# Project configuration

Install the locked PHP dependencies with `composer install --no-dev --optimize-autoloader`. PHPMailer handles authenticated SMTP and phpdotenv loads the project-root `.env` file. `.env.example` documents every setting. An existing `.env` must never be overwritten during deployment. Server/process environment variables take precedence, including explicitly empty values.

The supplied `.env` uses local development defaults. SMTP and Paystack credentials are blank. Fill them in locally; do not commit or share this file. Use `public/` as the production document root. The root Apache rules also block `.env` and Composer metadata when running under WAMP. Configure equivalent restrictions on other servers.

## Email

Set `TIMEPROOF_MAIL_TRANSPORT=smtp`, `TIMEPROOF_MAIL_FROM`, `TIMEPROOF_MAIL_FROM_NAME`, `TIMEPROOF_SMTP_HOST`, `TIMEPROOF_SMTP_PORT`, `TIMEPROOF_SMTP_ENCRYPTION`, `TIMEPROOF_SMTP_USERNAME`, and `TIMEPROOF_SMTP_PASSWORD` using the mail provider's values. Quote passwords in `.env`. Use a provider-approved sender address and configure the domain's SPF/DKIM records as directed by that provider.

Use `tls` for STARTTLS (usually port 587), or `ssl` for implicit TLS (usually port 465). Certificate verification remains enabled. SMTP authentication is required. Unencrypted SMTP is allowed only on localhost in development for testing.

Run `php tools/test_email.php your-address@example.com` to send one test message. A successful response means the SMTP server accepted it; check the inbox and spam folder to verify arrival. No external test mail is sent during automated tests.

Schedule `php cron/send_emails.php` every minute. The outbox tracks delivery attempts, retries after five minutes, and stops after five failures. Inspect failed outbox rows and provider logs if delivery fails. SMTP replies and credentials are not printed in application errors. Development-only `log` transport is still available with `TIMEPROOF_MAIL_LOG` pointing to a private absolute file path.

## Paystack

Set `PAYSTACK_SECRET_KEY` to your `sk_test_...` key while testing. The existing hosted checkout uses the secret key server-side; no public key is required. Test-mode purchases must be completed through Paystack checkout when a test key is configured. Development without a key retains the local payment simulator; production never permits simulated payments.

Set `TIMEPROOF_APP_URL` to the application's real HTTPS base URL. In the Paystack dashboard, configure the webhook URL as `<APP_URL>/actions/payment_webhook.php`. The application supplies `<APP_URL>/actions/payment_callback.php` when initializing checkout. The webhook must be publicly reachable. It verifies Paystack's signature and independently verifies the transaction's reference, amount, currency and success before activating a plan. Repeated notifications cannot activate the purchase twice.

Verify a test purchase, its active subscription and challenge allowance, and the webhook response. Then use the account's live secret key and perform a controlled live purchase. Live activation and provider configuration require your Paystack account; automated local tests cannot prove live payment readiness. Each purchase grants one month of access; automatic recurring charges are not implemented.

## Production

Set `TIMEPROOF_APP_ENV=production`, your HTTPS URL, restricted database credentials, a real sender, SMTP credentials, live payment credentials, and private backup directory/key. Run `php tools/production_check.php`, then verify actual email delivery, payments and scheduled jobs. See `PRODUCTION.md` for the full deployment checklist.

Local checks: `php -d xdebug.mode=off tests/smtp.php` and `php -d xdebug.mode=off tests/integration.php`.