Chat's updates for security, db and workflow

deploy/nginx.conf.example

@@ -0,0 +1,28 @@
+# Substitute certificate paths, document root, and PHP socket before installation.
+# This server terminates HTTPS directly. Forwarded headers are not trusted by default.
+server {
+    listen 80;
+    server_name app.myhuntingclubroster.com;
+    return 301 https://app.myhuntingclubroster.com$request_uri;
+}
+server {
+    listen 443 ssl;
+    server_name app.myhuntingclubroster.com;
+    ssl_certificate /etc/ssl/hcr/fullchain.pem;
+    ssl_certificate_key /etc/ssl/hcr/privkey.pem;
+    root /srv/hcr/current;
+    index main.php;
+    autoindex off;
+    client_max_body_size 1m;
+    location ~ ^/(classes|vendor|xml|tables|views|migrations|bin|tests|nbproject|reports|deploy)(/|$) { return 404; }
+    location ~ /\. { return 404; }
+    location ~* \.(json|lock|xml|sql|md|ya?ml|toml|log|cnf|env|zip|bak)$ { return 404; }
+    location = /main.php {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root/main.php;
+        fastcgi_param HTTPS on;
+        fastcgi_pass unix:/run/php/hcr.sock;
+    }
+    location ~ \.php(?:/|$) { return 404; }
+    location / { try_files $uri $uri/ =404; }
+}

deploy/php-production.ini.example

@@ -0,0 +1,11 @@
+display_errors = Off
+log_errors = On
+expose_php = Off
+session.use_strict_mode = 1
+session.use_only_cookies = 1
+session.cookie_httponly = 1
+session.cookie_samesite = Lax
+session.cookie_secure = 1
+; Place logs and session storage outside the document root with restricted access.
+; error_log = /var/log/hcr/php-errors.log
+; session.save_path = /var/lib/hcr/sessions

deploy/runtime-grants.sql.example

@@ -0,0 +1,24 @@
+-- Run as a DBA after provisioning the account with a strong externally managed
+-- password and the correct application host restriction. Do not run from PHP.
+-- Substitute the account/host/database to match the production deployment.
+GRANT SELECT ON huntingclubroster.* TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE, DELETE ON huntingclubroster.users TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE, DELETE ON huntingclubroster.password_resets TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE, DELETE ON huntingclubroster.auth_attempts TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, DELETE ON huntingclubroster.email_verifications TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE, DELETE ON huntingclubroster.alerts TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE, DELETE ON huntingclubroster.dropdowns TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE, DELETE ON huntingclubroster.dropdowntypes TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE, DELETE ON huntingclubroster.notes TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE, DELETE ON huntingclubroster.popovers TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE, DELETE ON huntingclubroster.statuses TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT ON huntingclubroster.journal TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE ON huntingclubroster.clubs TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT, UPDATE ON huntingclubroster.club_memberships TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT ON huntingclubroster.club_seasons TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT ON huntingclubroster.club_dues TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT ON huntingclubroster.club_payments TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT ON huntingclubroster.club_due_adjustments TO 'hcr_runtime'@'app-host.example';
+GRANT INSERT ON huntingclubroster.club_payment_reversals TO 'hcr_runtime'@'app-host.example';
+-- No schema-changing privileges, journal UPDATE/DELETE, or financial UPDATE/DELETE.
+-- Use separate credentials for migrations and backup/restore jobs.