification    72 hours from becoming aware
    final report    14 days AFTER A CORRECTIVE OR MITIGATING MEASURE IS AVAILABLE
  Severe incident
    early warning   24 hours from becoming aware
    notification    72 hours from becoming aware
    final report    1 month AFTER THE SUBMISSION OF THE NOTIFICATION

NIS2 (Directive (EU) 2022/2555, Article 23(4)) - as transposed nationally
    early warning   24 hours from becoming aware              (a)
    notification    72 hours from becoming aware              (b)
    intermediate    on request of the CSIRT                   (c)
    final report    1 month after the submission of the notification  (d)
    if still ongoing: progress report then, final within one month of
    the handling being completed                              (e)

READ THE ANCHORS, NOT JUST THE DURATIONS. The final-report clocks do NOT run
from when you found out. One runs from the moment a fix exists - which may not
have happened yet, in which case the register says "not started" and names what
starts it, rather than showing you a date it invented. The other runs from the
moment you actually submitted the notification, so filing early genuinely moves
your final-report deadline earlier.

SUPPORT NOTES
-------------
- All stored times are UTC to the second. You type local time; the app converts.
  A deadline measured in hours cannot survive a timezone left implicit.
- THESE CLOCKS DO NOT STOP AT THE WEEKEND. There is no working-day carve-out in
  either instrument. The register marks the deadlines that fall on a Saturday or
  Sunday rather than letting you assume otherwise.
- Recording a notification is a separate permission (`notify.submit`). A member
  can work an incident; declaring that a report went out is what an authority is
  later shown, so it is not the same right.
- NIS2 is a DIRECTIVE. What binds you is your Member State's transposition -
  the authority, and sometimes the detail. Record yours in Settings.
- Cyresora is a records and timing aid, not legal advice.

LOOKING AFTER IT (from 4.0)
---------------------------
  * Updates: open Updates in the menu, save your license key once, press Check for updates.
    Reaching 4.0 from 3.x is the last update by hand: replace the files; config.php and data/ stay.
  * Sample data: the installer offers to start with a sample; remove it later with one click.
  * Backups: "Back up once a day by itself" is on by default (/restore); add an S3-compatible bucket there for
    a copy somewhere else. The Health page (/health) says whether all of this is working.
  * On Nginx: use the NGINX lines above; they open the installer and keep data/ private.
  * One-line install for technical owners:
    curl -fsSL https://ownware.io/install.sh | sh -s -- cyresora <your license key>