Slotly quickstart: install in minutes

SLOTLY — QUICKSTART
===================

Appointment booking with a public booking page — self-hosted PHP + MySQL/SQLite.


REQUIREMENTS
------------
  - PHP 8.0+ with extensions: pdo, pdo_sqlite (or pdo_mysql), mbstring, openssl, curl, json
  - MySQL 5.7+ OR SQLite 3 (SQLite requires no extra setup — the default)
  - A web server (Apache with mod_rewrite — the shipped .htaccess does the routing — or Nginx with try_files)
  - No Composer packages, no Node, no build step, no external services.


SHARED HOSTING / CPANEL (RECOMMENDED FOR MOST BUYERS)
------------------------------------------------------
1. Upload the contents of the `app/` folder to your web root (e.g. public_html/)
   or a subdirectory (e.g. public_html/slotly/).

2. Make sure this directory is writable by PHP (it holds the SQLite file, uploads and backups):
     data/
     data/backups/

   Via cPanel File Manager: right-click -> Permissions -> set to 755 or 775.
   (If data/ is missing, Slotly creates it on first run.)

3. Visit https://yourdomain.com/install/ in your browser.

4. Fill in the installer:
     - Database: choose MySQL (host, database name, user, password) or SQLite (no setup;
       the file is data/slotly.sqlite)
     - Business name
     - Timezone (every slot is worked out in it)
     - Your name, email and password (the first admin)

5. The installer writes config.php and sends you to the login page.


FIRST STEPS (what to do in the first ten minutes)
-------------------------------------------------
1. Sign in at https://yourdomain.com/admin/login. Enable two-step verification on your own account (any authenticator app; keep the recovery codes).
2. Services and categories: duration, price, tax; coupons if you use them.
3. The team: who can be booked, and their weekly availability — a slot exists only where availability, service length and existing bookings allow.
4. Open your public booking page and book yourself in as a customer; then cancel and reschedule it from the admin side.
5. Set up reminders (cron below) and SMTP in Settings so customers get confirmations.

The manual (docs/MANUAL.md in this download, or the product page on the store) covers every
screen and every rule above, each with the line of source it comes from.


SCHEDULED JOB
-------------
  cron/reminders.php — sends the appointment reminders that are due (mail needs SMTP in Settings). Run it hourly:

    0 * * * * php /path/to/app/cron/reminders.php

  Without the job the application still works; only the scheduled part above does not happen.


VPS / SELF-HOSTED
-----------------
Requirements same as above. Apache example:

  <VirtualHost *:80>
    DocumentRoot /var/www/slotly/app
    <Directory /var/www/slotly/app>
      AllowOverride All
      Require all granted
    </Directory>
  </VirtualHost>

Run the web installer as above. Demo data on a FRESH install only (it wipes what is there):

  php bin/demo.php


DOCKER (QUICK TEST)
-------------------
  The app/ folder ships a Dockerfile (Apache + PHP 8.3, mod_rewrite on):

    docker build -t slotly .
    docker run --rm -p 8080:80 -v slotly-data:/var/www/html/data slotly

  Then visit http://localhost:8080/install/


POST-INSTALL SECURITY CHECKLIST
--------------------------------
  [ ] config.php, data/ and the *.sqlite file are blocked by the shipped .htaccess (Apache).
      On Nginx, deny /data/, /src/, /bin/, /tests/, /controllers/, /views/ and config.php yourself.
  [ ] Open https://yourdomain.com/data/ once — it must answer 403, never a listing.
  [ ] Use HTTPS in production.
  [ ] Keep PHP updated.
  [ ] If you ran bin/demo.php, change or delete the demo accounts before going live.
  [ ] Back up data/ (Settings -> Backups writes to data/backups/).


LOOKING AFTER IT (from 4.0)
---------------------------
  * Updates: open Updates in the menu, save your license key once, press Check for updates.
    Reaching 4.0 from 3.x is the last update by hand: replace the files; config.php and data/ stay.
  * Sample data: the installer offers to start with a sample; remove it later with one click.
  * Backups: "Back up once a day by itself" is on by default (/admin/restore); add an S3-compatible bucket there for
    a copy somewhere else. The Health page (/admin/health) says whether all of this is working.
  * On Nginx: use the server block in the manual ("On Nginx: keep data/ private", https://ownware.io/p/slotly/manual);
    it opens the installer and keeps data/ private.
  * One-line install for technical owners:
    curl -fsSL https://ownware.io/install.sh | sh -s -- slotly <your license key>

CARD PAYMENTS AT BOOKING (OPTIONAL, from 4.1)
---------------------------------------------
  Off until you switch it on. Customers pay a deposit or the full price on Stripe's own page,
  through YOUR Stripe account (Slotly never sees the card and takes no cut).
  1. Stripe -> Developers -> API keys: copy the secret key (sk_test_... to try it first).
  2. Stripe -> Developers -> Webhooks: add https://yourdomain.com/hooks/stripe with the events
     checkout.session.completed, checkout.session.async_payment_succeeded, checkout.session.expired;
     copy its signing secret (whsec_...).
  3. Slotly -> Settings -> Card payments at booking: tick it, paste both, choose the currency, save.
  4. Services -> edit -> Online payment at booking: Deposit by card or Full prepayment by card.
  Refunds are made in your Stripe dashboard; then press Mark refunded on the appointment.
  The manual has the details ("Card deposits and prepayment at booking").


NOTES
-----
  * Repeated failed logins are rate-limited.
  * Backups land in data/backups/ (Settings → Backups).
  * REST API + MCP endpoint for agents: see API.md.