Rostera Quickstart, as shipped in the download

ROSTERA — QUICKSTART
====================

Self-hosted staff shift scheduler & rota — PHP + MySQL/SQLite. Plans shifts only
(no payroll, no pay rates, no time clock, no payment processing).


REQUIREMENTS
------------
  - PHP 8.0+ with extensions: pdo, pdo_sqlite (or pdo_mysql)
  - MySQL 5.7+ / MariaDB 10+ OR SQLite 3 (SQLite requires no extra setup)
  - A web server (Apache with mod_rewrite, or Nginx with try_files)
  - No Composer packages, no API keys, no external services.


SHARED HOSTING / CPANEL (RECOMMENDED FOR MOST BUYERS)
------------------------------------------------------
1. Upload the contents of the `app/` folder to your web root (e.g. public_html/)
   or a subdirectory (e.g. public_html/rostera/).

2. Make sure this directory is writable by PHP:
     data/

   Via cPanel File Manager: right-click -> Permissions -> set to 755 or 775.

3. Visit https://yourdomain.com/install/ in your browser.

4. Fill in the installer:
     - Database: choose MySQL (fill in host/name/user/pass) or SQLite (no setup)
     - Business name, timezone, and which weekday the rota week starts on
     - Your admin name, email + password

5. The installer writes config.php and redirects you to the login page.

6. Log in, then:
     - Under Settings, confirm the week start, default shift times and timezone.
     - Add your team under Staff (each with a role and optional weekly target).
     - Open the Weekly rota and add shifts (assigned to a person, or "Open").
     - Publish a week when it's ready — drafts become the confirmed rota.


TRY IT WITH DEMO DATA FIRST
---------------------------
  - On the dashboard, click "Load demo data" for a sample hospitality team and a
    full published week of shifts (including overnight closes that cross midnight
    and a couple of open/unassigned shifts). Then "Reset all data" when done.
  - Or from the command line:  php bin/demo.php
      (login: admin@rostera.app with the one-time password it prints)


VPS / SELF-HOSTED (APACHE)
--------------------------
  <VirtualHost *:80>
    DocumentRoot /var/www/rostera/app
    <Directory /var/www/rostera/app>
      AllowOverride All
      Require all granted
    </Directory>
  </VirtualHost>


NGINX
-----
  root /var/www/rostera/app;
  index index.php;
  location ~ ^/(src|data|bin|tests|controllers|deploy|cron)/ { deny all; }
  location ~ ^/views/.+\.php$ { deny all; }
  location ~ (^|/)(config\.php|\.demo-mode)$|\.sqlite$ { deny all; }
  location = /install/ { rewrite ^ /install/index.php last; }
  location / { try_files $uri /index.php?$query_string; }
  location ~ \.php$ { try_files $uri =404; include fastcgi_params; fastcgi_pass unix:/run/php/php8.3-fpm.sock;
                      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; }


DOCKER (QUICK TEST)
-------------------
  docker run --rm -p 8080:8080 \
    -v "$(pwd)/app:/var/www/html" \
    -w /var/www/html \
    php:8.3-cli \
    php -S 0.0.0.0:8080 router.php

  Then visit http://localhost:8080/install/


SHIFTS, HOURS & DST
-------------------
  - Times use a 24-hour clock (HH:MM). A shift whose end time is at or before its
    start time runs past midnight and is measured across the day boundary.
  - A shift's length is the REAL elapsed time in your business timezone, so a
    shift on a daylight-saving change day counts the correct hours (a lost hour
    in spring, a gained hour in autumn). Weekly totals reflect the true hours.
  - Assigning a shift that overlaps another shift for the same person is blocked
    as a double-booking; a clean back-to-back hand-over is allowed.
  - Weekly hours are summed exactly (times are stored as integer minutes).


REPORTS & EXPORTS
-----------------
  - Weekly rota > Export CSV: every shift in the week, safe to open in Excel /
    Google Sheets (formula-injection hardened).
  - Weekly rota > PDF: a genuine, dependency-free PDF of the week grouped by
    person, with each person's total and a grand total.
  - Hours report: scheduled and published hours per person over any date range,
    with its own CSV export.


POST-INSTALL SECURITY CHECKLIST
--------------------------------
  [ ] config.php is protected (the .htaccess does this automatically)
  [ ] data/ is not web-accessible (.htaccess blocks it automatically)
  [ ] Use HTTPS in production
  [ ] Keep PHP updated


LOOKING AFTER IT (from 4.0)
---------------------------
  * Updates: open Updates in the menu, save your license key once, press Check for updates.
    Reaching 4.0 from 3.x is the last update by hand: replace the files; config.php and data/ stay.
  * Sample data: the installer offers to start with a sample; remove it later with one click.
  * Backups: "Back up once a day by itself" is on by default (/restore); add an S3-compatible bucket there for
    a copy somewhere else. The Health page (/health) says whether all of this is working.
  * On Nginx: use the NGINX lines above; they open the installer and keep data/ private.
  * One-line install for technical owners:
    curl -fsSL https://ownware.io/install.sh | sh -s -- rostera <your license key>

NOTES
-----
  * Clock times are stored as integer minutes-since-midnight and durations as
    whole minutes; no floating-point rounding touches an hours total.
  * Rostera plans shifts only. It is not payroll (no pay rates, no wages, no
    payments) and not a time clock (planned hours, not attendance capture).