Secreta Quickstart, as shipped in the download

SECRETA — QUICKSTART
====================

REQUIREMENTS
------------
  - PHP 8.0+ with extensions: pdo, pdo_sqlite (or pdo_mysql), openssl
  - MySQL 5.7+ OR SQLite 3 (SQLite requires no extra setup)
  - A web server (Apache with mod_rewrite, or Nginx with try_files)
  - HTTPS in production (required for the browser Web Crypto API)

WHY HTTPS IS NOT OPTIONAL
-------------------------
  Secreta encrypts every secret in the visitor's browser using the Web Crypto API.
  Browsers only expose that API on a "secure context" — i.e. https:// (or http://localhost
  for local testing). Over plain http:// on a real domain, encryption will not run and the
  page shows a warning. Always serve Secreta over https:// in production.


SHARED HOSTING / CPANEL (RECOMMENDED FOR MOST BUYERS)
------------------------------------------------------
1. Upload the contents of the `app/` folder to your web root (e.g. public_html/)
   or a subdirectory (e.g. public_html/secreta/).

2. Make sure the data directory is writable by PHP:
     data/
   Via cPanel File Manager: right-click -> Permissions -> set to 755 or 775.

3. Visit https://yourdomain.com/install/ in your browser.

4. Fill in the installer:
     - Database: choose MySQL (host/name/user/pass) or SQLite (no setup)
     - Team / organization name and timezone
     - Admin email + password (min 8 characters)
   The installer generates a random at-rest encryption key and writes config.php.

5. The installer redirects you to the login page. Sign in.

6. Share your first secret from the home page (/). Send the resulting link — including the
   part after '#' — to your recipient. They can view it once.


VPS / SELF-HOSTED
-----------------
Apache example:

  <VirtualHost *:443>
    ServerName secreta.example.com
    DocumentRoot /var/www/secreta/app
    <Directory /var/www/secreta/app>
      AllowOverride All
      Require all granted
    </Directory>
    # ... your TLS certificate directives ...
  </VirtualHost>

Nginx example (front controller):

  location / { try_files $uri /index.php?$query_string; }
  location ~ \.php$ { include fastcgi_params; fastcgi_pass unix:/run/php/php-fpm.sock;
                      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; }
  location ~ /(config\.php|\.demo-mode|data/|src/|bin/|tests/|controllers/) { deny all; }

Run the web installer as above, or load demo data from the CLI:

  php bin/demo.php    # login: admin@secreta.app / demo1234


DOCKER (QUICK TEST)
-------------------
  docker run --rm -p 8080:8080 \
    -v "$(pwd):/var/www/html" \
    -w /var/www/html \
    php:8.3-cli \
    php -S 0.0.0.0:8080 router.php

  Then visit http://localhost:8080/install/
  (localhost counts as a secure context, so encryption works for local testing.)


RUN THE TESTS
-------------
  docker run --rm -v "$PWD:/app" -w /app php:8.3-cli php tests/run.php
  Expect: ALL <N> TESTS PASSED.


POST-INSTALL SECURITY CHECKLIST
--------------------------------
  [ ] Site is served over HTTPS
  [ ] config.php is protected (the .htaccess does this automatically)
  [ ] data/ is not web-accessible (.htaccess blocks it automatically)
  [ ] Keep PHP updated
  [ ] Back up config.php's `secret` — changing it makes existing at-rest ciphertext unreadable
      (this does not weaken security; secrets are already protected by their browser-only key)


HOW IT WORKS (SHORT VERSION)
----------------------------
  * Secrets are encrypted in the browser (AES-256-GCM). The key goes in the link after '#'
    and is NEVER sent to the server.
  * The server stores only ciphertext (re-encrypted at rest) plus metadata.
  * A secret is destroyed after its view limit or expiry — the ciphertext is overwritten
    then removed.
  * The audit log records events (created/viewed/burned/expired) and salted one-way IP
    hashes — never any secret content, because the server never has it.