Invora Quickstart, as shipped in the download

INVORA — QUICKSTART
===================

Recurring invoicing with client payment links — self-hosted PHP + MySQL/SQLite, no Composer, no build step.


REQUIREMENTS
------------
  - PHP 8.1+ with extensions: pdo, pdo_sqlite (or pdo_mysql), mbstring, openssl, curl, json
  - MySQL 5.7+ OR SQLite 3 (SQLite requires no extra setup — the default)
  - A web server (Apache with mod_rewrite — the shipped .htaccess does the routing — or Nginx with try_files)
  - No Composer packages, no Node, no build step, no external services.


SHARED HOSTING / CPANEL (RECOMMENDED FOR MOST BUYERS)
------------------------------------------------------
1. Upload the contents of the `app/` folder to your web root (e.g. public_html/)
   or a subdirectory (e.g. public_html/invora/).

2. Make sure this directory is writable by PHP (it holds the SQLite file, uploads and backups):
     data/

   Via cPanel File Manager: right-click -> Permissions -> set to 755 or 775.
   (If data/ is missing, Invora creates it on first run.)

3. Visit https://yourdomain.com/install/ in your browser.

4. Fill in the installer:
     - Database: choose MySQL (host, database name, user, password) or SQLite (no setup;
       the file is data/invora.sqlite)
     - Business name
     - Timezone
     - Your name, email and password (the first admin)

5. The installer writes config.php and sends you to the login page.


FIRST STEPS (what to do in the first ten minutes)
-------------------------------------------------
1. Settings: your logo, address and default tax rate — every PDF and client page uses them.
2. Clients, then Items & Tax: saved items carry their own tax rate, so a line is one click.
3. Create an estimate, convert it to an invoice, send it: the client gets a read-only public link that needs no login, plus your own payment link.
4. Recurring invoices arrive as DRAFTS you approve before anything goes out — never as sent mail.
5. Record a payment and watch paid / partial / overdue status follow from the payments and the due date.
6. Automatic payment reminders are OFF until you switch them on (Settings -> Automatic payment
   reminders). Read the wording, then press "Preview today": it lists exactly which invoice would
   get which message today, and sends nothing. They go through your own SMTP server.

The manual (docs/MANUAL.md in this download, or the product page on the store) covers every
screen and every rule above, each with the line of source it comes from.


VPS / SELF-HOSTED
-----------------
Requirements same as above. Apache example:

  <VirtualHost *:80>
    DocumentRoot /var/www/invora/app
    <Directory /var/www/invora/app>
      AllowOverride All
      Require all granted
    </Directory>
  </VirtualHost>

Run the web installer as above. Demo data on a FRESH install only (it wipes what is there):

  php bin/demo.php


DOCKER (QUICK TEST)
-------------------
  The app/ folder ships a Dockerfile (Apache + PHP 8.3, mod_rewrite on):

    docker build -t invora .
    docker run --rm -p 8080:80 -v invora-data:/var/www/html/data invora

  Then visit http://localhost:8080/install/


POST-INSTALL SECURITY CHECKLIST
--------------------------------
  [ ] config.php, data/ and the *.sqlite file are blocked by the shipped .htaccess (Apache).
      On Nginx, deny /data/, /src/, /bin/, /tests/, /controllers/, /views/ and config.php yourself.
  [ ] Open https://yourdomain.com/data/ once — it must answer 403, never a listing.
  [ ] Use HTTPS in production.
  [ ] Keep PHP updated.
  [ ] If you ran bin/demo.php, change or delete the demo accounts before going live.
  [ ] Back up data/ (Settings -> Backups writes to data/backups/).


NOTES
-----
  * The PDF writer is written from scratch — nothing to install beside PHP.
  * Schema migrations run on every request and are safe to repeat: upgrading is replacing the files.
  * Attached files are served from /files/{id} and stored under data/; keep data/ writable and backed up.
  * REST API, signed webhooks and an MCP endpoint for agents (no send tool, no delete tool): see API.md.
  * Automatic reminders ride normal page loads; an install nobody visits can call
    /cron/reminders?t=<ops token> from its scheduler (the same token as /cron/recurring).