# Action Ledger — setup

## Files
- `index.html` — the app (served to users)
- `api.php` — signup / login / logout / load / save (per-user)
- `admin.php` — your control panel for users & expirations
- `weekly_cron.php` — sends each active user a weekly summary
- `config.php` — all your settings & secrets (edit this!)
- `data-folder-htaccess.txt` — rename to `.htaccess`, goes inside `data/`

`backup.php` from before is no longer used — delete it if you uploaded it.

## 1. Edit config.php
Set these:
- `admin_email`  → your inbox (gets a note on every new signup)
- `from_email`   → an address on 331goods.com, e.g. action@331goods.com
- `site_url`     → https://331goods.com
- `admin_key`    → the password you'll type to open admin.php
- `cron_key`     → a long random string (protects the cron URL)

## 2. Upload
Put `index.html`, `api.php`, `admin.php`, `weekly_cron.php`, `config.php`
in the same web folder (your site root). HTTPS must be on — sessions
and the iPhone GPS prompt both require it.

## 3. Protect the data folder
The app creates a `data/` folder on first use. Drop a `.htaccess` inside it
(rename `data-folder-htaccess.txt`) so the JSON files can't be opened in a
browser. PHP still reads them fine. If your host lets PHP create folders,
you can add the .htaccess after the folder appears.

## 4. Schedule the weekly email
In your host's cron panel, add ONE of these (Mondays ~9am shown):

CLI:
    0 9 * * 1 php /home/YOURUSER/public_html/weekly_cron.php

or URL (if cron only does URLs):
    0 9 * * 1 wget -qO- "https://331goods.com/weekly_cron.php?key=YOUR_CRON_KEY"

Test it once by hand: visit
    https://331goods.com/weekly_cron.php?key=YOUR_CRON_KEY
(only users with activity in the last 7 days get an email).

## 5. Manage users
Go to https://331goods.com/admin.php, enter your admin_key, and you can
+2 weeks, set an end date, set no-expiration, expire now, or delete anyone.

## Notes
- New signups get 14 days automatically (change `trial_days` in config).
- PHP mail() can land in spam. Using a from_email on your own domain helps;
  if delivery is flaky, the fix is an SMTP service later — tell me and I'll wire it.
- This is solid hobby-grade security (hashed passwords, protected data, per-user
  files), not a bank. Don't advertise the URL publicly and you're in good shape.