# Wall Dashboard — cPanel setup

A small PHP + MariaDB app that lets you build dashboard **pages** in a browser and
push them to any number of wall **displays**, controlling those displays remotely.

## What's in this folder

**Backend (PHP, runs on cPanel)**

- `config.php` — the only file you edit: your database name, user and password.
- `inc.php` — database connection, session, security helpers, schema auto-creation.
- `api/` — the endpoints: `session`, `login`, `logout`, `pages`, `displays`, `command`, `enrol`, `state`, `proxy`, `token`.
- `schema.sql` — reference only; tables are created automatically on first run.

**Front-end (static, served by the same site)**

- `admin.html` — the management console (login, displays, pages, page builder with live preview).
- `dashboard.js` / `dashboard.css` — the shared render engine and styles.
- `preview.html` — the live-preview pane used inside the builder.
- `dashboard.html` — the standalone single-screen dashboard (no server needed; optional).
- `player.html` — the managed display driver (built in the next round).

## Install (about 10 minutes)

1. **Create the database.** In cPanel → *MySQL® Databases*: create a database, create a
   user, add the user to the database with **All Privileges**. Note the three names cPanel
   gives you (they'll be prefixed with your cPanel username).

2. **Edit `config.php`.** Put the database name, user and password in. Leave
   `cookie_secure` as `true` (cPanel serves HTTPS via AutoSSL).

3. **Upload the files.** Put everything in the web folder you want — either `public_html`
   (site root) or a subfolder like `public_html/wall`. Keep the `api/` folder alongside the
   HTML files. The tables create themselves on the first request.

4. **First run.** Open `admin.html` in a browser. Because no password exists yet, it asks you
   to **create the admin password**. Choose a strong one — it protects everything.

5. **Build a page.** In the console → *Pages* → *New page*. Configure it with the live
   preview beside you, then *Save*.

6. **Add a display.** Power on the wall screen running `player.html`. It generates its own
   secret key, shows a short **pairing code**, and starts polling. In the admin *Displays* tab,
   type that code into *Adopt a display* to adopt it. It then appears as an adopted display —
   assign it a page or a rotating playlist, and use Reload / Identify / Blank / Wake to control
   it. *(The player is being built next round.)*

## Security notes

- **HTTPS is essential** because the console is reachable remotely. cPanel's AutoSSL gives you
  a free certificate — make sure the site loads on `https://` and, ideally, force HTTPS
  (cPanel → *Domains* → *Force HTTPS Redirect*, or an `.htaccess` rewrite).
- The admin password is stored **hashed** (bcrypt). Sessions are HttpOnly cookies; all
  state-changing API calls require a CSRF token; logins are rate-limited per IP.
- Each display mints its own secret key (stored only as a SHA-256 hash on the server) and shows
  a short **pairing code**. A display only becomes active once you, while logged in, adopt it by
  entering that code — so a device can't join itself, and you must be able to see the screen.
- The `proxy.php` endpoint (used to fetch calendar/news feeds server-side) only works for a
  logged-in admin or an enrolled display, and blocks private/loopback addresses — so it can't
  be abused as an open relay.
- Consider protecting the folder further with cPanel *Directory Privacy* (HTTP Basic auth) or
  IP allow-listing in `.htaccess` if you want a second gate in front of the login.

## Optional: standalone mode

`dashboard.html` still works on its own with no backend — open it directly or serve it
anywhere. It stores its config in the browser. Use it for a single screen where you don't need
central management.