# BarberShop — install on hosting

This is the **generic shop zip**: the same files every buyer uploads. Shop identity lives in the database, not in PHP.

Your live URL:

**`https://YOURSHOP.barber-shop.us/`**

Charlie’s (`charlies.barber-shop.us`) is the production test sale. A new owner uses this same zip and sets **their** slug (step 4).

Starter photos are in `uploads/tenant_1/` and match `sql/install.sql`. Keep that folder when you unzip.

## What to upload

Unzip so **`index.php` is at the document root** of the shop subdomain.

Do **not** nest a second folder. After upload you should see:

`https://YOURSHOP.barber-shop.us/index.php`

## Hosting checklist

1. **Subdomain** `YOURSHOP.barber-shop.us` → document root such as `public_html/YOURSHOP` (or the auto-created subdomain folder).
2. **SSL** on that subdomain (AutoSSL).
3. **MySQL** database + user. Grant the user all privileges on that DB only.
4. phpMyAdmin → select that DB → **Import** `sql/install.sql`.
5. Edit `sql/set-shop-slug.sql` so the slug matches `YOURSHOP`, then Import it.
6. Copy `config/db.local.example.php` to `config/db.local.php` and fill cPanel DB name/user/password. Keep `'APP_BASE' => ''`. Set `'REMINDER_EMAIL_FROM'` to an address on this hostname.
7. Make `uploads/` and `storage/` writable (0755 or 0775). Confirm `uploads/tenant_1/` is present.

## Two user types

| Role | Where they sign in | Seed login (change after go-live) |
|------|--------------------|-----------------------------------|
| **Owner (admin)** | `https://YOURSHOP.barber-shop.us/admin/login.php` | `admin` / `password32` |
| **Customer (user)** | Site “My account”, or the Android app | `sam@charlies.barber-shop.us` / `customer32` |

The Android app is a **customer** client. Owner accounts are rejected there on purpose. Each shop is a tenant. Customers in `users` are scoped by `tenant_id`.

Hostname routing: `{slug}.barber-shop.us` looks up `tenants.subdomain`. If they do not match, the site still loads the first tenant as a fallback — still set the slug so the Android shop name is correct.

## Android app for your clients

Customers download from the **parent** site (one APK for every shop):

**https://barber-shop.us/download-app.php**

Your zip also includes `/download-app.php`, which shows **this shop’s name** and sends them to that APK.

On first launch they enter **`YOURSHOP`** (opens `https://YOURSHOP.barber-shop.us/`).

Android will show Chrome / unknown-source / Play Protect warnings until the app is on Google Play. That is expected for a site download. Full explanation: `README.md`.

Play-related items already in the app:

- HTTPS only (no cleartext)
- Privacy policy: https://barber-shop.us/privacy.php
- In-app account deletion (Account → Delete account)
- `allowBackup="false"`

## After upload — owner edits

1. Admin → **Branding**: replace **Company Name Here**. Confirm **Subdomain** is `YOURSHOP`.
2. Admin → **Page Content**: replace **Title Here**, address, phone, SEO.
3. Admin → **Media**: starter photos already live in `uploads/tenant_1/`. Replace any you do not want.
4. Change the owner password. Delete or rename the seed customer.
